Subject: [mile] [Technical Errata Reported] RFC7970 (5583)

From: RFC Errata System <[email-masked]>
Date: Tue, 25 Dec 2018 03:21:49 -0800 (PST)

The following errata report has been submitted for RFC7970,
"The Incident Object Description Exchange Format Version 2".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5583

--------------------------------------
Type: Technical
Reported by: Takeshi Takahashi <[email-masked]>

Section: 8

Original Text
-------------
    <xs:simpleType name="action-type">
      <xs:restriction base="xs:NMTOKEN">
        <xs:enumeration value="nothing"/>
        <xs:enumeration value="contact-source-site"/>
        <xs:enumeration value="contact-target-site"/>
        <xs:enumeration value="contact-sender"/>
        <xs:enumeration value="investigate"/>
        <xs:enumeration value="block-host"/>
        <xs:enumeration value="block-network"/>
        <xs:enumeration value="block-port"/>
        <xs:enumeration value="rate-limit-host"/>
        <xs:enumeration value="rate-limit-network"/>
        <xs:enumeration value="rate-limit-port"/>
        <xs:enumeration value="redirect-traffic"/>
        <xs:enumeration value="honeypot"/>
        <xs:enumeration value="upgrade-software"/>
        <xs:enumeration value="rebuild-asset"/>
        <xs:enumeration value="harden-asset"/>
        <xs:enumeration value="remediate-other"/>
        <xs:enumeration value="status-triage"/>
        <xs:enumeration value="status-new-info"/>
        <xs:enumeration value="watch-and-report"/>
        <xs:enumeration value="defined-coa"/>

Corrected Text
--------------
    <xs:simpleType name="action-type">
      <xs:restriction base="xs:NMTOKEN">
        <xs:enumeration value="nothing"/>
        <xs:enumeration value="contact-source-site"/>
        <xs:enumeration value="contact-target-site"/>
        <xs:enumeration value="contact-sender"/>
        <xs:enumeration value="investigate"/>
        <xs:enumeration value="block-host"/>
        <xs:enumeration value="block-network"/>
        <xs:enumeration value="block-port"/>
        <xs:enumeration value="rate-limit-host"/>
        <xs:enumeration value="rate-limit-network"/>
        <xs:enumeration value="rate-limit-port"/>
        <xs:enumeration value="redirect-traffic"/>
        <xs:enumeration value="honeypot"/>
        <xs:enumeration value="upgrade-software"/>
        <xs:enumeration value="rebuild-asset"/>
        <xs:enumeration value="harden-asset"/>
        <xs:enumeration value="remediate-other"/>
        <xs:enumeration value="status-triage"/>
        <xs:enumeration value="status-new-info"/>
        <xs:enumeration value="watch-and-report"/>
        <xs:enumeration value="training"/>
        <xs:enumeration value="defined-coa"/>

Notes
-----
the mainbody text in Section 3.1.5 allows the action attribute to have "training" value, but the schema was inconsistent. The inconsistency was solved by the errata.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7970 (draft-ietf-mile-rfc5070-bis-26)
--------------------------------------
Title               : The Incident Object Description Exchange Format Version 2
Publication Date    : November 2016
Author(s)           : R. Danyliw
Category            : PROPOSED STANDARD
Source              : Managed Incident Lightweight Exchange
Area                : Security
Stream              : IETF
Verifying Party     : IESG