One document matched: draft-ietf-sacm-information-model-07.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "http://xml2rfc.ietf.org/authoring/rfc2629.dtd" [
<!-- One method to get references from the online citation libraries.
There has to be one entity for each item to be referenced.
An alternate method (rfc include) is described in the references. -->
<!ENTITY RFC0791 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.0791.xml">
<!ENTITY RFC2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC2434 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2434.xml">
<!ENTITY RFC3411 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3411.xml">
<!ENTITY RFC3416 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3416.xml">
<!ENTITY RFC3418 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3418.xml">
<!ENTITY RFC3580 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3580.xml">
<!ENTITY RFC3580 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3580.xml">
<!ENTITY RFC3587 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3587.xml">
<!ENTITY RFC4949 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4949.xml">
<!ENTITY RFC4287 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4287.xml">
<!ENTITY RFC5209 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5209.xml">
<!ENTITY RFC5792 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5792.xml">
<!ENTITY RFC5793 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5793.xml">
<!ENTITY RFC6020 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6020.xml">
<!ENTITY RFC6241 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6241.xml">
<!ENTITY RFC6313 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6313.xml">
<!ENTITY RFC6876 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6876.xml">
<!ENTITY RFC7012 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7012.xml">
<!ENTITY RFC7013 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7013.xml">
<!ENTITY RFC7171 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7171.xml">
<!ENTITY RFC7632 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7632.xml">
<!ENTITY I-D.ietf-sacm-terminology SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.draft-ietf-sacm-terminology-05.xml">
<!ENTITY I-D.ietf-sacm-requirements SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.draft-ietf-sacm-requirements-01.xml">
<!ENTITY I-D.ietf-sacm-architecture SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.draft-ietf-sacm-architecture-00.xml">
<!ENTITY W3C.REC-soap12-part1-20070427 SYSTEM "http://xml2rfc.ietf.org/public/rfc/bibxml4/reference.W3C.REC-soap12-part1-20070427.xml">
<!ENTITY W3C.REC-rdf11-concepts-20140225 SYSTEM "http://xml2rfc.ietf.org/public/rfc/bibxml4/reference.W3C.REC-rdf11-concepts-20140225.xml">
]>
<?xml-stylesheet type='text/xsl' href='http://xml2rfc.ietf.org/authoring/rfc2629.xslt' ?>
<!-- used by XSLT processors -->
<!-- For a complete list and description of processing instructions (PIs),
please see http://xml.resource.org/authoring/README.html. -->
<!-- Below are generally applicable Processing Instructions (PIs) that most I-Ds might want to use.
(Here they are set differently than their defaults in xml2rfc v1.32) -->
<?rfc strict="yes" ?>
<!-- give errors regarding ID-nits and DTD validation -->
<!-- control the table of contents (ToC) -->
<?rfc toc="yes"?>
<!-- generate a ToC -->
<?rfc tocdepth="4"?>
<!-- the number of levels of subsections in ToC. default: 3 -->
<!-- control references -->
<?rfc symrefs="yes"?>
<!-- use symbolic references tags, i.e, [RFC2119] instead of <xref target="TNC-Architecture"/> -->
<?rfc sortrefs="yes" ?>
<!-- sort the reference entries alphabetically -->
<!-- control vertical white space
(using these PIs as follows is recommended by the RFC Editor) -->
<?rfc compact="yes" ?>
<!-- do not start each main section on a new page -->
<?rfc subcompact="no" ?>
<!-- keep one blank line between list items -->
<!-- end of list of popular I-D processing instructions -->
<rfc category="std" docName="draft-ietf-sacm-information-model-07" ipr="trust200902">
<!-- category values: std, bcp, info, exp, and historic
ipr values: full3667, noModification3667, noDerivatives3667
you can add the attributes updates="NNNN" and obsoletes="NNNN"
they will automatically be output with "(if approved)" -->
<!-- ***** FRONT MATTER ***** -->
<front>
<!-- The abbreviated title is used in the page header - it is only necessary if the
full title is longer than 39 characters -->
<title abbrev="SACM Information Model">SACM Information Model</title>
<author fullname="David Waltermire" initials="D." surname="Waltermire" role="editor">
<organization abbrev="NIST">National Institute of Standards and
Technology</organization>
<address>
<postal>
<street>100 Bureau Drive</street>
<city>Gaithersburg</city>
<region>Maryland</region>
<code>20877</code>
<country>USA</country>
</postal>
<phone/>
<email>david.waltermire@nist.gov</email>
</address>
</author>
<author fullname="Kim Watson" initials="K.K." surname="Watson">
<organization abbrev="DHS">United States Department of Homeland Security</organization>
<address>
<postal>
<street>DHS/CS&C/FNR</street>
<street>245 Murray Ln. SW, Bldg 410</street>
<street>MS0613</street>
<city>Washington</city>
<region>DC</region>
<code>20528</code>
<country>USA</country>
</postal>
<email>kimberly.watson@hq.dhs.gov</email>
</address>
</author>
<author fullname="Clifford Kahn" initials="C." surname="Kahn">
<organization>Pulse Secure, LLC</organization>
<address>
<postal>
<street>2700 Zanker Road, Suite 200</street>
<city>San Jose</city>
<region>CA</region>
<code>95134</code>
<country>USA</country>
</postal>
<email>cliffordk@pulsesecure.net</email>
</address>
</author>
<author fullname="Lisa Lorenzin" initials="L." surname="Lorenzin">
<organization>Pulse Secure, LLC</organization>
<address>
<postal>
<street>2700 Zanker Road, Suite 200</street>
<city>San Jose</city>
<region>CA</region>
<code>95134</code>
<country>USA</country>
</postal>
<email>llorenzin@pulsesecure.net</email>
</address>
</author>
<author fullname="Michael Cokus"
initials="M.C." surname="Cokus">
<organization>The MITRE
Corporation</organization>
<address>
<postal>
<street>903 Enterprise Parkway, Suite 200</street>
<!-- Reorder these if your country does things differently -->
<city>Hampton</city>
<region>VA</region>
<code>23666</code>
<country>USA</country>
</postal>
<phone/>
<email>msc@mitre.org</email>
<!-- uri and facsimile elements may also be added -->
</address>
</author>
<author fullname="Daniel Haynes" initials="D.H." surname="Haynes">
<organization>The MITRE Corporation</organization>
<address>
<postal>
<street>202 Burlington Road</street>
<!-- Reorder these if your country does things differently -->
<city>Bedford</city>
<region>MA</region>
<code>01730</code>
<country>USA</country>
</postal>
<phone/>
<email>dhaynes@mitre.org</email>
<!-- uri and facsimile elements may also be added -->
</address>
</author>
<author fullname="Henk Birkholz" initials="H.B." surname="Birkholz">
<organization>Fraunhofer SIT</organization>
<address>
<postal>
<street>Rheinstrasse 75</street>
<!-- Reorder these if your country does things differently -->
<city>Darmstadt</city>
<code>64295</code>
<country>Germany</country>
</postal>
<phone/>
<email>henk.birkholz@sit.fraunhofer.de</email>
<!-- uri and facsimile elements may also be added -->
</address>
</author>
<date month="September" year="2016"/>
<area>General</area>
<workgroup>SACM</workgroup>
<!-- WG name at the upperleft corner of the doc,
IETF is fine for individual submissions.
If this element is not present, the default is "Network Working Group",
which is used by the RFC Editor as a nod to the history of the IETF. -->
<keyword>todo</keyword>
<!-- Keywords will be incorporated into HTML output
files in a meta tag but they have no effect on text or nroff
output. If you submit your draft to the RFC Editor, the
keywords will be used for the search engine. -->
<abstract>
<t>This document defines the Information Elements that are transported between SACM
components and their interconnected relationships. The primary purpose of the
Secure Automation and Continuous Monitoring (SACM) Information Model is to ensure
the interoperability of corresponding SACM data models and addresses the use cases
defined by SACM. The Information Elements and corresponding types are maintained
as the IANA "SACM Information Elements" registry.</t>
</abstract>
</front>
<middle>
<section title="Introduction" anchor="INTRO">
<t>The SACM Information Model (IM) serves multiple purposes:
<list style="symbols">
<t>to ensure interoperability between SACM data models that are used as transport
encodings,</t>
<t>to provide a standardized set of Information Elements - the SACM Vocabulary -
to enable the exchange of content vital to automated security posture assessment,
and</t>
<t>to enable secure information sharing in a scalable and extensible fashion in
order to support the tasks conducted by SACM components.</t>
</list>
</t>
<t>A complete set of requirements imposed on the IM can be
found in <xref target="I-D.ietf-sacm-requirements"/>. The
SACM IM is intended to be used for standardized data exchange between SACM components
(data in motion). Nevertheless, the Information Elements (IE) and their relationships
defined in this document can be leveraged to create and align corresponding data models
for data at rest.</t>
<t>The information model expresses, for example, target endpoint (TE) attributes, guidance,
and evaluation results. The corresponding Information Elements are consumed and produced
by SACM components as they carry out tasks.</t>
<t>The primary tasks that this information model supports (on data, control, and management
plane) are:
<list style="symbols">
<t>TE Discovery</t>
<t>TE Characterization</t>
<t>TE Classification</t>
<t>Collection</t>
<t>Evaluation</t>
<t>Information Sharing</t>
<t>SACM Component Discovery</t>
<t>SACM Component Authentication</t>
<t>SACM Component Authorization</t>
<t>SACM Component Registration</t>
</list>
</t>
<t>These tasks are defined in <xref target="I-D.ietf-sacm-terminology"/>.</t>
</section>
<section title="Conventions used in this document">
<section title="Requirements Language">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD",
"SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be
interpreted as described in <xref target="RFC2119">RFC 2119</xref>.</t>
</section>
<section title="Information Element Examples">
<t>The notation used to define the SACM Information
Elements (IEs) is based on a customized version of
the IPFIX information model syntax <xref
target="RFC7012"/> which is described in <xref target="information-element-specification-template"/>.
However, there are several examples presented throughout the document that use a simplified
pseudo-code to illustrate the basic structure. It should be noted that while
they include actual names of subjects and attributes as well as values, they
are not intended to influence how corresponding SACM IEs should be defined
in <xref target="information-model-elements"/>. The examples are provided for
demonstration purposes only.</t>
</section>
</section>
<section title="Information Elements">
<t>The IEs defined in this document comprise the building blocks by which all SACM
content is composed. They are consumed and provided by SACM components on the data
plane. Every Information Element has a unique label: its name. Every type of IE
defined by the SACM IM is registered as a type at the IANA registry. The Integer
Index of the IANA SMI number tables can be used by SACM data models.</t>
<section title="Context of Information Elements" anchor="context-of-information-elements">
<t>The IEs in this information model represent information related to assets in the following
areas (based on the use cases described in <xref
target="RFC7632"/>):
<list style="symbols">
<t>Endpoint Management</t>
<t>Software Inventory Management</t>
<t>Hardware Inventory Management</t>
<t>Configuration Management</t>
<t>Vulnerability Management</t>
</list>
</t>
</section>
<section title="Extensibility of Information Elements">
<t>A SACM data model based on this information model MAY include additional information
elements that are not defined here. The labels of additional Information Elements
included in different SACM data models MUST NOT conflict with the labels of the
Information Elements defined by this information model, and the names of additional
Information Elements MUST NOT conflict with each other or across multiple data models.
In order to avoid naming conflicts, the labels of additional IEs SHOULD be prefixed
to avoid collisions across extensions. The prefix MUST include an organizational
identifier and therefore, for example, MAY be an IANA enterprise number, a (partial)
name space URI, or an organization name abbreviation.
</t>
</section>
</section>
<section title="Structure of Information Elements" anchor="structure-of-information-elements">
<t>There are two basic types of IEs:
<list style="symbols">
<t>Attributes: an instance of an attribute type is the simplest IE structure comprised
of a unique attribute name and an attribute value.</t>
<t>Subjects: a subject is a richer structure that has a unique subject name and one
or more attributes or subjects. In essence, instances of a subject type are defined
(and differentiated) by the attribute values and subjects associated with it.</t>
</list>
</t>
<figure title="Example instance of an attribute and subject."
anchor="attribute-subject-example">
<artwork>
hostname = "arbutus"
coordinates = (
latitude = N27.99619,
longitude = E86.92761
)
</artwork>
</figure>
<t>In general, every piece of information that enables security posture assessment or
further enriches the quality of the assessment process can be associated with metadata.
In the SACM IM, metadata is represented by specific subjects and is bundled with other
attributes or subjects to provide additional information about them. The IM explicitly
defines two kinds of metadata:
<list style="symbols">
<t>Metadata focusing on the data origin (the SACM component that provides the
information to the SACM domain)</t>
<t>Metadata focusing on the data source (the target endpoint that is assessed)</t>
</list>
Metadata can also include relationships that refer to other associated IEs (or SACM
content in general) by using referencing labels that have to be included in the metadata
of the associated IE.</t>
<t>Subjects can be nested and the SACM IM allows for circular or recursive nesting. The
association of IEs via nesting results in a tree-like structure wherein subjects compose
the root and intermediary nodes and attributes the leaves of the tree. This semantic
structure does not impose a specific structure on SACM data models regarding data in
motion or data repository schemata for data at rest.</t>
<t>The SACM IM provides two conceptual top-level subjects that
are used to ensure a homogeneous structure for SACM content
and its associated metadata: SACM statements and SACM content-elements. Every set of IEs
that is provided by a SACM component must provide the information contained in these two
subjects although it is up to the implementer whether or not the subjects are explicitly
defined in a data model.</t>
<t>The notation the SACM IM is defined in is based on a modified
version of the IP Information Flow Export (IPFIX) Information
Model syntax described in Section 2.1 of <xref target="RFC7012"/>.
The customized syntax used by the SACM IM is defined below in
<xref target="information-element-specification-template"/>.</t>
<figure
title="Information Element Specification Template"
anchor="information-element-specification-template">
<artwork>
elementId (required): The numeric identifier of the
Information Element. It is used
for the compact identification
of an Information Element. If
this identifier is used without
an enterpriseID, then the
elementId must be unique, and
the description of allowed values
is administrated by IANA. The
value "TBD" may be used during
development of the information
model until an elementId is
assigned by IANA and filled
in at publication time.
enterpriseId (optional): Enterprises may wish to define
Information Elements without
registering them with IANA, for
example, for enterprise-internal
purposes. For such Information
Elements, the elementId is
not sufficient when used
outside the enterprise. If
specifications of enterprise-
specific Information Elements
are made public and/or if
enterprise-specific identifiers
are used by SACM components
outside the enterprise, then the
enterprise-specific identifier
MUST be made globally unique by
combining it with an enterprise
identifier. Valid values for the
enterpriseId are defined by IANA
as Structure of Management
Information (SMI) network management
private enterprise numbers.
name (required): A unique and meaningful name for
the Information Element.
dataType (required): There are two kinds of datatypes:
simple and structured. Attributes are
defined using simple datatypes
and subjects are defined using
structured datatypes. The contents of
the datatype field will be either
a reference to one of the simple
datatypes listed in Section
5.1, or the specification of
structured datatype as defined in
Section 5.2.
status (required): The status of the specification
of the Information Element.
Allowed values are "current" and
"deprecated". All newly defined
Information Elements have "current"
status. The process for moving
Information Elements to the
"deprecated" status is TBD.
description (required): Describes the meaning of the
Information Element, how it is
derived, conditions for its use,
etc.
structure (optional): A parsable property that provides
details about the definition of
structured Information Elements as
described in Section 5.2.
references (optional): Identifies other RFCs or documents
outside the IETF which provide
additional information or context
about the Information Element.
</artwork>
</figure>
<section title="Information Element Naming Convention"
anchor="naming-convention">
<t>SACM Information Elements must adhere to the following naming conventions.
<list style="symbols">
<t>Names SHOULD be descriptive</t>
<t>Names MUST be unique within the SACM registry. Enterprise-specific names
SHOULD be prefixed with a Private Enterprise Number <xref target="PEN"/>.</t>
<t>Names MUST start with lowercase letters unless it begins with a Private
Enterprise Number</t>
<t>Composed names MUST use capital letters for the first letter of each part</t>
</list>
</t>
</section>
<section title="SACM Content Elements"
anchor="sacm-content-elements">
<t>Every piece of information that is provided by a SACM component is always associated
with a set of metadata, for example, the timestamp at which this set of information
was produced (e.g. by a collection task) or what target endpoint this set of
information is about (e.g. the data-source or a target endpoint identifier, respectively).
