oasis-tcs / openc2-oc2ls

OASIS OpenC2 TC: GitHub repository used to propose and track changes to the OpenC2 Language Specification as new working draft level revisions are created and the associated CSDs mature
https://github.com/oasis-tcs/openc2-oc2ls
Other
15 stars 19 forks source link

Add comment/description for Command Argument #369

Closed alevere closed 2 years ago

alevere commented 4 years ago

There is often a need to annotate an action that was taken. This could simply be a description of such as 'bad host' or could reference a ticket number such as 'INC00023', where the ticket tracks the request and approval process. Most devices implementing commands support some type of a comment that can be later reviewed by a person but is not used in logic or decision making by a computer. This is often an ASCII string between 64-1024 characters. Another person suggested 'note' instead of comment as the field.

dlemire60 commented 2 years ago

discussed a triage; exception to general rule about features appearing in multiple APs; sensible addition; address in next version. @dlemire60 to address

dlemire60 commented 2 years ago

@alevere, @davaya, @Vasileios-Mavroeidis -- I'm trying to make sure I interpret and respond to this comment correctly. I don't see any issue or PR related to this in any of the three packet filtering APs, so there's no history to draw on here.

To confirm: The request is to add an argument type to the LS "to annotate an action that was taken"? The PF AP (at least as of PR 20) includes an AP-specific argument description that appears to serve this purpose (table 2.1.3-2):

ID | Name | Type | # | Description -- | -- | -- | -- | -- 1029 | description | String | 0..1 | A note to annotate or provide information regarding the rule.

Is the goal to add that argument type to the LS so that all APs can use it without specifying it individually? Assuming "yes", candidate names for this argument could be:

I think any of those are reasonable, but note seems a little vague / bland. description is in the PF AP draft but since that's not yet a CS I think there's freedom to choose something different.

dlemire60 commented 2 years ago

addressed in PR #395 -- closing this issue.