%% You should probably cite draft-teague-open-threat-signaling-01 instead of this revision. @techreport{teague-open-threat-signaling-00, number = {draft-teague-open-threat-signaling-00}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-teague-open-threat-signaling/00/}, author = {Nik Teague}, title = {{Open Threat Signaling using RPC API over HTTPS and IPFIX}}, pagetotal = 15, year = 2015, month = jan, day = 14, abstract = {This document defines a method by which a device or application may signal information relating to current threat handling to other devices/applications that may reside locally or in the cloud. The initial focus is ddos mitigation; however, the method may be extended to communicate any threat type. This will allow for a vendor or provider agnostic approach to threat mitigation utilising multiple layers of protection as the operator sees fit. The dissemination of threat information will occur utilising JSON RPC API over HTTPS communications between devices/applications and will be augmented by IPFIX and UDP for signaling telemetry information relating to attacks and protected object data. An open standards based approach to communication between on-premise DDoS mitigation devices and cloud based DDoS protection services allows for enterprises to have a wider range of options to better secure their environments without the limitations of vendor lock-in.}, }