The subject that associates content IE with content-metadata IE is called a
content-element. Content metadata can also include relationships that express associations
with other content-elements.</t>
<figure title="Example set of IEs associated with a timestamp and a
target endpoint label." anchor="sacm-content-element-example">
<artwork>
content-element = (
content-metadata = (
collection-timestamp = 146193322,
data-source = fb02e551-7101-4e68-8dec-1fde6bd10981
),
hostname = "arbutus",
coordinates = (
latitude = N27.99619,
longitude = E86.92761
)
)
</artwork>
</figure>
</section>
<section title="SACM Statements"
anchor="sacm-statements">
<t>One or more SACM content elements are bundled in a SACM statement. In contrast to
content-metadata, statement-metadata focuses on the providing SACM component instead of the
target endpoint that the content is about. The only content-specific metadata included in
the SACM statement is the content-type IE. Therefore, multiple content-elements that share
the same statement metadata and are of the same content-type can be included in a single
SACM statement. A SACM statement functions similar to an envelope or a header. Its purpose
is to enable the tracking of the origin of data inside a SACM domain and more importantly
to enable the mitigation of conflicting information that may originate from different SACM
components. How a consuming SACM component actually deals with conflicting information is
out-of-scope of the SACM IM. Semantically, the term statement implies that the SACM content
provided by a SACM component might not be correct in every context, but rather is the result
of a best-effort to produce correct information.</t>
<figure title="Example of a simple SACM statement including a single content-element." anchor="sacm-statement-example-1">
<artwork>
sacm-statement = (
statement-metadata = (
publish-timestamp = 1461934031,
data-origin = 24e67957-3d31-4878-8892-da2b35e121c2,
content-type = observation
),
content-element = (
content-metadata = (
collection-timestamp = 146193322,
data-source = fb02e551-7101-4e68-8dec-1fde6bd10981
),
hostname = "arbutus"
)
)
</artwork>
</figure>
<figure title="Example of conflicting information originating from different SACM components." anchor="sacm-statement-example-2">
<artwork>
sacm-statement = (
statement-metadata = (
publish-timestamp = 1461934031,
data-origin = 24e67957-3d31-4878-8892-da2b35e121c2
content-type = observation
),
content-element = (
content-metadata = (
collection-timestamp = 146193322,
data-source = fb02e551-7101-4e68-8dec-1fde6bd10981
),
coordinates = (
latitude = N27.99619,
longitude = E86.92761
)
)
)
sacm-statement = (
statement-metadata = (
publish-timestamp = 1461934744,
data-origin = e42885a1-0270-44e9-bb5c-865cf6bd4800,
content-type = observation
),
content-element = (
content-metadata = (
collection-timestamp = 146193821,
te-label = fb02e551-7101-4e68-8dec-1fde6bd10981
),
coordinates = (
latitude = N16.67622,
longitude = E141.55321
)
)
)
</artwork>
</figure>
</section>
<section title="Relationships">
<t>An IE can be associated with another IE, e.g. a user-name attribute
can be associated with a content-authorization subject. These
references are expressed via the relationships subject, which can be
included in a corresponding content-metadata subject. The
relationships subject includes a list of one or more references. The
SACM IM does not enforce a SACM domain to use unique identifiers as
references. Therefore, there are at least two ways to reference another
<list style="symbols">
<t>The value of a reference represents a specific content-label that
is unique in a SACM domain (and has to be included in the
corresponding content-element metadata in order to be referenced),
or</t>
<t>The reference is a subject that includes an appropriate number
of IEs in order to identify the referenced content-element by its
actual content.</t>
</list>
</t>
<t>It is recommended to provide unique identifiers in a SACM domain and
the SACM IM provides a corresponding naming-convention as a reference
in <xref target="naming-convention"/>. The alternative highlighted above summarizes a valid
approach that does not require unique identifiers and is similar to the
approach of referencing target endpoints via identifying attributes
included in a characterization record.</t>
<figure title="Example instance of a content-element subject associated with
another subject via its content metadata." anchor="sacm-relationship-example">
<artwork>
content-element = (
content-metadata = (
collection-timestamp = 1461934031,
te-label =
fb02e551-7101-4e68-8dec-1fde6bd10981
relationships = (
associated-with-user-account =
f3d70ef4-7e18-42af-a894-8955ba87c95d
)
),
hostname = "arbutus"
)
content-element = (
content-metadata = (
content-label = f3d70ef4-7e18-42af-a894-8955ba87c95d
),
user-account = (
username = romeo
authentication = local
)
)
</artwork>
</figure>
</section>
<section title="Event" anchor="event">
<t>Event subjects provide a structure to represent the change
of IE values that was detected by a collection task at a
specific point of time. It is mandatory to include the new
values and the collection timestamp in an event subject and
it is recommended to include the past values and a collection
timestamp that were replaced by the new IE values. Every
event can also be associated with a subject-specific
event-timestamp and a lastseen-timestamp that might differ
from the corresponding collection-timestamps. If these are
omitted the collection-timestamp that is included in the
content-metadata subject is used instead.
</t>
<figure title="Example of a SACM statement containing an event." anchor="sacm-event-example">
<artwork>
sacm-statement = (
statement-metadata = (
publish-timestamp = 1461934031,
data-origin = 24e67957-3d31-4878-8892-da2b35e121c2,
content-type = event
),
event = (
event-attributes = (
event-name = "host-name change",
content-element = (
content-metadata = (
collection-timestamp = 146193322,
data-source =
fb02e551-7101-4e68-8dec-1fde6bd10981,
event-component = past-state
),
hostname = "arbutus"
),
content-element = (
content-metadata = (
collection-timestamp = 146195723,
data-source =
fb02e551-7101-4e68-8dec-1fde6bd10981,
event-component = current-state
),
hostname = "lilac"
)
)
)
</artwork>
</figure>
</section>
<section title="Categories" anchor="categories">
<t>Categories are special IEs that enable to refer to multiple
types of IE via just one name. Therefore, they are similar
to a type-choice. A prominent example of a category is
network-address. Network-address is a category that every
kind of network address is associated with, e.g. mac-address,
ipv4-address, ipv6-address, or typed-network-address. If a
subject includes network-address as one of its components,
any of the category members are valid to be used in its place.
</t>
<t>Another prominent example is EndpointIdentifier. Some IEs
can be used to identify (and over time re-recognize) target
endpoints - those are associated with the category
endpoint-identifier.
</t>
</section>
</section>
<section title="Abstract Data Types" anchor="abstract-data-types">
<t>This section describes the set of valid abstract data types that
can be used for the specification of the SACM
Information Elements in <xref target="information-model-elements"/>.
SACM currently supports two classes of datatypes that can be used to
define Information Elements.
<list style="symbols">
<t>Simple: Datatypes that are atomic and are used to define the type of data represented by an attribute Information Element.</t>
<t>Structured: Datatypes that can be used to define the type of data represented by a subject Information Element.</t>
</list>
</t>
<t>Note that further abstract data types may be specified by future extensions of the SACM information model.</t>
<section title="Simple Datatypes" anchor="simple-datatypes">
<section title="IPFIX Datatypes" anchor="ipfix-datatypes">
<t>To facilitate the use of existing work, SACM supports the following
abstract data types defined in Section 3 of <xref target="RFC7012"/>.
<list style="symbols">
<t>unsigned8, unsigned16, unsigned32, unsigned64</t>
<t>signed8, signed16, signed32, signed64</t>
<t>float32, float64</t>
<t>boolean</t>
<t>macAddress</t>
<t>octetArray</t>
<t>string</t>
<t>dateTimeSeconds, dateTimeMilliseconds, dateTimeMicroseconds, dateTimeNanoSeconds</t>
<t>ipv4Address, ipv6Address</t>
</list>
</t>
</section>
</section>
<section title="Structured Datatypes" anchor="structured-datatypes">
<section title="List Datatypes" anchor="list-datatypes">
<t>SACM defines the following abstract list data types that are used to
represent the structured data associated with subjects.
<list style="symbols">
<t>list: indicates that the Information Element order is not significant but
MAY be preserved.</t>
<t>orderedList: indicates that Information Element order is significant and
MUST be preserved.</t>
</list>
</t>
<t>The notation for defining a SACM structured datatype is based on regular
expressions, which are composed of the keywords "list" or "orderedList"
and an Information Element expression. IE expressions use some of the regular
expression syntax and operators, but the terms in the expression are
the names of defined Information Elements instead of character classes. The
syntax for defining list and orderedList datatypes is described below, using
BNF:</t>
<figure title="Syntax for Defining List Datatypes" anchor="list-datatype-bnf">
<artwork>
<list-def> -> ("list"|"orderedList") "(" <ie-expression> ")"
<ie-expression> -> <ie-name> <cardinality>?
( ("," | "|") <ie-name> <cardinality>?)*
<cardinality> -> "*" | "+" | "?" |
( "(" <non-neg-int> ("," <non-neg-int>)? ")" )
</artwork>
</figure>
<t>As seen above, multiple occurences of an Information Element may be
present in a structured datatype. The cardinality of an Information Element
within a structured Information Element definition is defined by the following
operators:</t>
<figure title="Specifying Cardinality for Structured Datatypes"
anchor="specifying-cardinality-for-structured-datatypes">
<artwork>
* - zero or more occurrences
+ - one or more occurrences
? - zero or one occurrence
(m,n) - between m and n occurrences
</artwork>
</figure>
<t>The absence of a cardinality operator implies one mandatory occurrence of the
Information Element.</t>
<t>Below is an example of a structured Information Element definition.</t>
<figure title="Example of Defining a Structured List Datatype" anchor="example-of-defining-a-structured-list-datatype">
<artwork>
personInfo = list(firstName, middleNames?, lastName)
firstName = string
middleNames = orderedList(middleName+)
middleName = string
lastName = string
As an example, consider the name "John Ronald Reuel Tolkien".
Below are instances of this name, structured according to the
personInfo definition.
personInfo = (firstName="John", middleNames(middleName="Ronald",
middleName="Reuel"), lastName="Tolkien")
personInfo = (middleNames(middleName="Ronald", middleName=" Reuel"),
lastName="Tolkien", firstName="John")
The instance below is not legal with respect to the definition
of personInfo because the order in middleNames is not preserved.
personInfo = (firstName="John", middleNames(middleName=" Reuel",
middleName="Ronald"), lastName="Tolkien")
</artwork>
</figure>
</section>
<section title="Enumeration Datatype" anchor="enumeration-datatype">
<t>SACM defines the following abstract enumeration datatype that is used to
represent the restriction of an attribute value to a set of values.</t>
<figure title="Syntax for Defining an Enumeration Datatype" anchor="enumeration-datatype-bnf">
<artwork>
name, hex-value, description
<enumeration-def> -> -> <name> ";" <hex-value> ";" <description>
<name> -> [0-9a-zA-Z]+
<hex-value> -> 0x[0-9a-fA-F]+
<description> -> [0-9a-zA-Z\.\,]+
</artwork>
</figure>
<t>Below is an example of a structured Information Element definition for an enumeration.</t>
<figure title="Example of Defining a Structured Enumeration Datatype" anchor="example-of-defining-a-structured-enumeration-datatype">
<artwork>
Red ; 0x1 ; The color is red.
Orange ; 0x2 ; The color is orange.
Yellow ; 0x3 ; The color is yellow.
Green ; 0x4 ; The color is green.
...
</artwork>
</figure>
</section>
</section>
</section>
<section title="Information Model Assets" anchor="information-model-assets">
<t>In order to represent the Information Elements related to the areas listed
in <xref target="context-of-information-elements"/>, the information model
defines the information needs (or metadata about those information needs)
related to following types of assets which are defined in
<xref target="I-D.ietf-sacm-terminology"/> (and included below
for convenience) which are of interest to SACM.
Specifically:<list style="symbols">
<t>Endpoint</t>
<t>Software Component</t>
<t>Hardware Component</t>
<t>Identity</t>
<t>Guidance</t>
<t>Evaluation Results</t>
</list>
</t>
<t>The following figure shows the make up of an Endpoint asset which contains
zero or more hardware components and zero or more software components each of
which may have zero or more instances running an endpoint at any given time as
well as zero or more identities that act on behalf of the endpoint when interfacing
with other endpoints, tools, or services. An endpoint may also contain other
endpoints in the case of a virtualized environment.</t>
<figure title="Model of an Endpoint"
anchor="figure-model-of-an-endpoint">
<artwork>
<![CDATA[
+---------+*______in>_______*+-----+
|Hardware | |! !|
|Component| +---------+ |! !|
+---------+ |Software |in> |! !|
|Component|____|! !|
+---------+* *|! !|
1| |! !|
*| | | +----------+
+---------+ |End- |*_____*| Identity |
|Software |in> |point| acts +----------+
|Instance |____| | for>
+---------+* 1|! !|
|! !|
|! !|
|! !|
|! !|____
|! !|0..1|
+-----+ |
|* |
|_______|
in>
]]>
</artwork>
</figure>
<section title="Asset">
<t>As defined in <xref target="RFC4949"/>, an asset is a system resource that
is (a) required to be protected by an information system's security policy,
(b) intended to be protected by a countermeasure, or (c) required for a
system's mission.</t>
<t>In the scope of SACM, an asset can be composed of other assets. Examples of
Assets include: Endpoints, Software, Guidance, or Identity. Furthermore, an
asset is not necessarily owned by an organization.</t>
</section>
<section title="Endpoint">
<t>From <xref target="RFC5209"/>, an endpoint is any computing device that can
be connected to a network. Such devices normally are associated with a
particular link layer address before joining the network and potentially
an IP address once on the network. This includes: laptops, desktops,
servers, cell phones, or any device that may have an IP address.</t>
<t>To further clarify, an endpoint is any physical or virtual device that
may have a network address. Note that, network infrastructure devices
(e.g. switches, routers, firewalls), which fit the definition, are also
considered to be endpoints within this document.</t>
<t>Physical endpoints are always composites that are composed of hardware
components and software components. Virtual endpoints are composed entirely
of software components and rely on software components that provide
functions equivalent to hardware components.</t>
<t>The SACM architecture differentiates two essential categories of endpoints:
Endpoints whose security posture is intended to be assessed (target endpoints)
and endpoints that are specifically excluded from endpoint posture
assessment (excluded endpoints).</t>
</section>
<section title="Hardware Component">
<t>Hardware components are the distinguishable physical components that compose an
endpoint. The composition of an endpoint can be changed over time by adding
or removing hardware components. In essence, every physical endpoint is
potentially a composite of multiple hardware components, typically resulting
in a hierarchical composition of hardware components. The composition of hardware
components is based on interconnects provided by specific hardware types (e.g.
mainboard is a hardware type that provides local busses as an interconnect). In
general, a hardware component can be distinguished by its serial number.</t>
<t>Examples of a hardware components include: motherboards, network interfaces, graphics
cards, hard drives, etc.</t>
</section>
<section title="Software Component">
<t>A software package installed on an endpoint (including the operating system) as
well as a unique serial number if present (e.g. a text editor associated with
a unique license key).</t>
<t>It should be noted that this includes both benign and harmful software packages. Examples
of benign software components include: applications, patches, operating system kernel, boot
loader, firmware, code embedded on a webpage, etc. Examples of malicious software components
include: malware, trojans, viruses, etc.</t>
<section title="Software Instance">
<t>A running instance of the software component (e.g. on a multi-user system, one logged-in
user has one instance of a text editor running and another logged-in user has another
instance of the same text editor running, or on a single-user system, a user could have
multiple independent instances of the same text editor running).</t>
</section>
</section>
<section title="Identity">
<t>Any mechanism that can be used to identify an asset during an authentication process. Examples
include usernames, user and device certificates, etc. Note, that this is different than the
identity of assets in the context of designation as described in <xref target="endpoint-designation"/>.</t>
</section>
<section title="Guidance">
<t>Guidance is input instructions to processes and tasks, such as collection or evaluation. Guidance influences
the behavior of a SACM component and is considered content of the management plane. Guidance can be manually
or automatically generated or provided. Typically, the tasks that provide guidance to SACM components have
a low-frequency and tend to be sporadic. A prominent example of guidance are target endpoint profiles,but
guidance can have many forms, including:
<list style="symbol">
<t>Configuration, e.g. a SACM component's name, or a CMDB's IPv6 address.</t>
<t>Profiles, e.g. a set of expected states for network behavior associated with target endpoints
employed by specific users.</t>
<t>Policies, e.g. an interval to refresh the registration of a SACM component, or a list of
required capabilities for SACM components in a specific location.</t>
</list>
</t>
<section title="Collection Guidance">
<t>A collector may need guidance to govern what it collects and when. Collection Guidance provides
instructions for a Collector that specifies which endpoint attributes to collect, when to collect
them, and how to collect them. Collection Guidance is composed of Target Endpoint Attribute
Guidance, Frequency Guidance, and Method Guidance.<list style="symbols">
<t>Target Endpoint Attribute Guidance: Set of endpoint attributes that are supposed to be
collected from a target endpoint. The definition of the set of endpoint attributes is
typically based on an endpoint characterization record.</t>
<t>Frequency Guidance: Specifies when endpoint attributes are to be collected.</t>
<t>Method Guidance: Indicates how endpoint attributes are to be collected.</t>
</list>
</t>
</section>
<section title="Evaluation Guidance">
<t>An evaluator typically needs guidance to govern what it considers to be a good or bad security
posture. Evaluation Guidance provides instructions for an Evaluator that specifies which endpoint
attributes to evaluate, the desired state of those endpoint attributes, and any special requirements
that enable an Evaluator to determine if the endpoint attributes can be used in the evaluation
(e.g. freshness of data, how it was collected, etc.). Evaluation Guidance is composed of Target
Endpoint Attribute Guidance, Expected Endpoint Attribute Value Guidance, and Frequency Guidance.
