Subject: [sacm] SACM IM Terminology/Glossary

From: Henk Birkholz <[email-masked]>
Date: Mon, 15 Sep 2014 14:54:34 +0200

Hello!

my action item was to create an updated list of terms found in the 
current combined SACM IM draft 
(draft-combined-sacm-information-model-00). This list of terms is 
intended to focus a discussion on global terminology: which terms might 
already be defined in other places, which might be redundant or 
conflicting, which might be appropriate and which might have to be 
reconsidered.

Some of the terms already are in the process of being discussed (e.g. 
task, process & activity) and relationships between singular terms (e.g. 
attribute and event, or device and endpoint) seem to be an important 
topic (in order to convey the "bigger picture").
Some of the terms highlighted are now located in the appendices and 
therefore could potentially move to the corresponding SACM drafts.

As a default, terms that are agreed upon could be covered in the 
terminology draft (draft-ietf-sacm-terminology-05) or--alternatively-- 
be defined in the drafts they are used in. We do not have to decide this 
now and can work on the terms themselves.

Please feel free to suggest new terms or comment on having them removed 
if there seems to be no actual need to provide (or improve) an explicit 
definition.

Sincerely,

Henk

---

[Terms listed include a reference and an example of their usage in the 
combined SACM IM draft.]

- configuration (e.g. Abstract: "model for aggregated configuration and 
operational data")
- operation (e.g. 1. "technology that performs operations to support 
collection")
- report (e.g. 1. "to support collection, evaluation, and reporting")
- policy (e.g. 1. "4. Policy evaluation expression")
- activity (e.g. 2. "The activities and processes described within this 
document")
- process (e.g. 2. "The activities and processes described within this 
document")
- network interface (e.g. 4. Figure 1)
- address (e.g. 4.4.1. A network session generally is associated with 
addresses, such as MAC and IP addresses.)
- value (e.g. 4.7.7. "expected values for the data elements and attributes")
- attribute value (e.g. 4.7.7. "an acceptable data element or attribute 
value")
- event (e.g. 4.7.7. "In contrast, an *event* occurs at a moment in time.")
- guidance (e.g. 4.13. "Guidance is generally configurable by human 
administrators")
- task (e.g. 4.13.5. "A Reporting Task typically needs Reporting Guidance")
- metadata (e.g. 5.5. "A metadata item is the basic unit of information, 
and is attached to an identifier or to a link.")
- status (e.g. C.1. "status of the endpoint")
- entity (e.g. C.2. "Every entity (human or machine) that notifies, 
queries, or")
- continuous monitoring (e.g. C.2. "Operators of a continuous monitoring 
or security automation system")
- trigger (e.g. C.2. "Guidance may be retrieved in event of a collection 
or evaluation trigger")
- component (e.g. C.3. "core architectural components as the basis for 
determining information elements")
- expression (e.g. D.1. "sustainable collection, expression, and 
evaluation")
- device (e.g. D.1. "what devices are on the network")
- data element (e.g. D.2. "This requires populating the data elements 
and attributes")
- collected instances (e.g. D.2. "the actual collected instances of 
asset data")
- state (e.g. E.3.2.1.1.2.1. "State(platform specific): A generalized 
construct that is extended in platform schema")