Subject: [mile] DNS fields

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 6 Mar 2013 10:37:56 -0500

Hi,

In trying to figure out how to represent DNS information when exchanging indicators, there seems to be a few options and I'd like to hear opinions to guide direction.

Ideally, we would be able to directly reference the DomainData class of RFC5901 as it did a really good job of capturing what is needed for DNS during an event.  If the event is not phishing, the required header information for the phishing schema may be out of place.  The only thing that appears to be missing (from use case descriptions) is additional DNS record types (PTR, MX, CNAME, TXT, etc.).  It would be nice if we could just reference the DomainData class in the IODEF Node class to associate the NodeName provided with the related data, then just add an element for related DNS with an attribute that lets you select the record type.

Since we can't reference it directly, there are a few options (in no particular order):
a.      Do we change RFC5901 so we can reference portions of the schema directly (like we do for the W3C digital signature schema in RFC5070bis)?
b.      Do we use RFC5901 as an extension and maybe add more LureSource types and let it escape the boundary of being use case specific in case DNS information is needed when sharing indicators related to other types of attacks?
c.      Do we pull in DomainData and its children into IODEF?
d.      Is there another schema that should be considered for this that is also in use (RFC5901 is in use by at least APWG and possibly CIF)?

Or are there other ideas of how this should be handled?

Thank you,
Kathleen