<list style="symbols">
<t>Target Endpoint Attribute Guidance: Set of target endpoint attributes that are supposed to
be used in an evaluation as well as any requirements on the endpoint attributes. The
definition of the set of endpoint attributes is typically based on an endpoint
characterization record.</t>
<t>Expected Endpoint Attribute Value Guidance: The expected values of the endpoint attributes
described in the Target Endpoint Attribute Guidance.</t>
<t>Frequency Guidance: Specifies when endpoint attributes are to be evaluated.</t>
<t>Method Guidance: Indicates how endpoint attributes are to be collected.</t>
</list>
</t>
</section>
<section title="Classification Guidance">
<t>A SACM Component carrying out the Target Endpoint Classification Task may need guidance on how to
classify an endpoint. Specifically, how to associate endpoint classes with a specific target endpoint
characterization record. Target Endpoint Classes function as guidance for collection, evaluation,
remediation and security posture assessment in general. Classification Guidance is composed of Target
Endpoint Attribute Guidance and Class Guidance.<list style="symbols">
<t>Target Endpoint Attribute Guidance: Set of target endpoint attributes that are supposed to
be used to identify the endpoint characterization record.</t>
<t>Class Guidance: A list of target endpoint classes that are to be associated with the identified
target endpoint characterization record.</t>
</list>
</t>
</section>
<section title="Storage Guidance">
<t>An SACM Component typically needs guidance to govern what information it should store and where.
Storage Guidance provides instructions for a SACM Component that specifies which security automation
information should be stored, for how long, and on which endpoint. Storage Guidance is composed of
Target Endpoint Attribute Guidance, Expected Security Automation Information Guidance, and Retention
Guidance.
<list style="symbols">
<t>Target Endpoint Attribute Guidance: Set of target endpoint attributes that are supposed to
be used to identify the endpoint where the security automation information is to be stored.</t>
<t>Expected Security Automation Information Guidance: The security automation information
that is expected to be stored (guidance, collected posture attributes, results, etc.).</t>
<t>Retention Guidance: Specifies how long the security automation information should be stored.</t>
</list>
</t>
</section>
<section title="Evaluation Results">
<t>Evaluation Results are the output of comparing the actual state of an endpoint against the expected state
of an endpoint. In addition to the actual results of the comparison, Evaluation Results should include the
Evaluation Guidance and actual target endpoint attributes values used to perform the evaluation.</t>
</section>
</section>
</section>
<section title="Information Model Elements" anchor="information-model-elements">
<t>This section defines the specific Information Elements and relationships that will be
implemented by data models and transported between SACM Components.</t>
<section title="accessPrivilegeType">
<figure>
<artwork>
elementId: TBD
name: accessPrivilegeType
dataType: string
status: current
description: A set of types that represent access
privileges (read, write, none, etc.).
</artwork>
</figure>
</section>
<section title="accountName">
<figure>
<artwork>
elementId: TBD
name: accountName
dataType: string
status: current
description: A label that uniquely identifies an account
that can require some form of (user) authentication to
access.
</artwork>
</figure>
</section>
<section title="administrativeDomainType">
<figure>
<artwork>
elementId: TBD
name: accessPrivilegeType
dataType: string
status: current
description: A label the is supposed to uniquely
identify an administrative domain.
</artwork>
</figure>
</section>
<section title="addressAssociationType">
<figure>
<artwork>
elementId: TBD
name: accessPrivilegeType
dataType: string
status: current
description: A label the is supposed to uniquely
identify an administrative domain.
</artwork>
</figure>
</section>
<section title="addressMaskValue">
<figure>
<artwork>
elementId: TBD
name: addressMaskValue
dataType: string
status: current
description: A value that expresses a generic address
subnetting bitmask.
</artwork>
</figure>
</section>
<section title="addressType">
<figure>
<artwork>
elementId: TBD
name: addressType
dataType: string
status: current
description: A set of types that specifies the type
of address that is expressed in an address subject
(e.g. ethernet, modbus, zigbee).
</artwork>
</figure>
</section>
<section title="addressValue">
<figure>
<artwork>
elementId: TBD
name: addressValue
dataType: string
status: current
description: A value that expresses a generic network
address.
</artwork>
</figure>
</section>
<section title="applicationComponent">
<figure>
<artwork>
elementId: TBD
name: applicationComponent
dataType: string
status: current
description: A label that references a "sub"-application
that is part of the application (e.g. an add-on, a
cipher-suite, a library).
</artwork>
</figure>
</section>
<section title="applicationLabel">
<figure>
<artwork>
elementId: TBD
name: applicationLabel
dataType: string
status: current
description: A label that is supposed to uniquely
reference an application.
</artwork>
</figure>
</section>
<section title="applicationType">
<figure>
<artwork>
elementId: TBD
name: applicationType
dataType: string
status: current
description: A set of types (FIXME maybe a finite set
is not realistic here - value not enumerator?) that
identifies the type of (user-space) application
(e.g. text-editor, policy-editor, service-client,
service-server, calender, rouge-like RPG).
</artwork>
</figure>
</section>
<section title="applicationManufacturer">
<figure>
<artwork>
elementId: TBD
name: applicationManufacturer
dataType: string
status: current
description: The name of the vendor that created the
application.
</artwork>
</figure>
</section>
<section title="authenticator">
<figure>
<artwork>
elementId: TBD
name: authenticator
dataType: string
status: current
description: A label that references a SACM component
that can authenticate target endpoints (can be used in
a target-endpoint subject to express that the target
endpoint was authenticated by that SACM component.
</artwork>
</figure>
</section>
<section title="authenticationType">
<figure>
<artwork>
elementId: TBD
name: authenticationType
dataType: string
status: current
description: A set of types that expresses which type
of authentication was used to enable a network
interaction/connection.
</artwork>
</figure>
</section>
<section title="birthdate">
<figure>
<artwork>
elementId: TBD
name: birthdate
dataType: string
status: current
description: A label for the registered day of birth
of a natural person (e.g. the date of birth of a person
as an ISO date string).
references: http://rs.tdwg.org/ontology/voc/Person#birthdate
</artwork>
</figure>
</section>
<section title="bytesReceived">
<figure>
<artwork>
elementId: TBD
name: bytesReceived
dataType: string
status: current
description: A value that represents a number of octets
received on a network interface.
</artwork>
</figure>
</section>
<section title="bytesSent">
<figure>
<artwork>
elementId: TBD
name: bytesSent
dataType: string
status: current
description: A value that represents the number of
octets received on a network interface.
</artwork>
</figure>
</section>
<section title="bytesSent">
<figure>
<artwork>
elementId: TBD
name: bytesSent
dataType: string
status: current
description: A value that represents the number of
octets sent on a network interface.
</artwork>
</figure>
</section>
<section title="certificate">
<figure>
<artwork>
elementId: TBD
name: certificate
dataType: string
status: current
description: A value that expresses a certificate that
can be collected from a target endpoint.
</artwork>
</figure>
</section>
<section title="collectionTaskType">
<figure>
<artwork>
elementId: TBD
name: collectionTaskType
dataType: string
status: current
description: A set of types that defines how collected
SACM content was acquired (e.g. network-observation,
remote-acquisition, self-reported).
</artwork>
</figure>
</section>
<section title="confidence">
<figure>
<artwork>
elementId: TBD
name: confidence
dataType: string
status: current
description: A representation of the subjective probability
that the assessed value is correct. If no confidence value
is given, it is assumed that the confidence is 1. Acceptable
values are between 0 and 1.
</artwork>
</figure>
</section>
<section title="contentAction">
<figure>
<artwork>
elementId: TBD
name: contentAction
dataType: string
status: current
description: A set of types that express a type of
action (e.g. add, delete, update). It can be associated,
for instance, with an event subject or with a network
observation.
</artwork>
</figure>
</section>
<section title="countryCode">
<figure>
<artwork>
elementId: TBD
name: countryCode
dataType: string
status: current
description: A set of types according to ISO 3166-1.
</artwork>
</figure>
</section>
<section title="dataOrigin">
<figure>
<artwork>
elementId: TBD
name: dataOrigin
dataType: string
status: current
description: A label that uniquely identifies a SACM
component in and across SACM domains.
</artwork>
</figure>
</section>
<section title="dataSource">
<figure>
<artwork>
elementId: TBD
name: dataSource
dataType: string
status: current
description: A label that is supposed to uniquely
identify the data source (e.g. a target endpoint or
sensor) that provided an initial endpoint attribute
record.
</artwork>
</figure>
</section>
<section title="default-depth">
<figure>
<artwork>
elementId: TBD
name: default-depth
dataType: string
status: current
description: A value that expresses how often a circular
reference of subject is allowed to repeat, or how deep
a recursive nesting may occur, respectively.
</artwork>
</figure>
</section>
<section title="discoverer">
<figure>
<artwork>
elementId: TBD
name: contentAction
dataType: string
status: current
description: A label that refers to the SACM component
that discovered a target endpoint (can be used in a
target-endpoint subject to express, for example, that
the target endpoint was authenticated by that SACM
component).
</artwork>
</figure>
</section>
<section title="emailAddress">
<figure>
<artwork>
elementId: TBD
name: countryCode
dataType: string
status: current
description: A value that expresses an email-address.
</artwork>
</figure>
</section>
<section title="eventType">
<figure>
<artwork>
elementId: TBD
name: eventType
dataType: string
status: current
description: a set of types that define the categories
of an event (e.g. access-level-change,
change-of-priviledge, change-of-authorization,
environmental-event, or provisioning-event).
</artwork>
</figure>
</section>
<section title="eventThreshold">
<figure>
<artwork>
elementId: TBD
name: eventThreshold
dataType: string
status: current
description: if applicable, a value that can be
included in an event subject to indicate what numeric
threshold value was crossed to trigger that event.
</artwork>
</figure>
</section>
<section title="eventThresholdName">
<figure>
<artwork>
elementId: TBD
name: eventThresholdName
dataType: string
status: current
description: If an event is created due to a crossed
threshold, the threshold might have a name associated
with it that can be expressed via this value.
</artwork>
</figure>
</section>
<section title="eventTrigger">
<figure>
<artwork>
elementId: TBD
name: eventTrigger
dataType: string
status: current
description: This value is used to express more
complex trigger conditions that may cause the creation
of an event.
</artwork>
</figure>
</section>
<section title="eventTrigger">
<figure>
<artwork>
elementId: TBD
name: eventTrigger
dataType: string
status: current
description: This value is used to express more
complex trigger conditions that may cause the creation
of an event.
</artwork>
</figure>
</section>
<section title="firmwareId">
<figure>
<artwork>
elementId: TBD
name: firmwareId
dataType: string
status: current
description: A label that represents the BIOS or
firmware ID of a specific target endpoint.
</artwork>
</figure>
</section>
<section title="hostName">
<figure>
<artwork>
elementId: TBD
name: hostName
dataType: string
status: current
description: A label typically associated with an
endpoint, but, not always intended to be unique given
scope.
</artwork>
</figure>
</section>
<section title="interfaceLabel">
<figure>
<artwork>
elementId: TBD
name: interfaceLabel
dataType: string
status: current
description: A unique label that can be used to
reference a network interface.
</artwork>
</figure>
</section>
<section title="ipv6AddressSubnetMask">
<figure>
<artwork>
elementId: TBD
name: ipv6AddressSubnetMask
dataType: string
status: current
description: An IPv6 subnet bitmask.
</artwork>
</figure>
</section>
<section title="ipv6AddressSubnetMaskCidrNotation">
<figure>
<artwork>
elementId: TBD
name: ipv6AddressSubnetMaskCidrNotation
dataType: string
status: current
description: An IPv6 subnet bitmask in CIDR notation.
</artwork>
</figure>
</section>
<section title="ipv6AddressValue">
<figure>
<artwork>
elementId: TBD
name: ipv6AddressValue
dataType: ipv6Address
status: current
description: An IPv6 subnet bitmask in CIDR notation.
a network interface.
</artwork>
</figure>
</section>
<section title="ipv4AddressSubnetMask">
<figure>
<artwork>
elementId: TBD
name: ipv4AddressSubnetMask
dataType: string
status: current
description: An IPv4 subnet bitmask.
</artwork>
</figure>
</section>
<section title="ipv4AddressSubnetMaskCidrNotation">
<figure>
<artwork>
elementId: TBD
name: ipv4AddressSubnetMaskCidrNotation
dataType: string
status: current
description: An IPv4 subnet bitmask in CIDR notation.
</artwork>
</figure>
</section>
<section title="ipv4AddressValue">
<figure>
<artwork>
elementId: TBD
name: ipv4AddressValue
dataType: ipv4Address
status: current
description: An IPv4 address value.
</artwork>
</figure>
</section>
<section title="layer2InterfaceType">
<figure>
<artwork>
elementId: TBD
name: layer2InterfaceType
dataType: string
status: current
description: A set of types referenced by IANA ifType.
</artwork>
</figure>
</section>
<section title="layer4PortAddress">
<figure>
<artwork>
elementId: TBD
name: layer4PortAddress
dataType: unsigned32
status: current
description: A layer 4 port address
typically associated with TCP and UDP
protocols.
</artwork>
</figure>
</section>
<section title="layer4Protocol">
<figure>
<artwork>
elementId: TBD
name: layer4Protocol
dataType: string
status: current
description: A set of types that express a layer 4
protocol (e.g. UDP or TCP).
</artwork>
</figure>
</section>
<section title="locationName">
<figure>
<artwork>
elementId: TBD
name: locationName
dataType: string
status: current
description: A value that represents a named region of
physical space.
</artwork>
</figure>
</section>
<section title="macAddressValue">
<figure>
<artwork>
elementId: TBD
name: macAddressValue
dataType: string
status: current
description: A value that expresses an Ethernet address.
</artwork>
</figure>
</section>
<section title="methodLabel">
<figure>
<artwork>
elementId: TBD
name: methodLabel
dataType: string
status: current
description: A label that references a specific method
registered and used in a SACM domain (e.g. method to
match and re-identify target endpoints via identifying
attributes).
</artwork>
</figure>
</section>
<section title="methodRepository">
<figure>
<artwork>
elementId: TBD
name: methodRepository
dataType: string
status: current
description: A label that references a SACM component
methods can be registered at and that can provide
guidance in the form of registered methods to other
SACM components.
</artwork>
</figure>
</section>
<section title="networkAccessLevelType">
<figure>
<artwork>
elementId: TBD
name: networkAccessLevelType
dataType: string
status: current
description: A set of types that expresses categories
of network access-levels (e.g. block, quarantine, etc.).
</artwork>
</figure>
</section>
<section title="networkId">
<figure>
<artwork>
elementId: TBD
name: networkId
dataType: string
status: current
description: Most networks such as AS, OSBF domains,
or VLANs can have an ID.
</artwork>
</figure>
</section>
<section title="networkInterfaceName">
<figure>
<artwork>
elementId: TBD
name: networkInterfaceName
dataType: string
status: current
description: A label that uniquely identifies an interface
associated with a distinguishable endpoint.
</artwork>
</figure>
</section>
<section title="networkLayer">
<figure>
<artwork>
elementId: TBD
name: networkLayer
dataType: string
status: current
description: A set of layers that expresses the specific
network layer an interface operates on.
</artwork>
</figure>
</section>
<section title="networkName">
<figure>
<artwork>
elementId: TBD
name: networkName
dataType: string
status: current
description: A label that is associated with a network.
Some networks, for example, effetive layer2-broadcast-domains
are difficult to "grasp" and therefore quite difficult to name.
</artwork>
</figure>
</section>
<section title="organizationId">
<figure>
<artwork>
elementId: TBD
name: organizationId
dataType: string
status: current
description: A label that uniquely identifies an
organization via a PEN.
</artwork>
</figure>
</section>
<section title="osComponent">
<figure>
<artwork>
elementId: TBD
name: osComponent
dataType: string
status: current
description: A label that references a "sub-component"
that is part of the operating system (e.g. a kernel
module, microcode, or ACPI table).
</artwork>
</figure>
</section>
<section title="osLabel">
<figure>
<artwork>
elementId: TBD
name: osLabel
dataType: string
status: current
description: A label that references a specific version
of an operating system, including patches and hotfixes.
