Subject: Re: [sacm] [sacmwg/draft-ietf-sacm-information-model] create IEs for Vulnerability Assessment Scenario information needs (#43)

From: Danny Haynes <[email-masked]>
Date: Thu, 27 Apr 2017 07:48:29 -0700

Closed #43 via 05168d9eb33a6bdc1bcd91907769e30839ea42be.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/43#event-1060549277

---

From: Danny Haynes <[email-masked]>
Date: Thu, 27 Apr 2017 08:20:08 -0700

o Collection date/time - see collectionTimestamp.
o Endpoint type - see endpointType.
o Hardware version/firmware - see softwareInstance.
o Operating system - see softwareInstance.
o Operating system attributes - see softwareInstance.
o Installed software name - see softwareInstance.
o Installed software attributes - see softwareInstance. Install path should be covered by (https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/76).
o Open ports/enabled services - see portInfo, inetd, internetService, etc.
o Operating system optional component inventory - see softwareInstance class other and applicationComponent.
o Location - see locationName, networkZoneLocation, layer2NetworkLocation, layer3NetworkLocation, WGS84Longitude, WGS84Latitude. 
o Purpose - see endpointPurpose.
o Criticality - see endpointCriticality.
o File system attributes - see file.
o Shared libraries - see applicationComponent. Should also be addressed by Install path should be covered by (https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/76).
o Other software configuration information - see registryKey and other OVAL-based IEs.
o Ingest Date - see ingestTimestamp.
o Date of Release - see publicationTimestamp.
o Version - see vulnerabilityVersion.
o External vuln ID - see vulnerabilityExternalId.
o Severity Score - see vulnerabilitySeverity.
o Date of assessment - see assessmentTimestamp.
o Date of data collection - see collectionTimestamp.
o Endpoint identification and/or locally assigned ID - see targetEndpointIdentifier and targetEndpointLabel. 
o Vulnerable software product(s) - see vulnerableSoftware.
o Endpoint vulnerability status - see endpointVulnerabilityStatus.
o Vulnerability description - see vulnerabilityDescription.
o Vulnerability remediation - may be part of vulnerabilityDescription. Also, see patchId and patchName.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/43#issuecomment-297746680

---

From: Jerome Athias <[email-masked]>
Date: Fri, 28 Apr 2017 00:45:02 -0700

Note for the future
Warning regarding "Date of assessment - see assessmentTimestamp.", we would have to support/record information related to the assessment, in particular the - Profile - (important in compliance context) 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/43#issuecomment-297931407