Minutes IETF104: mile
minutes-104-mile-00

Managed Incident Lightweight Exchange (MILE)

Tuesday Morning session II
11:20-12:20, March 26, 2019 (Prague)

Room: Karlin 3

--------------------------------------------------------------------------
MILE status
co-chairs                                                         -  5 mins

XMPP draft status
[draft-ietf-mile-xmpp-grid-10]
Nancy Cam Winget                                                  - 10 mins

JSON IODEF
[draft-ietf-mile-jsoniodef-07]
Takeshi Takahashi                                                 - 10 mins

Rolie draft status
[draft-ietf-mile-rolie-csirt-00]
Stephen Banghart                                                  - 10 mins

AOB                                                               - 10 mins
--------------------------------------------------------------------------

Total:                                                              45 mins

Volunteers:
  Note Takers: David Waltermire and Chris Inacio
  Jabber scribe: Stephen Banghart

Notes:

WG status
https://datatracker.ietf.org/meeting/104/materials/slides-104-mile-mile-status-overview-00
--------------------------------------------------------------------------
Stephen Banghart -  ( :) ) was ok with the April 2019 ROLIE CSIRT milestone for
WGLC

XMPP draft status - Nancy Cam-Winget
https://datatracker.ietf.org/meeting/104/materials/slides-104-mile-draft-ietf-mile-xmpp-grid-10-00
[draft-ietf-mile-xmpp-grid-10]
--------------------------------------------------------------------------
AD - standard vs. information, this is an edge case; if editor has a strong
preference, we should use it. Stephen. Banghart - flexible on std vs.
informational; didn't have a lot of normative language previously Alexy - There
are additional requirements above XMPP, which makes it more like a standards
track Kathleen Moriarty - concurs; has more normative language; (advising that
could approve document and send last set of edits via RFC editor note) Nancy -
Not sure there is enough time to address Ben's Discuss before the Plenary.
Might run out of time. AD - Nancy, you should ask Ben if he will have time to
review.

JSON IODEF - Takeshi Takahashi
https://datatracker.ietf.org/meeting/104/materials/slides-104-mile-draft-ietf-mile-jsoniodef-07-01
[draft-ietf-mile-jsoniodef-07]
--------------------------------------------------------------------------
Take needs a clean version of the XML for IODEFv2 / RFC7970
Kathleen Moriarity - You can get that from teh RFC editor
Waltermire - does RFC editor version. have erata applied?
Kathleen -  RFC editor should have updated version
Chair -  in process of mapping to CDDL/JSON, more errors were found in 7970 XML
Kathleen - publish errata, then you can get process to do a bis on the document
Kathleen - 7970-bis would be  fast if the changes are limited to applying
errata; this would only require review by the experts since this approach is
just veryifying documented mistakes

Nancy - an IANA registry can be used to provide extensibility
Chris Inacio - If an IANA registry is added for JSON, these need to be made
available for XML IODEF Dave  Waltermire. -  example about CDDL was w/ CoSWID
(coauthor for that). creating that registry. for CoSWID in order to keep.
CoSWID. in. sync. with ISO. based SWID. standard,  to. avoid divergence.
Stephen. Banghart - its a tag value registry or more? Waltermire - no there
are. more values which provide roles, etc. so they provide ability. to. sync
without new. drafts Banghart -  Is this about adding the CDDL (schema) in the
IANA registry? I recommend just including the CDDL in an appendix; this is
option #1 on slide #3.

Rolie draft status - Stephen Banghart
[draft-ietf-mile-rolie-csirt-00]
--------------------------------------------------------------------------
Kathleen Moriarty - what standard about developed in Europe that is gaining
traction; (Need to lookup standard name from CARIS workshop Mirjam's TF-CSIRT
presentation?) Banghart - (1) can we do it?  Yes Banghart - Need a few hours on
the phone with someone who knows the format Waltermire. - Option C - update the
draft when we learn about it Chair. -  The point of. the document is to show
how. people to use ROLIE to. coordinate these data. types (as exemplars) so we
don't need to wait Options - (A) publish as is (B) split for. more support for
STIX & IODEF (C) publish and do update (D) ...

Chair - does working group object to having this in one document
room. - no objections
Chair -  does the working group want to include the third format?

Chair - Kathleen will find the new format (MISP -
https://www.misp-project.org/) and email the list before the end of the week;
Stephen will move forward with a single draft, allowing some time to include
the additional format; WGLC on next revision

Take. -  VDO is really good work (independent of MILE) and CVE has real
problems when applying machine learning techniques;  so I am very supportive of
this work Chair -  Is. the group interested in working on this document in
MILE? Waltermire. - general room concensus, yes do the work, as long as the
work gets a home, MILE is fine Chair -  is anyone willing to. coauthor?
Waltermire -  I will help co-author

Chair. - Who would be interested in reviewing the vulnerability work?
Takeshi Takahashi, Jessica Fitzgerald-McKay, Kathleen Moriarity volunteered.

Waltermire. - can we do adoption comments on. the list with respect to time.
and. document. status?

Chair - working group. will adopt document
Banghart - will submit updated document to working group in 1-2 weeks
Chair - preliminary review after document for working group document

AOB
--------------------------------------------------------------------------

Milestones - WGLC for ROLIE csirt extension by 3rd week of April
Kathleen Moriarty will review draft
Chris Inacio will review draft

TT,  JF-M,  KM - mid-May will work for reviews.