</artwork>
</figure>
</section>
<section title="osName">
<figure>
<artwork>
elementId: TBD
name: osName
dataType: string
status: current
description: The name of an operating system.
</artwork>
</figure>
</section>
<section title="osType">
<figure>
<artwork>
elementId: TBD
name: osType
dataType: string
status: current
description: A set of types that identifies the type
of an operating system (e.g. real-time,
security-enhanced, consumer, server).
</artwork>
</figure>
</section>
<section title="osVersion">
<figure>
<artwork>
elementId: TBD
name: osVersion
dataType: string
status: current
description: A value that represents the version of
an operating-system.
</artwork>
</figure>
</section>
<section title="patchId">
<figure>
<artwork>
elementId: TBD
name: patchId
dataType: string
status: current
description: A label the uniquely identifies a specific
software patch.
</artwork>
</figure>
</section>
<section title="patchName">
<figure>
<artwork>
elementId: TBD
name: osVersion
dataType: string
status: current
description: The vendor's name of a software patch.
</artwork>
</figure>
</section>
<section title="personFirstName">
<figure>
<artwork>
elementId: TBD
name: patchId
dataType: string
status: current
description: The first name of a natural person.
</artwork>
</figure>
</section>
<section title="personLastName">
<figure>
<artwork>
elementId: TBD
name: personLastName
dataType: string
status: current
description: The last name of a natural person.
</artwork>
</figure>
</section>
<section title="personMiddleName">
<figure>
<artwork>
elementId: TBD
name: personMiddleName
dataType: string
status: current
description: The middle name of a natural person.
</artwork>
</figure>
</section>
<section title="phoneNumber">
<figure>
<artwork>
elementId: TBD
name: phoneNumber
dataType: string
status: current
description: A label that expresses the U.S. national
phone number (e.g. pattern value="((\d{3}) )?\d{3}-\d{4}").
</artwork>
</figure>
</section>
<section title="phoneNumberType">
<figure>
<artwork>
elementId: TBD
name: phoneNumberType
dataType: string
status: current
description: A set of types that express the type of
a phone number (e.g. DSN, Fax, Home, Mobile, Pager,
Secure, Unsecure, Work, Other).
</artwork>
</figure>
</section>
<section title="privilegeName">
<figure>
<artwork>
elementId: TBD
name: privilegeName
dataType: string
status: current
description: The attribute name of the privilege
represented as an AVP.
</artwork>
</figure>
</section>
<section title="privilegeValue">
<figure>
<artwork>
elementId: TBD
name: privilegeValue
dataType: string
status: current
description: The value content of the privilege
represented as an AVP.
</artwork>
</figure>
</section>
<section title="protocol">
<figure>
<artwork>
elementId: TBD
name: protocol
dataType: string
status: current
description: A set of types that defines specific
protocols above layer 4 (e.g. http, https, dns, ipp,
or unknown).
</artwork>
</figure>
</section>
<section title="publicKey">
<figure>
<artwork>
elementId: TBD
name: publicKey
dataType: string
status: current
description: The value of a public key (regardless of its
method of creation, crypto-system, or signature scheme)
that can be collected from a target endpoint.
</artwork>
</figure>
</section>
<section title="relationshipContentElementGuid">
<figure>
<artwork>
elementId: TBD
name: relationshipContentElementGuid
dataType: string
status: current
description: A reference to a specific content element
used in a relationship subject.
</artwork>
</figure>
</section>
<section title="relationshipStatementElementGuid">
<figure>
<artwork>
elementId: TBD
name: relationshipStatementElementGuid
dataType: string
status: current
description: A reference to a specific SACM statement
used in a relationship subject.
</artwork>
</figure>
</section>
<section title="relationshipObjectLabel">
<figure>
<artwork>
elementId: TBD
name: relationshipObjectLabel
dataType: string
status: current
description: A reference to a specific label used in
content (e.g. a te-label or a user-id). This
reference is typically used if matching content
attribute can be done efficiantly and can also be
included in addition to a relationship-content-element-guid
reference.
</artwork>
</figure>
</section>
<section title="relationshipType">
<figure>
<artwork>
elementId: TBD
name: relationshipType
dataType: string
status: current
description: A set of types that is in every instance
of a relationship subject to highlight what kind of
relationship exists between the subject the relationship
is included in (e.g. associated_with_user,
applies_to_session, seen_on_interface, associated_with_flow,
contains_virtual_device).
</artwork>
</figure>
</section>
<section title="roleName">
<figure>
<artwork>
elementId: TBD
name: roleName
dataType: string
status: current
description: A label that references a collection of
privileges assigned to a specific entity (identity?
FIXME).
</artwork>
</figure>
</section>
<section title="sessionStateType">
<figure>
<artwork>
elementId: TBD
name: sessionStateType
dataType: string
status: current
description: A set of types a discernible session (an
ongoing network interaction) can be in (e.g.
Authenticating, Authenticated, Postured, Started,
Disconnected).
</artwork>
</figure>
</section>
<section title="statementGuid">
<figure>
<artwork>
elementId: TBD
name: statementGuid
dataType: string
status: current
description: A label that expresses a global unique
ID referencing a specific SACM statement that was
produced by a SACM component.
</artwork>
</figure>
</section>
<section title="statementType">
<figure>
<artwork>
elementId: TBD
name: statementType
dataType: string
status: current
description: A set of types that define the type of
content that is included in a SACM statement (e.g.
Observation, DirectoryContent, Correlation, Assessment,
Guidance).
</artwork>
</figure>
</section>
<section title="status">
<figure>
<artwork>
elementId: TBD
name: status
dataType: string
status: current
description: A set of types that defines possible
result values for a finding in general (e.g. true,
false, error, unknown, not applicable, not evaluated).
</artwork>
</figure>
</section>
<section title="subAdministrativeDomain">
<figure>
<artwork>
elementId: TBD
name: subAdministrativeDomain
dataType: string
status: current
description: A label for related child domains an
administrative domain can be composed of (used in the
subject administrative-domain)
</artwork>
</figure>
</section>
<section title="subInterfaceLabel">
<figure>
<artwork>
elementId: TBD
name: subInterfaceLabel
dataType: string
status: current
description: A unique label a sub network interface
(e.g. a tagged vlan on a trunk) can be referenced
with.
</artwork>
</figure>
</section>
<section title="superAdministrativeDomain">
<figure>
<artwork>
elementId: TBD
name: superAdministrativeDomain
dataType: string
status: current
description: a label for related parent domains an
administrative domain is part of (used
in the subject s.administrative-domain).
</artwork>
</figure>
</section>
<section title="superInterfaceLabel">
<figure>
<artwork>
elementId: TBD
name: superInterfaceLabel
dataType: string
status: current
description: a unique label a super network interface
(e.g. a physical interface a tunnel
interface terminates on) can be referenced
with.
</artwork>
</figure>
</section>
<section title="teAssessmentState">
<figure>
<artwork>
elementId: TBD
name: teAssessmentState
dataType: string
status: current
description: a set of types that defines the state of
assessment of a target-endpoint (e.g.
in-discovery, discovered, in-classification,
classified, in-assessment, assessed).
</artwork>
</figure>
</section>
<section title="teLabel">
<figure>
<artwork>
elementId: TBD
name: teLabel
dataType: string
status: current
description: an identifying label created from a set
of identifying attributes used to reference
a specific target endpoint.
</artwork>
</figure>
</section>
<section title="teId">
<figure>
<artwork>
elementId: TBD
name: teId
dataType: string
status: current
description: an identifying label that is created
randomly, is supposed to be unique, and
used to reference a specific target
endpoint.
</artwork>
</figure>
</section>
<section title="timestampType">
<figure>
<artwork>
elementId: TBD
name: timestampType
dataType: string
status: current
description: a set of types that express what type of
action or event happened at that point
of time (e.g. discovered, classified,
collected, published). Can be included in
a generic s.timestamp subject.
</artwork>
</figure>
</section>
<section title="unitsReceived">
<figure>
<artwork>
elementId: TBD
name: unitsReceived
dataType: string
status: current
description: a value that represents a number of units
(e.g. frames, packets, cells or segments)
received on a network interface.
</artwork>
</figure>
</section>
<section title="unitsSent">
<figure>
<artwork>
elementId: TBD
name: unitsSent
dataType: string
status: current
description: a value that represents a number of units
(e.g. frames, packets, cells or segments)
sent on a network interface.
</artwork>
</figure>
</section>
<section title="username">
<figure>
<artwork>
elementId: TBD
name: username
dataType: string
status: current
description: a part of the credentials required to
access an account that can be collected from a target
endpoint.
</artwork>
</figure>
</section>
<section title="userDirectory">
<figure>
<artwork>
elementId: TBD
name: userDirectory
dataType: string
status: current
description: a label that identifies a specific type
of user-directory (e.g. ldap, active-directory,
local-user).
</artwork>
</figure>
</section>
<section title="userId">
<figure>
<artwork>
elementId: TBD
name: userId
dataType: string
status: current
description: a label that references a specific user
known in a SACM domain.
</artwork>
</figure>
</section>
<section title="webSite">
<figure>
<artwork>
elementId: TBD
name: webSite
dataType: string
status: current
description: a URI that references a web-site.
</artwork>
</figure>
</section>
<section title="WGS84Longitude">
<figure>
<artwork>
elementId: TBD
name: WGS84Longitude
dataType: float
status: current
description: a label that represents WGS 84 rev 2004
longitude.
</artwork>
</figure>
</section>
<section title="WGS84Latitude">
<figure>
<artwork>
elementId: TBD
name: WGS84Latitude
dataType: float
status: current
description: a label that represents WGS 84 rev 2004
latitude.
</artwork>
</figure>
</section>
<section title="WGS84Altitude">
<figure>
<artwork>
elementId: TBD
name: WGS84Altitude
dataType: float
status: current
description: a label that represents WGS 84 rev 2004
altitude.
</artwork>
</figure>
</section>
<section title="hardwareSerialNumber">
<figure>
<artwork>
elementId: TBD
name: hardwareSerialNumber
dataType: string
status: current
description: A globally unique identifier for a particular
piece of hardware assigned by the vendor.
</artwork>
</figure>
</section>
<section title="interfaceName">
<figure>
<artwork>
elementId: TBD
name: interfaceName
dataType: string
status: current
description: A short name uniquely describing an interface,
eg "Eth1/0". See [RFC2863] for the definition
of the ifName object.
</artwork>
</figure>
</section>
<section title="interfaceIndex">
<figure>
<artwork>
elementId: TBD
name: interfaceIndex
dataType: unsigned32
status: current
description: The index of an interface installed on an endpoint.
The value matches the value of managed object
'ifIndex' as defined in [RFC2863]. Note that ifIndex
values are not assigned statically to an interface
and that the interfaces may be renumbered every time
the device's management system is re-initialized,
as specified in [RFC2863].
</artwork>
</figure>
</section>
<section title="interfaceMacAddress">
<figure>
<artwork>
elementId: TBD
name: interfaceMacAddress
dataType: macAddress
status: current
description: The IEEE 802 MAC address associated with a network
interface on an endpoint.
</artwork>
</figure>
</section>
<section title="interfaceType">
<figure>
<artwork>
elementId: TBD
name: interfaceType
dataType: unsigned32
status: current
description: The type of a network interface. The value matches
the value of managed object 'ifType' as defined in
[IANA registry ianaiftype-mib].
</artwork>
</figure>
</section>
<section title="interfaceFlags">
<figure>
<artwork>
elementId: TBD
name: interfaceFlags
dataType: unsigned16
status: current
description: This information element specifies the flags
associated with a network interface. Possible
values include:
structure: Up ; 0x1 ; Interface is up.
Broadcast ; 0x2 ; Broadcast address valid.
Debug ; 0x4 ; Turn on debugging.
Loopback ; 0x8 ; Is a loopback net.
Point-to-point ; 0x10 ; Interface is point-to-point link.
No trailers ; 0x20 ; Avoid use of trailers.
Resources allocated ; 0x40 ; Resources allocated.
No ARP ; 0x80 ; No address resolution protocol.
Receive all ; 0x100 ; Receive all packets.
</artwork>
</figure>
</section>
<section title="networkInterface">
<figure>
<artwork>
elementId: TBD
name: networkInterface
dataType: orderedList
status: current
description: Information about a network interface
installed on an endpoint. The
following high-level digram
describes the structure of
networkInterface information
element.
structure: orderedList(interfaceName, interfaceIndex, macAddress,
ifType, flags)
</artwork>
</figure>
</section>
<section title="softwareIdentifier">
<figure>
<artwork>
elementId: TBD
name: softwareIdentifier
dataType: string
status: current
description: A globally unique identifier for a particular
software application.
</artwork>
</figure>
</section>
<section title="softwareTitle">
<figure>
<artwork>
elementId: TBD
name: softwareTitle
dataType: string
status: current
description: The title of the software application.
</artwork>
</figure>
</section>
<section title="softwareCreator">
<figure>
<artwork>
elementId: TBD
name: softwareCreator
dataType: string
status: current
description: The software developer (e.g., vendor or author).
</artwork>
</figure>
</section>
<section title="simpleSoftwareVersion">
<figure>
<artwork>
elementId: TBD
name: simpleSoftwareVersion
dataType: string
status: current
description: The version string for a software application that
conforms to the format of a list of hierarchical
non-negative integers separated by a single character
delimiter format.
</artwork>
</figure>
</section>
<section title="rpmSoftwareVersion">
<figure>
<artwork>
elementId: TBD
name: rpmSoftwareVersion
dataType: string
status: current
description: The version string for a software application that
conforms to the EPOCH:VERSION-RELEASE format.
</artwork>
</figure>
</section>
<section title="ciscoTrainSoftwareVersion">
<figure>
<artwork>
elementId: TBD
name: ciscoTrainSoftwareVersion
dataType: string
status: current
description: The version string for a software application that
conforms to the Cisco IOS Train string format.
</artwork>
</figure>
</section>
<section title="softwareVersion">
<figure>
<artwork>
elementId: TBD
name: softwareVerison
dataType: list
status: current
description: The version of the software application. Software
applications may be versioned using a number of
schemas. The following high-level digram describes
the structure of the softwareVersion information
element.
structure: list(simpleSoftwareVersion | rpmSoftwareVersion |
ciscoTrainSoftwareVersion)
</artwork>
</figure>
</section>
<section title="lastUpdated">
<figure>
<artwork>
elementId: TBD
name: lastUpdated
dataType: dateTimeSeconds
status: current
description: The date and time when the software instance
was last updated on the system (e.g., new
version instlalled or patch applied)
</artwork>
</figure>
</section>
<section title="softwareInstance">
<figure>
<artwork>
elementId: TBD
name: softwareInstance
dataType: orderedList
status: current
description: Information about an instance of software
installed on an endpoint. The following
high-level digram describes the structure of
softwareInstance information element.
structure: orderedList(softwareIdentifier, title, creator,
softwareVersion, lastUpdated)
</artwork>
</figure>
</section>
<section title="globallyUniqueIdentifier">
<figure>
<artwork>
elementId: TBD
name: globallyUniqueIdentifier
dataType: unsigned8
status: current
metadata: true
description: TODO.
</artwork>
</figure>
</section>
<section title="dataOrigin">
<figure>
<artwork>
elementId: TBD
name: dataOrigin
dataType: string
status: current
metadata: true
description: The origin of the data.
</artwork>
</figure>
</section>
<section title="dataSource">
<figure>
<artwork>
elementId: TBD
name: dataSource
dataType: string
status: current
metadata: true
description: The source of the data.
</artwork>
</figure>
</section>
<section title="creationTimestamp">
<figure>
<artwork>
elementId: TBD
name: creationTimestamp
dataType: dateTimeSeconds
status: current
metadata: true
description: The date and time when the posture
information was created by a SACM Component.
</artwork>
</figure>
</section>
<section title="collectionTimestamp">
<figure>
<artwork>
elementId: TBD
name: collectionTimestamp
dataType: dateTimeSeconds
status: current
metadata: true
description: The date and time when the posture
information was collected or observed by a SACM
Component.
</artwork>
</figure>
</section>
<section title="publicationTimestamp">
<figure>
<artwork>
elementId: TBD
name: publicationTimestamp
dataType: dateTimeSeconds
status: current
metadata: true
description: The date and time when the posture
information was published.
</artwork>
</figure>
</section>
<section title="relayTimestamp">
<figure>
<artwork>
elementId: TBD
name: relayTimestamp
dataType: dateTimeSeconds
status: current
metadata: true
description: The date and time when the posture
information was relayed to another SACM Component.
</artwork>
</figure>
</section>
<section title="storageTimestamp">
<figure>
<artwork>
elementId: TBD
name: storageTimestamp
dataType: dateTimeSeconds
status: current
metadata: true
description: The date and time when the posture
information was stored in a Repository.
