July 18 Working Call

["Wunder, John A." <jwunder@mitre.org>]

Hi all,

 

For the July 18 working call we’re going to spend some time on one question about location and then continue our focus on event:

 

1. For the latitude and longitude on location we currently don’t have a precision defined. Do we need to add one, and if so is it required or optional? If optional, is there a default? Or if we don’t include it, do we need a statement saying it’s approximate?
2. We have fields for event_type, event_status, and labels. Is this the right set of fields to capture that data? Are the values what we want? What goes in labels?

Event Type: Event, Investigation, or Incident

Event Status: Open, Closed-Resolved, Closed-False-Positive, Triaged, Contained, Mitigated, Remediated, In-Remediation, Dismissed

Labels: (None defined yet)

3. At the F2F we had consensus that most actual impact should be scoped out, with the exception of a high level intended effect and some counts for items impacted. Does that work for the broader community?
   1. What counts do we include?
   2. How do we cover monetary cost, which isn’t just a simple count like the others (because you need a currency unit)

 

You can see the current status of the event object here: https://docs.google.com/document/d/15qD9KBQcVcY4FlG9n_VGhqacaeiLlNcQ7zVEjc8I3b4/edit#heading=h.8etbi9afk5u9

 

The location precision thing was discussed in the Slack #location channel, let me know if you need to be added to the Slack team.

 

John