Subject: [sacm] Poll on Scope

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 21 Nov 2012 09:38:13 -0500

Hello All,

Question: Do you agree that narrowing the scope to UC1, while leaving the design open to accommodate other use cases is the right approach for SACM?

This poll will close in two weeks from today, December 5, 2012.  
Reply with +1 if you agree or alternate options for considerations if you disagree.

Thank you!
Kathleen

---

From: Adam Montville <[email-masked]>
Date: Wed, 21 Nov 2012 14:43:09 +0000

> Question: Do you agree that narrowing the scope to UC1, while leaving the design open to accommodate other use cases is the right approach for SACM?

+1, Yes.

> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Tim Keanini <[email-masked]>
Date: Wed, 21 Nov 2012 14:45:52 +0000

+1

Chief Research Officer, nCircle...blog: patterns.ncircle.com...mbl: 415.328.2722...twtr: @tkeanini

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Wednesday, November 21, 2012 8:38 AM
To: [email-masked]
Subject: [sacm] Poll on Scope

Hello All,

Thank you!
Kathleen

---

From: "Booth, Harold" <[email-masked]>
Date: Wed, 21 Nov 2012 09:55:54 -0500

Yes, +1

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Wednesday, November 21, 2012 9:38 AM
To: [email-masked]
Subject: [sacm] Poll on Scope

Hello All,

Thank you!
Kathleen

---

From: Stephen Hanna <[email-masked]>
Date: Wed, 21 Nov 2012 15:09:22 +0000

+1

Steve

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Booth, Harold
> Sent: Wednesday, November 21, 2012 9:56 AM
> To: Moriarty, Kathleen; [email-masked]
> Subject: Re: [sacm] Poll on Scope
> 
> Yes, +1
> 
> Question: Do you agree that narrowing the scope to UC1, while leaving
> the design open to accommodate other use cases is the right approach
> for SACM?
> 
> 
>

---

From: "Whitlock, Stephen" <[email-masked]>
Date: Wed, 21 Nov 2012 07:13:38 -0800

+1

Steve Whitlock

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Wednesday, November 21, 2012 6:38 AM
To: [email-masked]
Subject: [sacm] Poll on Scope

Hello All,

Thank you!
Kathleen

---

From: "Chandrashekhar B" <[email-masked]>
Date: Wed, 21 Nov 2012 21:03:42 +0530

+1

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Moriarty, Kathleen
Sent: Wednesday, November 21, 2012 8:08 PM
To: [email-masked]
Subject: [sacm] Poll on Scope

Hello All,

Question: Do you agree that narrowing the scope to UC1, while leaving the
design open to accommodate other use cases is the right approach for SACM?

This poll will close in two weeks from today, December 5, 2012.  
Reply with +1 if you agree or alternate options for considerations if you
disagree.

Thank you!
Kathleen
_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 2013.0.2793 / Virus Database: 2629/5900 - Release Date: 11/16/12

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 21 Nov 2012 10:54:41 -0500

Yes, +1.

Dave

---

From: Randal Taylor <[email-masked]>
Date: Wed, 21 Nov 2012 11:26:13 -0500

+1

Randy

---

From: Gunnar Engelbach <[email-masked]>
Date: Wed, 21 Nov 2012 11:34:28 -0500

I'm neutral.  I'm fine with keeping the larger scope, but don't see any 
harm in narrowing the scope to start with.

--gun

---

From: Gary Gapinski <[email-masked]>
Date: Wed, 21 Nov 2012 11:57:42 -0500

+1

---

From: Gene Golovinsky <[email-masked]>
Date: Wed, 21 Nov 2012 09:28:55 -0800

Hi All.
I just responded +1, but I would like to make sure that we do not lose
sight and track of including SP use cases in the near future and making
sure we really address "continues" monitoring by gathering asset events,
for example.

Cheers.
--Gene

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Moriarty, Kathleen
Sent: Wednesday, November 21, 2012 06:38 AM
To: [email-masked]
Subject: [sacm] Poll on Scope

Hello All,

Thank you!
Kathleen

---

From: "Baker, Jon" <[email-masked]>
Date: Fri, 23 Nov 2012 12:42:56 +0000

yes

Jon

============================================
Jonathan O. Baker
G022 - IA Industry Collaboration
The MITRE Corporation
Email: [email-masked]

---

From: "Nunez, Luis K" <[email-masked]>
Date: Mon, 26 Nov 2012 13:01:46 +0000

+1

-ln

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Baker, Jon
Sent: Friday, November 23, 2012 7:43 AM
To: Moriarty, Kathleen; [email-masked]
Subject: Re: [sacm] Poll on Scope

yes

Jon

---

From: <[email-masked]>
Date: Mon, 26 Nov 2012 15:19:36 +0000

+1

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: <Moriarty>, Kathleen Moriarty <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, November 21, 2012 8:38 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [sacm] Poll on Scope

Hello All,

Thank you!
Kathleen
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: Anton Chuvakin <[email-masked]>
Date: Tue, 27 Nov 2012 11:53:12 -0800

> Question: Do you agree that narrowing the scope to UC1, while leaving the design open to accommodate other use cases is the right approach for SACM?

Yes, +1.  It is more useful to focus on assessment and not dabble into
logs and other adjacent areas (yet)

-- 
Dr. Anton Chuvakin
Site: http://www.chuvakin.org
Twitter: @anton_chuvakin
Work: http://www.linkedin.com/in/chuvakin

---

From: Gene Golovinsky <[email-masked]>
Date: Tue, 27 Nov 2012 12:51:59 -0800

logs and other adjacent areas (yet)
[Gene Golovinsky] Anton, assessment is necessary, but insufficient for
continues monitoring. I really do not agree with calling logs "other
adjacent areas". Besides, you seem to be assuming certain implementation
way before we are done defining problem. Although, I personally would
agree that IMHO logs are a part of CM.

Cheers.
--Gene