</artwork>
</figure>
</section>
<section title="type">
<figure>
<artwork>
elementId: TBD
name: type
dataType: enumeration
status: current
metadata: true
description: The type of data model use to represent
some set of endpoint information. The following
table lists the set of data models supported by SACM.
structure: TBD
</artwork>
</figure>
</section>
<section title="protocolIdentifier">
<figure>
<artwork>
elementId: TBD
name: protocolIdentifier
dataType: unsigned8
status: current
description: The value of the protocol number in the IP packet
header. The protocol number identifies the IP packet
payload type. Protocol numbers are defined in the
IANA Protocol Numbers registry.
In Internet Protocol version 4 (IPv4), this is
carried in the Protocol field. In Internet Protocol
version 6 (IPv6), this is carried in the Next Header
field in the last extension header of the packet.</artwork>
</figure>
</section>
<section title="sourceTransportPort">
<figure>
<artwork>
elementId: TBD
name: sourceTransportPort
dataType: unsigned16
status: current
description: The source port identifier in the transport header.
For the transport protocols UDP, TCP, and SCTP, this
is the source port number given in the respective
header. This field MAY also be used for future
transport protocols that have 16-bit source port
identifiers.</artwork>
</figure>
</section>
<section title="sourceIPv4PrefixLength">
<figure>
<artwork>
elementId: TBD
name: sourceIPv4PrefixLength
dataType: unsigned8
status: current
description: The number of contiguous bits that are relevant in
the sourceIPv4Prefix Information Element.</artwork>
</figure>
</section>
<section title="ingressInterface">
<figure>
<artwork>
elementId: TBD
name: ingressInterface
dataType: unsigned32
status: current
description: The index of the IP interface where packets of this
Flow are being received. The value matches the
value of managed object 'ifIndex' as defined in
[RFC2863]. Note that ifIndex values are not assigned
statically to an interface and that the interfaces
may be renumbered every time the device's management
system is re-initialized, as specified in [RFC2863].</artwork>
</figure>
</section>
<section title="destinationTransportPort">
<figure>
<artwork>
elementId: TBD
name: destinationTransportPort
dataType: unsigned16
status: current
description: The destination port identifier in the transport
header. For the transport protocols UDP, TCP, and
SCTP, this is the destination port number given in
the respective header. This field MAY also be used
for future transport protocols that have 16-bit
destination port identifiers.</artwork>
</figure>
</section>
<section title="sourceIPv6PrefixLength">
<figure>
<artwork>
elementId: TBD
name: sourceIPv6PrefixLength
dataType: unsigned8
status: current
description: The number of contiguous bits that are relevant in
the sourceIPv6Prefix Information Element.</artwork>
</figure>
</section>
<section title="sourceIPv4Prefix">
<figure>
<artwork>
elementId: TBD
name: sourceIPv4Prefix
dataType: ipv4Address
status: current
description: IPv4 source address prefix.</artwork>
</figure>
</section>
<section title="destinationIPv4Prefix">
<figure>
<artwork>
elementId: TBD
name: destinationIPv4Prefix
dataType: ipv4Address
status: current
description: IPv4 destination address prefix.</artwork>
</figure>
</section>
<section title="sourceMacAddress">
<figure>
<artwork>
elementId: TBD
name: sourceMacAddress
dataType: macAddress
status: current
description: The IEEE 802 source MAC address field.</artwork>
</figure>
</section>
<section title="ipVersion">
<figure>
<artwork>
elementId: TBD
name: ipVersion
dataType: unsigned8
status: current
description: The IP version field in the IP packet header.</artwork>
</figure>
</section>
<section title="interfaceDescription">
<figure>
<artwork>
elementId: TBD
name: interfaceDescription
dataType: string
status: current
description: The description of an interface, eg "FastEthernet
1/0" or "ISP
connection".</artwork>
</figure>
</section>
<section title="applicationDescription">
<figure>
<artwork>
elementId: TBD
name: applicationDescription
dataType: string
status: current
description: Specifies the description of an application.</artwork>
</figure>
</section>
<section title="applicationId">
<figure>
<artwork>
elementId: TBD
name: applicationId
dataType: octetArray
status: current
description: Specifies an Application ID per [RFC6759].</artwork>
</figure>
</section>
<section title="applicationName">
<figure>
<artwork>
elementId: TBD
name: applicationName
dataType: string
status: current
description: Specifies the name of an application.</artwork>
</figure>
</section>
<section title="exporterIPv4Address">
<figure>
<artwork>
elementId: TBD
name: exporterIPv4Address
dataType: ipv4Address
status: current
description: The IPv4 address used by the Exporting Process.
This is used by the Collector to identify the
Exporter in cases where the identity of the Exporter
may have been obscured by the use of a proxy.</artwork>
</figure>
</section>
<section title="exporterIPv6Address">
<figure>
<artwork>
elementId: TBD
name: exporterIPv6Address
dataType: ipv6Address
status: current
description: The IPv6 address used by the Exporting Process.
This is used by the Collector to identify the
Exporter in cases where the identity of the
Exporter may have been obscured by the use of a
proxy.</artwork>
</figure>
</section>
<section title="portId">
<figure>
<artwork>
elementId: TBD
name: portId
dataType: unsigned32
status: current
description: An identifier of a line port that is unique per
IPFIX Device hosting an Observation Point.
Typically, this Information Element is used for
limiting the scope of other Information Elements.</artwork>
</figure>
</section>
<section title="templateId">
<figure>
<artwork>
elementId: TBD
name: templateId
dataType: unsigned16
status: current
description: An identifier of a Template that is locally unique
within a combination of a Transport session and an
Observation Domain.
Template IDs 0-255 are reserved for Template Sets,
Options Template Sets, and other reserved Sets yet
to be created. Template IDs of Data Sets are
numbered from 256 to 65535.
Typically, this Information Element is used for
limiting the scope of other Information Elements.
Note that after a re-start of the Exporting Process
Template identifiers may be re-assigned.</artwork>
</figure>
</section>
<section title="collectorIPv4Address">
<figure>
<artwork>
elementId: TBD
name: collectorIPv4Address
dataType: ipv4Address
status: current
description: An IPv4 address to which the Exporting Process sends
Flow information.</artwork>
</figure>
</section>
<section title="collectorIPv6Address">
<figure>
<artwork>
elementId: TBD
name: collectorIPv6Address
dataType: ipv6Address
status: current
description: An IPv6 address to which the Exporting Process sends
Flow information.</artwork>
</figure>
</section>
<section title="informationElementIndex">
<figure>
<artwork>
elementId: TBD
name: informationElementIndex
dataType: unsigned16
status: current
description: A zero-based index of an Information Element
referenced by informationElementId within a Template
referenced by templateId; used to disambiguate
scope for templates containing multiple identical
Information Elements.</artwork>
</figure>
</section>
<section title="informationElementId">
<figure>
<artwork>
elementId: TBD
name: informationElementId
dataType: unsigned16
status: current
description: This Information Element contains the ID of another
Information Element.</artwork>
</figure>
</section>
<section title="informationElementDataType">
<figure>
<artwork>
elementId: TBD
name: informationElementDataType
dataType: unsigned8
status: current
description: A description of the abstract data type of an IPFIX
information element.These are taken from the
abstract data types defined in section 3.1 of the
IPFIX Information Model [RFC5102]; see that section
for more information on the types described in the
informationElementDataType sub-registry.
These types are registered in the IANA IPFIX
Information Element Data Type subregistry. This
subregistry is intended to assign numbers for type
names, not to provide a mechanism for adding data
types to the IPFIX Protocol, and as such requires a
Standards Action [RFC5226] to modify.</artwork>
</figure>
</section>
<section title="informationElementDescription">
<figure>
<artwork>
elementId: TBD
name: informationElementDescription
dataType: string
status: current
description: A UTF-8 [RFC3629] encoded Unicode string containing
a human-readable description of an Information
Element. The content of the
informationElementDescription MAY be annotated with
one or more language tags [RFC4646], encoded
in-line [RFC2482] within the UTF-8 string, in order
to specify the language in which the description is
written. Description text in multiple languages MAY
tag each section with its own language tag; in this
case, the description information in each language
SHOULD have equivalent meaning. In the absence of
any language tag, the "i-default" [RFC2277] language
SHOULD be assumed. See the Security Considerations
section for notes on string handling for Information
Element type records.</artwork>
</figure>
</section>
<section title="informationElementName">
<figure>
<artwork>
elementId: TBD
name: informationElementName
dataType: string
status: current
description: A UTF-8 [RFC3629] encoded Unicode string containing
the name of an Information Element, intended as a
simple identifier. See the Security Considerations
section for notes on string handling for Information
Element type records.</artwork>
</figure>
</section>
<section title="informationElementRangeBegin">
<figure>
<artwork>
elementId: TBD
name: informationElementRangeBegin
dataType: unsigned64
status: current
description: Contains the inclusive low end of the range of
acceptable values for an Information Element.</artwork>
</figure>
</section>
<section title="informationElementRangeEnd">
<figure>
<artwork>
elementId: TBD
name: informationElementRangeEnd
dataType: unsigned64
status: current
description: Contains the inclusive high end of the range of
acceptable values for an Information Element.</artwork>
</figure>
</section>
<section title="informationElementSemantics">
<figure>
<artwork>
elementId: TBD
name: informationElementSemantics
dataType: unsigned8
status: current
description: A description of the semantics of an IPFIX
Information Element. These are taken from the data
type semantics defined in section 3.2 of the IPFIX
Information Model [RFC5102]; see that section for
more information on the types defined in the
informationElementSemantics sub-registry. This
field may take the values in Table ; the special
value 0x00 (default) is used to note that no
semantics apply to the field; it cannot be
manipulated by a Collecting Process or File Reader
that does not understand it a priori.
These semantics are registered in the IANA IPFIX
Information Element Semantics subregistry. This
subregistry is intended to assign numbers for
semantics names, not to provide a mechanism for
adding semantics to the IPFIX Protocol, and as such
requires a Standards Action [RFC5226] to modify.</artwork>
</figure>
</section>
<section title="informationElementUnits">
<figure>
<artwork>
elementId: TBD
name: informationElementUnits
dataType: unsigned16
status: current
description: A description of the units of an IPFIX Information
Element. These correspond to the units implicitly
defined in the Information Element definitions in
section 5 of the IPFIX Information Model [RFC5102];
see that section for more information on the types
described in the informationElementsUnits
sub-registry. This field may take the values in
Table 3 below; the special value 0x00 (none) is
used to note that the field is unitless.
These types are registered in the IANA IPFIX
Information Element Units subregistry; new types
may be added on a First Come First Served [RFC5226]
basis.</artwork>
</figure>
</section>
<section title="userName">
<figure>
<artwork>
elementId: TBD
name: userName
dataType: string
status: current
description: User name associated with the flow.</artwork>
</figure>
</section>
<section title="applicationCategoryName">
<figure>
<artwork>
elementId: TBD
name: applicationCategoryName
dataType: string
status: current
description: An attribute that provides a first level
categorization for each Application ID.</artwork>
</figure>
</section>
<section title="mibObjectValueInteger">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueInteger
dataType: signed64
status: current
description: An IPFIX Information Element which denotes that the
integer value of a MIB object will be exported.
The MIB Object Identifier ("mibObjectIdentifier")
for this field MUST be exported in a MIB Field
Option or via another means. This Information
Element is used for MIB objects with the Base
Syntax of Integer32 and INTEGER with IPFIX Reduced
Size Encoding used as required. The value is
encoded as per the standard IPFIX Abstract Data Type
of signed64.</artwork>
</figure>
</section>
<section title="mibObjectValueOctetString">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueOctetString
dataType: octetArray
status: current
description: An IPFIX Information Element which denotes that an
Octet String or Opaque value of a MIB object will
be exported. The MIB Object Identifier
("mibObjectIdentifier") for this field MUST be
exported in a MIB Field Option or via another means.
This Information Element is used for MIB objects
with the Base Syntax of OCTET STRING and Opaque. The
value is encoded as per the standard IPFIX Abstract
Data Type of octetArray.</artwork>
</figure>
</section>
<section title="mibObjectValueOID">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueOID
dataType: octetArray
status: current
description: An IPFIX Information Element which denotes that an
Object Identifier or OID value of a MIB object will
be exported. The MIB Object Identifier
("mibObjectIdentifier") for this field MUST be
exported in a MIB Field Option or via another means.
This Information Element is used for MIB objects
with the Base Syntax of OBJECT IDENTIFIER. Note -
In this case the "mibObjectIdentifier" will define
which MIB object is being exported while the value
contained in this Information Element will be an
OID as a value. The mibObjectValueOID Information
Element is encoded as ASN.1/BER [BER] in an
octetArray.</artwork>
</figure>
</section>
<section title="mibObjectValueBits">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueBits
dataType: octetArray
status: current
description: An IPFIX Information Element which denotes that a
set of Enumerated flags or bits from a MIB object
will be exported. The MIB Object Identifier
("mibObjectIdentifier") for this field MUST be
exported in a MIB Field Option or via another means.
This Information Element is used for MIB objects
with the Base Syntax of BITS. The flags or bits are
encoded as per the standard IPFIX Abstract Data Type
of octetArray, with sufficient length to accommodate
the required number of bits. If the number of bits
is not an integer multiple of octets then the most
significant bits at end of the octetArray MUST be
set to zero.</artwork>
</figure>
</section>
<section title="mibObjectValueIPAddress">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueIPAddress
dataType: ipv4Address
status: current
description: An IPFIX Information Element which denotes that the
IPv4 Address of a MIB object will be exported. The
MIB Object Identifier ("mibObjectIdentifier") for
this field MUST be exported in a MIB Field Option
or via another means. This Information Element is
used for MIB objects with the Base Syntax of
IPaddress. The value is encoded as per the standard
IPFIX Abstract Data Type of ipv4Address.</artwork>
</figure>
</section>
<section title="mibObjectValueCounter">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueCounter
dataType: unsigned64
status: current
description: An IPFIX Information Element which denotes that the
counter value of a MIB object will be exported.
The MIB Object Identifier ("mibObjectIdentifier")
for this field MUST be exported in a MIB Field
Option or via another means. This Information
Element is used for MIB objects with the Base
Syntax of Counter32 or Counter64 with IPFIX Reduced
Size Encoding used as required. The value is encoded
as per the standard IPFIX Abstract Data Type
of unsigned64.</artwork>
</figure>
</section>
<section title="mibObjectValueGauge">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueGauge
dataType: unsigned32
status: current
description: An IPFIX Information Element which denotes that the
Gauge value of a MIB object will be exported. The
MIB Object Identifier ("mibObjectIdentifier") for
this field MUST be exported in a MIB Field Option
or via another means. This Information Element is
used for MIB objects with the Base Syntax of Gauge32.
The value is encoded as per the standard IPFIX
Abstract Data Type of unsigned64. This value will
represent a non-negative integer, which may increase
or decrease, but shall never exceed a maximum
value, nor fall below a minimum value.</artwork>
</figure>
</section>
<section title="mibObjectValueTimeTicks">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueTimeTicks
dataType: unsigned32
status: current
description: An IPFIX Information Element which denotes that the
TimeTicks value of a MIB object will be exported.
The MIB Object Identifier ("mibObjectIdentifier")
for this field MUST be exported in a MIB Field
Option or via another means. This Information
Element is used for MIB objects with the Base
Syntax of TimeTicks. The value is encoded as per
the standard IPFIX Abstract Data Type of unsigned32.</artwork>
</figure>
</section>
<section title="mibObjectValueUnsigned">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueUnsigned
dataType: unsigned64
status: current
description: An IPFIX Information Element which denotes that an
unsigned integer value of a MIB object will be
exported. The MIB Object Identifier
("mibObjectIdentifier") for this field MUST be
exported in a MIB Field Option or via another means.
This Information Element is used for MIB objects
with the Base Syntax of unsigned64 with IPFIX
Reduced Size Encoding used as required. The value is
encoded as per the standard IPFIX Abstract Data Type
of unsigned64.</artwork>
</figure>
</section>
<section title="mibObjectValueTable">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueTable
dataType: orderedList
status: current
description: An IPFIX Information Element which denotes that a
complete or partial conceptual table will be
exported. The MIB Object Identifier
("mibObjectIdentifier") for this field MUST be
exported in a MIB Field Option or via another means.
This Information Element is used for MIB objects
with a SYNTAX of SEQUENCE. This is encoded as a
subTemplateList of mibObjectValue Information
Elements. The template specified in the
subTemplateList MUST be an Options Template and
MUST include all the Objects listed in the INDEX
clause as Scope Fields.
structure: orderedList(mibObjectValueRow+)
</artwork>
</figure>
</section>
<section title="mibObjectValueRow">
<figure>
<artwork>
elementId: TBD
name: mibObjectValueRow
dataType: orderedList
status: current
description: An IPFIX Information Element which denotes that a
single row of a conceptual table will be exported.
