Modifications to the SLPF based on discussions at the face to face

["Brule, Joseph M" <jmbrule@radium.ncsc.mil>]

All,

 

Based on discussions at the Face to Face, I made the following suggestions to the SLPF profile (https://docs.google.com/document/d/1F8mcrs029uYgPLHD1VrziX_eQWPauq3fWm_0h485yuk/edit#heading=h.xz68b4sikhgw ). 

 

If you were at the face to face, please confirm that I captured the gist of the discussions in the attempted resolution and provide additional suggestions and comments.  If you were not at the face to face, please review the comment and let me know if the reason for the change is not clear.  Also, provide additional suggestions and comments. 

 

• Move the text from Section 1 to 1.1 and new text in section 1 to indicate how the different OpenC2 specifications relate to each other.
• Removed sections 2.1.2.1 through 2.1.2.3 in their entirety.   The 'query access_rules' command was determined to be beyond the scope of the openc2 SLPF profile.  The discussion at the face to face was quite lengthy, but we essentially converged on the conclusion that openc2 is intended to respond to cyber event(s) and NOT intended to replace firewall configuration and management. 
• To be supplied, will need a target that supports the 'delete rule number' rather than issue contrary command (such as issue a deny to counteract a previous allow)
• Removed the 'prepend' command argument.  We converged on the conclusion that openc2 is intended to issue a deny (or allow) and that the actuator will 'know' how to properly place the rule in its rule set. 
• Removed the SLPF specifier that was NFV that is a list.  Modern cloud based providers can accommodate a single unique identifier via a string.
• JADN and the tables convey the same information, however in the event of a conflict, the tables are authoritative.  The text in the conformance section (3.1, appendix 1 and appendix 2) 
• Removed section 2.2.2 in its entirety due to the removal of the query access_rules command and associated response
• Modified the conformance section to identify the message fabric. 

 

Thank you

 

VR

 

Joe B