The MIB Object Identifier ("mibObjectIdentifier")
for this field MUST be exported in a MIB Field
Option or via another means. This Information
Element is used for MIB objects with a SYNTAX of
SEQUENCE. This is encoded as a subTemplateList of
mibObjectValue Information Elements. The
subTemplateList exported MUST contain exactly one
row (i.e., one instance of the subtemplate). The
template specified in the subTemplateList MUST be
an Options Template and MUST include all the
Objects listed in the INDEX clause as Scope Fields.
structure: orderedList(mibObjectValue+)
</artwork>
</figure>
</section>
<section title="mibObjectIdentifier">
<figure>
<artwork>
elementId: TBD
name: mibObjectIdentifier
dataType: octetArray
status: current
description: An IPFIX Information Element which denotes that a
MIB Object Identifier (MIB OID) is exported in the
(Options) Template Record. The mibObjectIdentifier
Information Element contains the OID assigned to
the MIB Object Type Definition encoded as
ASN.1/BER [BER].</artwork>
</figure>
</section>
<section title="mibSubIdentifier">
<figure>
<artwork>
elementId: TBD
name: mibSubIdentifier
dataType: unsigned32
status: current
description: A non-negative sub-identifier of an Object
Identifier (OID).</artwork>
</figure>
</section>
<section title="mibIndexIndicator">
<figure>
<artwork>
elementId: TBD
name: mibIndexIndicator
dataType: unsigned64
status: current
description: This set of bit fields is used for marking the
Information Elements of a Data Record that serve as
INDEX MIB objects for an indexed Columnar MIB
object. Each bit represents an Information Element
in the Data Record with the n-th bit representing
the n-th Information Element. A bit set to value 1
indicates that the corresponding Information Element
is an index of the Columnar Object represented by
the mibFieldValue. A bit set to value 0 indicates
that this is not the case.
If the Data Record contains more than 64
Information Elements, the corresponding Template
SHOULD be designed such that all INDEX
Fields are among the first 64 Information Elements,
because the mibIndexIndicator only contains 64 bits.
If the Data Record contains less than 64
Information Elements, then the extra bits in the
mibIndexIndicator for which no corresponding
Information Element exists MUST have the value 0,
and must be disregarded by the Collector. This
Information Element may be exported with
IPFIX Reduced Size Encoding.</artwork>
</figure>
</section>
<section title="mibCaptureTimeSemantics">
<figure>
<artwork>
elementId: TBD
name: mibCaptureTimeSemantics
dataType: unsigned8
status: current
description: Indicates when in the lifetime of the flow the MIB
value was retrieved from the MIB for a
mibObjectIdentifier. This is used to indicate if
the value exported was collected from the MIB
closer to flow creation or flow export time and
will refer to the Timestamp fields included in the
same record. This field SHOULD be used when
exporting a mibObjectValue that specifies counters
or statistics.
If the MIB value was sampled by SNMP prior to the
IPFIX Metering Process or Exporting Process
retrieving the value (i.e., the data is already
stale) and it's important to know the exact sampling
time, then an additional observationTime* element
should be paired with the OID using structured data.
Similarly, if different mibCaptureTimeSemantics
apply to different mibObject elements within the
Data Record, then individual mibCaptureTimeSemantics
should be paired with each OID using structured data.
Values:
0. undefined
1. begin - The value for the MIB object is captured
from the MIB when the Flow is first observed
2. end - The value for the MIB object is captured
from the MIB when the Flow ends
3. export - The value for the MIB object is
captured from the MIB at export time
4. average - The value for the MIB object is an
average of multiple captures from the MIB over the
observed life of the Flow</artwork>
</figure>
</section>
<section title="mibContextEngineID">
<figure>
<artwork>
elementId: TBD
name: mibContextEngineID
dataType: octetArray
status: current
description: A mibContextEngineID that specifies the SNMP engine
ID for a MIB field being exported over IPFIX.
Definition as per [RFC3411] section 3.3.</artwork>
</figure>
</section>
<section title="mibContextName">
<figure>
<artwork>
elementId: TBD
name: mibContextName
dataType: string
status: current
description: This Information Element denotes that a MIB Context
Name is specified for a MIB field being exported
over IPFIX. Reference [RFC3411] section 3.3.</artwork>
</figure>
</section>
<section title="mibObjectName">
<figure>
<artwork>
elementId: TBD
name: mibObjectName
dataType: string
status: current
description: The name (called a descriptor in [RFC2578]
of an object type definition.</artwork>
</figure>
</section>
<section title="mibObjectDescription">
<figure>
<artwork>
elementId: TBD
name: mibObjectDescription
dataType: string
status: current
description: The value of the DESCRIPTION clause of an MIB object
type definition.</artwork>
</figure>
</section>
<section title="mibObjectSyntax">
<figure>
<artwork>
elementId: TBD
name: mibObjectSyntax
dataType: string
status: current
description: The value of the SYNTAX clause of an MIB object type
definition, which may include a Textual Convention
or Subtyping. See [RFC2578].</artwork>
</figure>
</section>
<section title="mibModuleName">
<figure>
<artwork>
elementId: TBD
name: mibModuleName
dataType: string
status: current
description: The textual name of the MIB module that defines a MIB
Object.</artwork>
</figure>
</section>
<section title="interface">
<figure>
<artwork>
elementId: TBD
name: interface
dataType: list
structure: list (InterfaceName, hwAddress, inetAddr, netmask)
status: current
description: Represents an interface and its configuration
options.</artwork>
</figure>
</section>
<section title="interfaceName">
<figure>
<artwork>
elementId: TBD
name: interfaceName
dataType: string
status: current
description: The interface
name.</artwork>
</figure>
</section>
<section title="iflisteners">
<figure>
<artwork>
elementId: TBD
name: iflisteners
dataType: list
structure: list (interfaceName, physicalProtocol, hwAddress,
programName, pid, userId)
status: current
description: Stores the results of checking for applications that
are bound to an ethernet interface on the system.</artwork>
</figure>
</section>
<section title="physicalProtocol">
<figure>
<artwork>
elementId: TBD
name: physicalProtocol
dataType: enumeration
structure:
ETH_P_LOOP ; 0x1 ; Ethernet loopback packet.
ETH_P_PUP ; 0x2 ; Xerox PUP packet.
ETH_P_PUPAT ; 0x3 ; Xerox PUP Address Transport packet.
ETH_P_IP ; 0x4 ; Internet protocol packet.
ETH_P_X25 ; 0x5 ; CCITT X.25 packet.
ETH_P_ARP ; 0x6 ; Address resolution packet.
ETH_P_BPQ ; 0x7 ; G8BPQ AX.25 ethernet packet.
ETH_P_IEEEPUP ; 0x8 ; Xerox IEEE802.3 PUP packet.
ETH_P_IEEEPUPAT ; 0x9 ; Xerox IEEE802.3 PUP address transport
packet.
ETH_P_DEC ; 0xA ; DEC assigned protocol.
ETH_P_DNA_DL ; 0xB ; DEC DNA Dump/Load.
ETH_P_DNA_RC ; 0xC ; DEC DNA Remote Console.
ETH_P_DNA_RT ; 0xD ; DEC DNA Routing.
ETH_P_LAT ; 0xE ; DEC LAT.
ETH_P_DIAG ; 0xF ; DEC Diagnostics.
ETH_P_CUST ; 0x10 ; DEC Customer use.
ETH_P_SCA ; 0x11 ; DEC Systems Comms Arch.
ETH_P_RARP ; 0x12 ; Reverse address resolution packet.
ETH_P_ATALK ; 0x13 ; Appletalk DDP.
ETH_P_AARP ; 0x14 ; Appletalk AARP.
ETH_P_8021Q ; 0x15 ; 802.1Q VLAN Extended Header.
ETH_P_IPX ; 0x16 ; IPX over DIX.
ETH_P_IPV6 ; 0x17 ; IPv6 over bluebook.
ETH_P_SLOW ; 0x18 ; Slow Protocol. See 802.3ad 43B.
ETH_P_WCCP ; 0x19 ; Web-cache coordination protocol.
ETH_P_PPP_DISC ; 0x1A ; PPPoE discovery messages.
ETH_P_PPP_SES ; 0x1B ; PPPoE session messages.
ETH_P_MPLS_UC ; 0x1C ; MPLS Unicast traffic.
ETH_P_MPLS_MC ; 0x1D ; MPLS Multicast traffic.
ETH_P_ATMMPOA ; 0x1E ; MultiProtocol Over ATM.
ETH_P_ATMFATE ; 0x1F ; Frame-based ATM Transport over Ethernet.
ETH_P_AOE ; 0x20 ; ATA over Ethernet.
ETH_P_TIPC ; 0x21 ; TIPC.
ETH_P_802_3 ; 0x22 ; Dummy type for 802.3 frames.
ETH_P_AX25 ; 0x23 ; Dummy protocol id for AX.25.
ETH_P_ALL ; 0x24 ; Every packet.
ETH_P_802_2 ; 0x25 ; 802.2 frames.
ETH_P_SNAP ; 0x26 ; Internal only.
ETH_P_DDCMP ; 0x27 ; DEC DDCMP: Internal only
ETH_P_WAN_PPP ; 0x28 ; Dummy type for WAN PPP frames.
ETH_P_PPP_MP ; 0x29 ; Dummy type for PPP MP frames.
ETH_P_PPPTALK ; 0x2A ; Dummy type for Atalk over PPP.
ETH_P_LOCALTALK ; 0x2B ; Localtalk pseudo type.
ETH_P_TR_802_2 ; 0x2C ; 802.2 frames.
ETH_P_MOBITEX ; 0x2D ; Mobitex.
ETH_P_CONTROL ; 0x2E ; Card specific control frames.
ETH_P_IRDA ; 0x2F ; Linux-IrDA.
ETH_P_ECONET ; 0x30 ; Acorn Econet.
ETH_P_HDLC ; 0x31 ; HDLC frames.
ETH_P_ARCNET ; 0x32 ; 1A for ArcNet.
; 0x33 ; The empty string value is permitted here
to allow for detailed error reporting.
status: current
description: The physical layer protocol used by the AF_PACKET
socket.</artwork>
</figure>
</section>
<section title="hwAddress">
<figure>
<artwork>
elementId: TBD
name: hwAddress
dataType: string
status: current
description: The hardware address associated
with the interface.</artwork>
</figure>
</section>
<section title="programName">
<figure>
<artwork>
elementId: TBD
name: programName
dataType: string
status: current
description: The name of the communicating
program.</artwork>
</figure>
</section>
<section title="userId">
<figure>
<artwork>
elementId: TBD
name: userId
dataType: integer
status: current
description: The numeric user id.</artwork>
</figure>
</section>
<section title="inetlisteningserver">
<figure>
<artwork>
elementId: TBD
name: inetlisteningserver
dataType: list
structure: list (transportProtocol, localAddress,
localPort, localFullAddress, programName, foreignAddress,
foreignPort, foreignFullAddress, pid, userId)
status:
current
description: Stores the results of checking for network servers
currently active on a system. It holds information pertaining to
a specific protocol-address-port combination.</artwork>
</figure>
</section>
<section title="transportProtocol">
<figure>
<artwork>
elementId: TBD
name: transportProtocol
dataType: string
status: current
description: The transport-layer
protocol (tcp or udp).</artwork>
</figure>
</section>
<section title="localAddress">
<figure>
<artwork>
elementId: TBD
name: localAddress
dataType: ipAddress
status: current
description: This is the IP address being listened to. Note that
the IP address can be IPv4 or IPv6.</artwork>
</figure>
</section>
<section title="localPort">
<figure>
<artwork>
elementId: TBD
name: localPort
dataType: integer
status: current
description: This is the TCP or UDP port
being listened to.</artwork>
</figure>
</section>
<section title="localFullAddress">
<figure>
<artwork>
elementId: TBD
name: localFullAddress
dataType: string
status: current
description: The IP address and network port on which the program
listens, including the local address and the local port. Note
that the IP address can be IPv4 or IPv6.</artwork>
</figure>
</section>
<section title="foreignAddress">
<figure>
<artwork>
elementId: TBD
name: foreignAddress
dataType: ipAddresss
status: current
description: The IP address with which the program is
communicating, or with which it will communicate. Note that the
IP address can be IPv4 or IPv6.</artwork>
</figure>
</section>
<section title="foreignFullAddress">
<figure>
<artwork>
elementId: TBD
name: foreignFullAddress
dataType: ipAddresss
status: current
description: The IP address and network port to which the program
is communicating or will accept communications from, including
the foreign address and foreign port. Note that the IP address
can be IPv4 or IPv6.</artwork>
</figure>
</section>
<section title="selinuxboolean">
<figure>
<artwork>
elementId: TBD
name: selinuxboolean
dataType: list
structure: list (selinuxName, currentStatus,
pendingStatus)
status: current
description: Describes the current and pending status of a
SELinux boolean.
</artwork>
</figure>
</section>
<section title="selinuxName">
<figure>
<artwork>
elementId: TBD
name: selinuxName
dataType: string
status: current
description: The name of the SELinux
boolean.</artwork>
</figure>
</section>
<section title="currentStatus">
<figure>
<artwork>
elementId: TBD
name: currentStatus
dataType: boolean
status: current
description: Indicates current state of
the specified SELinux boolean.</artwork>
</figure>
</section>
<section title="pendingStatus">
<figure>
<artwork>
elementId: TBD
name: pendingStatus
dataType: boolean
status: current
description: Indicates the pending
state of the specified SELinux boolean.</artwork>
</figure>
</section>
<section title="selinuxsecuritycontext">
<figure>
<artwork>
elementId: TBD
name: selinuxsecuritycontext
dataType: list
structure: list (filepath, path, filename, pid,
username, role, domainType, lowSensitivity, lowCategory,
highSensitivity, highCategory, rawlowSensitivity,
rawlowCategory, rawhighSensitivity, rawhighCategory)
status: current
description: Describes the SELinux security
context of a file or process on the local system.</artwork>
</figure>
</section>
<section title="filepath">
<figure>
<artwork>
elementId: TBD
name: filepath
dataType: string
status: current
description: Specifies the absolute path for a file on the
machine. A directory cannot be specified as a filepath.</artwork>
</figure>
</section>
<section title="path">
<figure>
<artwork>
elementId: TBD
name: path
dataType: string
status: current
description: Specifies the directory component of
the absolute path to a file on the machine.</artwork>
</figure>
</section>
<section title="filename">
<figure>
<artwork>
elementId: TBD
name: filename
dataType: string
status: current
description: The name of the file.</artwork>
</figure>
</section>
<section title="pid">
<figure>
<artwork>
elementId: TBD
name: pid
dataType: integer
status: current
description: The process ID of the
process.</artwork>
</figure>
</section>
<section title="role">
<figure>
<artwork>
elementId: TBD
name: role
dataType: string
status: current
description: Specifies the types that a process
may transition to (domain transitions).</artwork>
</figure>
</section>
<section title="domainType">
<figure>
<artwork>
elementId: TBD
name: domainType
dataType: string
status: current
description: Specifies the domain in which the file is accessible
or the domain in which a process executes.</artwork>
</figure>
</section>
<section title="lowSensitivity">
<figure>
<artwork>
elementId: TBD
name: lowSensitivity
dataType: string
status: current
description: Specifies the current sensitivity of a file or
process.</artwork>
</figure>
</section>
<section title="lowCategory">
<figure>
<artwork>
elementId: TBD
name: lowCategory
dataType: string
status: current
description: Specifies the set of
categories associated with the low sensitivity.</artwork>
</figure>
</section>
<section title="highSensitivity">
<figure>
<artwork>
elementId: TBD
name: highSensitivity
dataType: string
status: current
description: Specifies the maximum
range for a file or the clearance for a process.</artwork>
</figure>
</section>
<section title="highCategory">
<figure>
<artwork>
elementId: TBD
name: highCategory
dataType: string
status: current
description: Specifies the set of
categories associated with the high sensitivity.</artwork>
</figure>
</section>
<section title="rawlowSensitivity">
<figure>
<artwork>
elementId: TBD
name: rawlowSensitivity
dataType: string
status: current
description: Specifies the current sensitivity of a file or
process but in its raw context.</artwork>
</figure>
</section>
<section title="rawlowCategory">
<figure>
<artwork>
elementId: TBD
name: rawlowCategory
dataType: string
status: current
description: Specifies the set of categories associated with the
low sensitivity but in its raw context.</artwork>
</figure>
</section>
<section title="rawhighSensitivity">
<figure>
<artwork>
elementId: TBD
name: rawhighSensitivity
dataType: string
status: current
description: Specifies the maximum range for a file or the
clearance for a process but in its raw context.</artwork>
</figure>
</section>
<section title="rawhighCategory">
<figure>
<artwork>
elementId: TBD
name: rawhighCategory
dataType: string
status: current
description: Specifies the set of categories associated with the
high sensitivity but in its raw context.</artwork>
</figure>
</section>
<section title="systemdunitdependency">
<figure>
<artwork>
elementId: TBD
name: systemdunitdependency
dataType: list
structure: list (unit, dependency)
status: current
description: Stores the dependencies of the systemd
unit.</artwork>
</figure>
</section>
<section title="unit">
<figure>
<artwork>
elementId: TBD
name: unit
dataType: string
status: current
description: Refers to the full systemd unit name, which has a
form of "$name.$type". For example "cupsd.service". This name is
usually also the filename of the unit configuration file.
</artwork>
</figure>
</section>
<section title="dependency">
<figure>
<artwork>
elementId: TBD
name: dependency
dataType: string
status: current
description: Refers to the name of a unit that was confirmed to
be a dependency of the given unit.</artwork>
</figure>
</section>
<section title="systemdunitproperty">
<figure>
<artwork>
elementId: TBD
name: systemdunitproperty
dataType: list
structure: list (unit, property, systemdunitValue)
status: current
description: Stores the properties and values of a systemd unit.
</artwork>
</figure>
</section>
<section title="property">
<figure>
<artwork>
elementId: TBD
name: property
dataType: string
status: current
description: The property associated with a
systemd unit.</artwork>
</figure>
</section>
<section title="systemdunitValue">
<figure>
<artwork>
elementId: TBD
name: systemdunitValue
dataType: string
status: current
description: The value of the property associated with a systemd
unit. Exactly one value shall be used for all property types
except dbus arrays - each array element shall be represented by
one value.</artwork>
</figure>
</section>
<section title="file">
<figure>
<artwork>
elementId: TBD
name: file
dataType: list
structure: list (filepath, path, filename, fileType, userId,
aTime, changeTime, mTime, size)
status: current
description: The metadata associated with a file on the endpoint.
</artwork>
</figure>
</section>
<section title="fileType">
<figure>
<artwork>
elementId: TBD
name: fileType
dataType: string
status: current
description: The file's type (e.g., regular file (regular),
directory, named pipe (fifo), symbolic link, socket or block
special.)</artwork>
</figure>
</section>
<section title="groupId">
<figure>
<artwork>
elementId: TBD
name: groupId
dataType: integer
status: current
description: The group owner of the file, by
group number.</artwork>
</figure>
</section>
<section title="aTime">
<figure>
<artwork>
elementId: TBD
name: aTime
dataType: timeStamp
status: current
description: The time that the file was last
accessed.</artwork>
</figure>
</section>
<section title="changeTime">
<figure>
<artwork>
elementId: TBD
name: changeTime
dataType: timeStamp
status: current
description: The time of the last change
to the file's inode.</artwork>
</figure>
</section>
<section title="mTime">
<figure>
<artwork>
elementId: TBD
name: mTime
dataType: timeStamp
status: current
description: The time of the last change to
the file's contents.</artwork>
</figure>
</section>
<section title="size">
<figure>
<artwork>
elementId: TBD
name: size
dataType: integer
status: current
description: This is the size of the file in
bytes.</artwork>
</figure>
</section>
<section title="suid">
<figure>
<artwork>
elementId: TBD
name: suid
dataType: boolean
status: current
description: Indicates whether the program runs with the uid
(thus privileges) of the file's owner, rather than the calling
user.</artwork>
</figure>
</section>
<section title="sgid">
<figure>
<artwork>
elementId: TBD
name: sgid
dataType: boolean
status: current
description: Indicates whether the program runs with the gid
(thus privileges) of the file's group owner, rather than the
calling user's group.</artwork>
</figure>
</section>
<section title="sticky">
<figure>
<artwork>
elementId: TBD
name: sticky
dataType: boolean
status: current
description: Indicates whether users can delete each other's
files in this directory, when said directory is writable by
those users.</artwork>
</figure>
</section>
<section title="hasExtendedAcl">
<figure>
<artwork>
elementId: TBD
name: hasExtendedAcl
dataType: boolean
status: current
description: Indicates whether the file or directory hasACL
permissions applied to it. If a system supports ACLs and the
file or directory doesn't have an ACL, or it matches the standard
UNIX permissions, the entity will have a status of 'exists' and
a value of 'false'. If the system supports ACLs and the file or
directory has an ACL, the entity will have a status of 'exists'
and a value of 'true'. Lastly, if a system doesn't support ACLs,
the entity will have a status of 'does not exist'.</artwork>
</figure>
</section>
<section title="inetd">
<figure>
<artwork>
elementId: TBD
name: inetd
dataType: list
structure: list (serviceProtocol, serviceName, serverProgram,
serverArguments, endpointType, execAsUser, waitStatus)
status: current
description: Holds information associated
with different Internet services.</artwork>
</figure>
</section>
<section title="serverProgram">
<figure>
<artwork>
elementId: TBD
name: serverProgram
dataType: string
status: current
description: Either the pathname of a server program to be
invoked by inetd to perform the requested service, or the value
internal if inetd itself provides the service.</artwork>
</figure>
</section>
<section title="endpointType">
<figure>
<artwork>
elementId: TBD
name: endpointType
dataType: enumeration
structure:
stream ; 0x1 ; The stream value is used to describe a stream
socket.
dgram ; 0x2 ; The dgram value is used to describe a datagram
socket.
raw ; 0x3 ; The raw value is used to describe a raw socket.
seqpacket ; 0x4 ; The seqpacket value is used to describe a
sequenced packet socket.
tli ; 0x5 ; The tli value is used to describe all TLI endpoints.
sunrpc_tcp ; 0x6 ; The sunrpc_tcp value is used to describe all
SUNRPC TCP endpoints.
sunrpc_udp ; 0x7 ; The sunrpc_udp value is used to describe all
SUNRPC UDP endpoints.
; 0x8 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: The endpoint type (aka, socket type) associated with
the service.</artwork>
</figure>
</section>
<section title="execAsUser">
<figure>
<artwork>
elementId: TBD
name: execAsUser
dataType: string
status: current
description: The user id of the user the
server program should run under.</artwork>
</figure>
</section>
<section title="waitStatus">
<figure>
<artwork>
elementId: TBD
name: waitStatus
dataType: enumeration
structure: wait ; 0x1 ; The value of 'wait' specifies that the
server that is invoked by inetd will take over the listening
socket associated with the service, and once launched, inetd will
wait for that server to exit, if ever, before it resumes
listening for new service requests.
nowait ; 0x2 ; The value of 'nowait' specifies that the server
that is invoked by inetd will not wait for any existing server
to finish before taking over the listening socket associated with
the service.
; 0x3 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Specifies whether the server that is invoked by
inetd will take over the listening socket associated with the
service, and whether once launched, inetd will wait for that
server to exit, if ever, before it resumes listening for new
service requests. The legal values are "wait" or "nowait".
</artwork>
</figure>
</section>
<section title="inetAddr">
<figure>
<artwork>
elementId: TBD
name: inetAddr
dataType: ipAddress
status: current
description: The IP address of the specific interface. Note that
the IP address can be IPv4 or IPv6.</artwork>
</figure>
</section>
<section title="netmask">
<figure>
<artwork>
elementId: TBD
name: netmask
dataType: ipAddress
status: current
description: The bitmask used to calculate
the interface's IP network.</artwork>
</figure>
</section>
<section title="passwordInfo">
<figure>
<artwork>
elementId: TBD
name: passwordInfo
dataType: list
structure: list (username, password, userId, groupId, gcos,
homeDir, loginShell, lastLogin)
status: current
description: Describes user account information for a
system.</artwork>
</figure>
</section>
<section title="username">
<figure>
<artwork>
elementId: TBD
name: username
dataType: string
status: current
description: The name of the user.</artwork>
</figure>
</section>
<section title="password">
<figure>
<artwork>
elementId: TBD
name: password
dataType: string
status: current
description: The encrypted version of the
user's password.</artwork>
</figure>
</section>
<section title="gcos">
<figure>
<artwork>
elementId: TBD
name: gcos
dataType: string
status: current
description:</artwork>
</figure>
</section>
<section title="homeDir">
<figure>
<artwork>
elementId: TBD
name: homeDir
dataType: string
status: current
description: The user's home
directory.</artwork>
</figure>
</section>
<section title="loginShell">
<figure>
<artwork>
elementId: TBD
name: loginShell
dataType: string
status: current
description: The user's shell
program.</artwork>
</figure>
</section>
<section title="lastLogin">
<figure>
<artwork>
elementId: TBD
name: lastLogin
dataType: integer
status: current
description: The date and time when the
last login occurred.</artwork>
</figure>
</section>
<section title="process">
<figure>
<artwork>
elementId: TBD
name: process
dataType: list
structure: list (commandLine, pid, ppid, priority, startTime)
status: current
description: Information about a process running on an endpoint.
</artwork>
</figure>
</section>
<section title="commandLine">
<figure>
<artwork>
elementId: TBD
name: commandLine
dataType: string
status: current
description: The string used to start the
process. This includes any parameters that are part of the
command line.</artwork>
</figure>
</section>
<section title="ppid">
<figure>
<artwork>
elementId: TBD
name: ppid
dataType: integer
status: current
description: The process ID of the process's
parent process.</artwork>
</figure>
</section>
<section title="priority">
<figure>
<artwork>
elementId: TBD
name: priority
dataType: integer
status: current
description: The scheduling priority with
which the process runs.</artwork>
</figure>
</section>
<section title="startTime">
<figure>
<artwork>
elementId: TBD
name: startTime
dataType: string
status: current
description: The time of day the process
started.</artwork>
</figure>
</section>
<section title="routingtable">
<figure>
<artwork>
elementId: TBD
name: routingtable
dataType: list
structure: list (destination, gateway, flags,
interfaceName)
status: current
description: Holds information about an individual routing table
entry found in a system's primary routing table.</artwork>
</figure>
</section>
<section title="destination">
<figure>
<artwork>
elementId: TBD
name: destination
dataType: ipaddress
status: current
description: The destination IP address
prefix of the routing table entry.</artwork>
</figure>
</section>
<section title="gateway">
<figure>
<artwork>
elementId: TBD
name: gateway
dataType: ipaddress
status: current
description: The gateway of the specified
routing table entry.</artwork>
</figure>
</section>
<section title="runlevelInfo">
<figure>
<artwork>
elementId: TBD
name: runlevelInfo
dataType: list
structure: list (serviceName, runlevel, start, kill)
status: current
description: Information about the start or kill state of a
specified service at a given runlevel.
</artwork>
</figure>
</section>
<section title="runlevel">
<figure>
<artwork>
elementId: TBD
name: runlevel
dataType: string
status: current
description: Specifies the system runlevel
associated with a service.</artwork>
</figure>
</section>
<section title="start">
<figure>
<artwork>
elementId: TBD
name: start
dataType: boolean
status: current
description: Specifies whether the service is
scheduled to start at the runlevel.</artwork>
</figure>
</section>
<section title="kill">
<figure>
<artwork>
elementId: TBD
name: kill
dataType: boolean
status: current
description: Specifies whether the service is
scheduled to be killed at the runlevel.</artwork>
</figure>
</section>
<section title="shadowItem">
<figure>
<artwork>
elementId: TBD
name: shadowItem
dataType: list
structure: list (username, password, chgLst, chgAllow,
chgReq, expWarn, expInact, expDate, flags, encryptMethod)
status: current
description:</artwork>
</figure>
</section>
<section title="chgLst">
<figure>
<artwork>
elementId: TBD
name: chgLst
dataType: timeStamp
status: current
description: The date of the last password
change.</artwork>
</figure>
</section>
<section title="chgAllow">
<figure>
<artwork>
elementId: TBD
name: chgAllow
dataType: integer
status: current
description: Specifies how often in days a
user may change their password. It can also be thought of
as the minimum age of a password.</artwork>
</figure>
</section>
<section title="chgReq">
<figure>
<artwork>
elementId: TBD
name: chgReq
dataType: integer
status: current
description: Describes how long a user can
keep a password before the system forces her to change it.</artwork>
</figure>
</section>
<section title="expWarn">
<figure>
<artwork>
elementId: TBD
name: expWarn
dataType: integer
status: current
description: Describes how long before
password expiration the system begins warning the user.</artwork>
</figure>
</section>
<section title="expInact">
<figure>
<artwork>
elementId: TBD
name: expInact
dataType: integer
status: current
description: Describes how many days of
account inactivity the system will wait after a password
expires before locking the account.</artwork>
</figure>
</section>
<section title="expDate">
<figure>
<artwork>
elementId: TBD
name: expDate
dataType: timeStamp
status: current
description: Specifies when will the
account's password expire.</artwork>
</figure>
</section>
<section title="encryptMethod">
<figure>
<artwork>
elementId: TBD
name: encryptMethod
dataType: enumeration
structure: DES ; 0x1 ; The DES method corresponds to the (none)
prefix.
BSDi ; 0x2 ; The BSDi method corresponds to BSDi modified
DES or the '_' prefix.
MD5 ; 0x3 ; The MD5 method corresponds to MD5 for Linux/BSD
or the $1$ prefix.
Blowfish ; 0x4 ; The Blowfish method corresponds to Blowfish
(OpenBSD) or the $2$ or $2a$ prefixes.
Sun MD5 ; 0x5 ; The Sun MD5 method corresponds to the $md5$
prefix.
SHA-256 ; 0x6 ; The SHA-256 method corresponds to the $5$
prefix.
SHA-512 ; 0x7 ; The SHA-512 method corresponds to the $6$
prefix. ; 0x8 ; The empty string value is permitted here to
allow for empty elements associated with variable references.
status: current
description: Describes method that is used for hashing
passwords.</artwork>
</figure>
</section>
<section title="symlink">
<figure>
<artwork>
elementId: TBD
name: symlink
dataType: list
structure: list (symlinkFilepath, canonicalPath)
status: current
description: Identifies the result generated for a symlink.</artwork>
</figure>
</section>
<section title="symlinkFilepath">
<figure>
<artwork>
elementId: TBD
name: symlinkFilepath
dataType: string
status: current
description: Specifies the filepath to
the subject symbolic link file.</artwork>
</figure>
</section>
<section title="canonicalPath">
<figure>
<artwork>
elementId: TBD
name: canonicalPath
dataType: string
status: current
description: Specifies the canonical
path for the target of the symbolic link file specified by
the filepath.</artwork>
</figure>
</section>
<section title="sysctl">
<figure>
<artwork>
elementId: TBD
name: sysctl
dataType: list
structure: list (kernelParameterName, kernelParameterValue+,
uname, machineClass, nodeName, osName, osRelease,
osVersion, processorType)
status: current
description: Stores
information retrieved from the local system about a kernel
parameter and its respective value(s).</artwork>
</figure>
</section>
<section title="kernelParameterName">
<figure>
<artwork>
elementId: TBD
name: kernelParameterName
dataType: string
status: current
description: The name of a kernel
parameter that was collected from the local system.</artwork>
</figure>
</section>
<section title="kernelParameterValue">
<figure>
<artwork>
elementId: TBD
name: kernelParameterValue
dataType: string
status: current
description: The current value(s)
for the specified kernel parameter on the local system.</artwork>
</figure>
</section>
<section title="uname">
<figure>
<artwork>
elementId: TBD
name: uname
dataType: list
structure: list (machineClass, nodeName, osName, osRelease,
osVersion, processorType)
status: current
description: Information about the hardware the machine is running
on.</artwork>
</figure>
</section>
<section title="machineClass">
<figure>
<artwork>
elementId: TBD
name: machineClass
dataType: string
status: current
description: Specifies the machine
hardware name.</artwork>
</figure>
</section>
<section title="nodeName">
<figure>
<artwork>
elementId: TBD
name: nodeName
dataType: string
status: current
description: Specifies the host
name.</artwork>
</figure>
</section>
<section title="osName">
<figure>
<artwork>
elementId: TBD
name: osName
dataType: string
status: current
description: Specifies the operating system
name.</artwork>
</figure>
</section>
<section title="osRelease">
<figure>
<artwork>
elementId: TBD
name: osRelease
dataType: string
status: current
description: Specifies the build
version.</artwork>
</figure>
</section>
<section title="osVersion">
<figure>
<artwork>
elementId: TBD
name: osVersion
dataType: string
status: current
description: Specifies the operating system
version.</artwork>
</figure>
</section>
<section title="processorType">
<figure>
<artwork>
elementId: TBD
name: processorType
dataType: string
status: current
description: Specifies the processor
type.</artwork>
</figure>
</section>
<section title="internetService">
<figure>
<artwork>
elementId: TBD
name: internetService
dataType: list
structure: list (serviceProtocol, serviceName, flags,
noAccess, onlyFrom, port, server, serverArguments,
socketType, registeredServiceType, user, wait, disabled)
status: current
description: Holds information associated with Internet services.</artwork>
</figure>
</section>
<section title="serviceProtocol">
<figure>
<artwork>
elementId: TBD
name: serviceProtocol
dataType: string
status: current
description: Specifies the protocol
that is used by the service.</artwork>
</figure>
</section>
<section title="serviceName">
<figure>
<artwork>
elementId: TBD
name: serviceName
dataType: string
status: current
description: Specifies the name of the
service.</artwork>
</figure>
</section>
<section title="flags">
<figure>
<artwork>
elementId: TBD
name: flags
dataType: string
status: current
description: Specifies miscellaneous settings
associated with the service with executing a program.</artwork>
</figure>
</section>
<section title="noAccess">
<figure>
<artwork>
elementId: TBD
name: noAccess
dataType: string
status: current
description: Specifies the remote hosts to
which the service is unavailable.</artwork>
</figure>
</section>
<section title="onlyFrom">
<figure>
<artwork>
elementId: TBD
name: onlyFrom
dataType: ipAddress
status: current
description: Specifies the remote hosts to
which the service is available.</artwork>
</figure>
</section>
<section title="port">
<figure>
<artwork>
elementId: TBD
name: port
dataType: integer
status: current
description: The port entity specifies the port
used by the service.</artwork>
</figure>
</section>
<section title="server">
<figure>
<artwork>
elementId: TBD
name: server
dataType: string
status: current
description: Specifies the executable that is
used to launch the service.</artwork>
</figure>
</section>
<section title="serverArguments">
<figure>
<artwork>
elementId: TBD
name: serverArguments
dataType: string
status: current
description: Specifies the arguments
that are passed to the executable when launching the service.</artwork>
</figure>
</section>
<section title="socketType">
<figure>
<artwork>
elementId: TBD
name: socketType
dataType: string
status: current
description: Specifies the type of socket
that is used by the service. Possible values include: stream,
dgram, raw, or seqpacket.</artwork>
</figure>
</section>
<section title="registeredServiceType">
<figure>
<artwork>
elementId: TBD
name: registeredServiceType
dataType: enumeration
structure: INTERNAL ; 0x1 ; The INTERNAL type is used to describe
services like echo, chargen, and others whose functionality is
supplied by xinetd itself.
RPC ; 0x2 ; The RPC type is used to describe services that
use remote procedure call ala NFS.
UNLISTED ; 0x3 ; The UNLISTED type is used to describe
services that aren't listed in /etc/protocols or /etc/rpc.
TCPMUX ; 0x4 ; The TCPMUX type is used to describe services
that conform to RFC 1078. This type indiciates that the service
is responsible for handling the protocol handshake.
TCPMUXPLUS ; 0x5 ; The TCPMUXPLUS type is used to describe
services that conform to RFC 1078. This type indicates that
xinetd is responsible for handling the protocol
handshake.
; 0x6 ; The empty string value is permitted here to allow
for detailed error reporting.
status: current
description: Specifies the type of internet service.</artwork>
</figure>
</section>
<section title="wait">
<figure>
<artwork>
elementId: TBD
name: wait
dataType: boolean
status: current
description: Specifies whether or not the service is single-threaded
or multi-threaded and whether or not xinetd accepts the connection
or the service accepts the connection. A value of 'true' indicates
that the service is single-threaded and the service will accept the
connection. A value of 'false' indicates that the service is multi-
threaded and xinetd will accept the connection.</artwork>
</figure>
</section>
<section title="disabled">
<figure>
<artwork>
elementId: TBD
name: disabled
dataType: boolean
status: current
description: Specifies whether or not the
service is disabled. A value of 'true' indicates that the
service is disabled and will not start. A value of
'false' indicates that the service is not disabled.</artwork>
</figure>
</section>
<section title="windowsView">
<figure>
<artwork>
elementId: TBD
name: windowsView
dataType: enumeration
structure: 32_bit ; 0x1 ; Indicates the 32_bit windows view.
64_bit ; 0x2 ; Indicates the 64_bit windows view.
; 0x3 ; The empty string value is permitted here to allow for
empty elements associated with error conditions.
status: current
description: Indicates from which
view (32-bit or 64-bit), the information was collected.
A value of '32_bit' indicates the Item was collected from
the 32-bit view. A value of '64-bit' indicates the Item
was collected from the 64-bit view.</artwork>
</figure>
</section>
<section title="fileauditedpermissions">
<figure>
<artwork>
elementId: TBD
name: fileauditedpermissions
dataType: list
structure: list (filepath, path, filename,
trusteeSid, trusteeName, auditStandardDelete,
auditStandardReadControl, auditStandardWriteDac,
auditStandardWriteOwner, auditStandardSynchronize,
auditAccessSystemSecurity, auditGenericRead, auditGenericWrite,
auditGenericExecute, auditGenericAll, auditFileReadData,
auditFileWriteData, auditFileAppendData, auditFileReadEa,
auditFileWriteEa, auditFileExecute, auditFileDeleteChild,
auditFileReadAttributes, auditFileWriteAttributes,
windowsView)
status: current
description: Stores the audited access rights of a file that a
system access control list (SACL) structure grants to a specified
trustee. The trustee's audited access rights are determined checking
all access control entries (ACEs) in the SACL.</artwork>
</figure>
</section>
<section title="trusteeName">
<figure>
<artwork>
elementId: TBD
name: trusteeName
dataType: string
status: current
description: Specifies the trustee name. A
trustee can be a user, group, or program (such as a Windows
service).</artwork>
</figure>
</section>
<section title="auditStandardDelete">
<figure>
<artwork>
elementId: TBD
name: auditStandardDelete
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: The right to delete the object.</artwork>
</figure>
</section>
<section title="auditStandardReadControl">
<figure>
<artwork>
elementId: TBD
name: auditStandardReadControl
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: The right to read the information in the object's
security descriptor, not including the information in the SACL.</artwork>
</figure>
</section>
<section title="auditStandardWriteDac">
<figure>
<artwork>
elementId: TBD
name: auditStandardWriteDac
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: The right to modify the DACL in the object's security
descriptor.</artwork>
</figure>
</section>
<section title="auditStandardWriteOwner">
<figure>
<artwork>
elementId: TBD
name: auditStandardWriteOwner
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: The right to change the owner in the object's security
descriptor.</artwork>
</figure>
</section>
<section title="auditStandardSynchronize">
<figure>
<artwork>
elementId: TBD
name: auditStandardSynchronize
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: The right to use the object for synchronization.
This enables a thread to wait until the object is in the signaled
state. Some object types do not support this access right.</artwork>
</figure>
</section>
<section title="auditAccessSystemSecurity">
<figure>
<artwork>
elementId: TBD
name: auditAccessSystemSecurity
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Indicates access to a system access control list (SACL).</artwork>
</figure>
</section>
<section title="auditGenericRead">
<figure>
<artwork>
elementId: TBD
name: auditGenericRead
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Read access.</artwork>
</figure>
</section>
<section title="auditGenericWrite">
<figure>
<artwork>
elementId: TBD
name: auditGenericWrite
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Write access.</artwork>
</figure>
</section>
<section title="auditGenericExecute">
<figure>
<artwork>
elementId: TBD
name: auditGenericExecute
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Execute access.</artwork>
</figure>
</section>
<section title="auditGenericAll">
<figure>
<artwork>
elementId: TBD
name: auditGenericAll
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Read, write, and execute access.</artwork>
</figure>
</section>
<section title="auditFileReadData">
<figure>
<artwork>
elementId: TBD
name: auditFileReadData
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Grants the right to read data from the file.</artwork>
</figure>
</section>
<section title="auditFileWriteData">
<figure>
<artwork>
elementId: TBD
name: auditFileWriteData
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Grants the right to write data to the file.</artwork>
</figure>
</section>
<section title="auditFileAppendData">
<figure>
<artwork>
elementId: TBD
name: auditFileAppendData
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Grants the right to append data to the file.</artwork>
</figure>
</section>
<section title="auditFileReadEa">
<figure>
<artwork>
elementId: TBD
name: auditFileReadEa
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Grants the right to read extended attributes.</artwork>
</figure>
</section>
<section title="auditFileWriteEa">
<figure>
<artwork>
elementId: TBD
name: auditFileWriteEa
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Grants the right to write extended attributes.</artwork>
</figure>
</section>
<section title="auditFileExecute">
<figure>
<artwork>
elementId: TBD
name: auditFileExecute
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Grants the right to execute a file.</artwork>
</figure>
</section>
<section title="auditFileDeleteChild">
<figure>
<artwork>
elementId: TBD
name: auditFileDeleteChild
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Right to delete a directory and all the files it
contains (its children), even if the files are read-only.</artwork>
</figure>
</section>
<section title="auditFileReadAttributes">
<figure>
<artwork>
elementId: TBD
name: auditFileReadAttributes
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Grants the right to read file attributes.</artwork>
</figure>
</section>
<section title="auditFileWriteAttributes">
<figure>
<artwork>
elementId: TBD
name: auditFileWriteAttributes
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description: Grants the right to change file attributes.</artwork>
</figure>
</section>
<section title="fileeffectiverights">
<figure>
<artwork>
elementId: TBD
name: fileeffectiverights
dataType: list
structure: list (filepath, path, filename,
trusteeSid, trusteeName, standardDelete, standardReadControl,
standardWriteDac, standardWriteOwner,
standardSynchronize, accessSystemSecurity, genericRead,
genericWrite, genericExecute, genericAll, fileReadData,
fileWriteData, fileAppendData, fileReadEa, fileWriteEa,
fileExecute, fileDeleteChild, fileReadAttributes,
fileWriteAttributes, windowsView)
status: current
description: Stores the effective rights of a file that a
discretionary access control list (DACL) structure grants
to a specified trustee. The trustee's effective rights
are determined checking all access-allowed and access-denied
access control entries (ACEs) in the DACL.</artwork>
</figure>
</section>
<section title="standardDelete">
<figure>
<artwork>
elementId: TBD
name: standardDelete
dataType: boolean
status: current
description: The right to delete the
object.</artwork>
</figure>
</section>
<section title="standardReadControl">
<figure>
<artwork>
elementId: TBD
name: standardReadControl
dataType: boolean
status: current
description: The right to read
the information in the object's security descriptor, not
including the information in the SACL.</artwork>
</figure>
</section>
<section title="standardWriteDac">
<figure>
<artwork>
elementId: TBD
name: standardWriteDac
dataType: boolean
status: current
description: The right to modify the
DACL in the object's security descriptor.</artwork>
</figure>
</section>
<section title="standardWriteOwner">
<figure>
<artwork>
elementId: TBD
name: standardWriteOwner
dataType: boolean
status: current
description: The right to change
the owner in the object's security descriptor.</artwork>
</figure>
</section>
<section title="standardSynchronize">
<figure>
<artwork>
elementId: TBD
name: standardSynchronize
dataType: boolean
status: current
description: The right to use the
object for synchronization. This enables a thread to wait
until the object is in the signaled state. Some object
types do not support this access right.</artwork>
</figure>
</section>
<section title="accessSystemSecurity">
<figure>
<artwork>
elementId: TBD
name: accessSystemSecurity
dataType: boolean
status: current
description: Indicates access to
a system access control list (SACL).</artwork>
</figure>
</section>
<section title="genericRead">
<figure>
<artwork>
elementId: TBD
name: genericRead
dataType: boolean
status: current
description: Read access.</artwork>
</figure>
</section>
<section title="genericWrite">
<figure>
<artwork>
elementId: TBD
name: genericWrite
dataType: boolean
status: current
description: Write access.</artwork>
</figure>
</section>
<section title="genericExecute">
<figure>
<artwork>
elementId: TBD
name: genericExecute
dataType: boolean
status: current
description: Execute access.</artwork>
</figure>
</section>
<section title="genericAll">
<figure>
<artwork>
elementId: TBD
name: genericAll
dataType: boolean
status: current
description: Read, write, and execute
access.</artwork>
</figure>
</section>
<section title="fileReadData">
<figure>
<artwork>
elementId: TBD
name: fileReadData
dataType: boolean
status: current
description: Grants the right to read
data from the file</artwork>
</figure>
</section>
<section title="fileWriteData">
<figure>
<artwork>
elementId: TBD
name: fileWriteData
dataType: boolean
status: current
description: Grants the right to write
data to the file.</artwork>
</figure>
</section>
<section title="fileAppendData">
<figure>
<artwork>
elementId: TBD
name: fileAppendData
dataType: boolean
status: current
description: Grants the right to
append data to the file.</artwork>
</figure>
</section>
<section title="fileReadEa">
<figure>
<artwork>
elementId: TBD
name: fileReadEa
dataType: boolean
status: current
description: Grants the right to read
extended attributes.</artwork>
</figure>
</section>
<section title="fileWriteEa">
<figure>
<artwork>
elementId: TBD
name: fileWriteEa
dataType: boolean
status: current
description: Grants the right to write
extended attributes.</artwork>
</figure>
</section>
<section title="fileExecute">
<figure>
<artwork>
elementId: TBD
name: fileExecute
dataType: boolean
status: current
description: Grants the right to execute
a file.</artwork>
</figure>
</section>
<section title="fileDeleteChild">
<figure>
<artwork>
elementId: TBD
name: fileDeleteChild
dataType: boolean
status: current
description: Right to delete a
directory and all the files it contains (its children),
even if the files are read-only.</artwork>
</figure>
</section>
<section title="fileReadAttributes">
<figure>
<artwork>
elementId: TBD
name: fileReadAttributes
dataType: boolean
status: current
description: Grants the right to
read file attributes.</artwork>
</figure>
</section>
<section title="fileWriteAttributes">
<figure>
<artwork>
elementId: TBD
name: fileWriteAttributes
dataType: boolean
status: current
description: Grants the right to
change file attributes.</artwork>
</figure>
</section>
<section title="groupInfo">
<figure>
<artwork>
elementId: TBD
name: groupInfo
dataType: list
structure: list (group, username, subgroup)
status: current
description: Specifies the different users and subgroups, that
directly belong to specific groups.</artwork>
</figure>
</section>
<section title="group">
<figure>
<artwork>
elementId: TBD
name: group
dataType: string
status: current
description: Represents the name of a particular
group.</artwork>
</figure>
</section>
<section title="user">
<figure>
<artwork>
elementId: TBD
name: user
dataType: string
status: current
description: Represents the name of a particular
user.</artwork>
</figure>
</section>
<section title="subgroup">
<figure>
<artwork>
elementId: TBD
name: subgroup
dataType: string
status: current
description: Represents the name of a
particular subgroup in the specified group.</artwork>
</figure>
</section>
<section title="groupSidInfo">
<figure>
<artwork>
elementId: TBD
name: groupSidInfo
dataType: list
structure: list (groupSid, userSid, subgroupSid)
status:
current
description: Specifies the different users and subgroups, that
directly belong to specific groups
(identified by SID).</artwork>
</figure>
</section>
<section title="userSidInfo">
<figure>
<artwork>
elementId: TBD
name: userSidInfo
dataType: list
structure: list (userSid, enabled, groupSid, lastLogon)
status: current
description: Specifies the different groups (identified by SID)
that a user belongs to.</artwork>
</figure>
</section>
<section title="userSid">
<figure>
<artwork>
elementId: TBD
name: userSid
dataType: string
status: current
description: Represents the SID of a
particular user.</artwork>
</figure>
</section>
<section title="subgroupSid">
<figure>
<artwork>
elementId: TBD
name: subgroupSid
dataType: string
status: current
description: Represents the SID of a
particular subgroup.</artwork>
</figure>
</section>
<section title="lockoutpolicy">
<figure>
<artwork>
elementId: TBD
name: lockoutpolicy
dataType: list
structure: list (forceLogoff, lockoutDuration,
lockoutObservationWindow, lockoutThreshold)
status: current
description: Specifies various attributes associated
with lockout information for users and global groups in the
security database.</artwork>
</figure>
</section>
<section title="forceLogoff">
<figure>
<artwork>
elementId: TBD
name: forceLogoff
dataType: integer
status: current
description: Specifies, in seconds, the
amount of time between the end of the valid logon time and
the time when the user is forced to log off the
network.</artwork>
</figure>
</section>
<section title="lockoutDuration">
<figure>
<artwork>
elementId: TBD
name: lockoutDuration
dataType: integer
status: current
description: Specifies, in seconds,
how long a locked account remains locked before it is
automatically unlocked.</artwork>
</figure>
</section>
<section title="lockoutObservationWindow">
<figure>
<artwork>
elementId: TBD
name: lockoutObservationWindow
dataType: integer
status: current
description: Specifies the
maximum time, in seconds, that can elapse between any two
failed logon attempts before lockout occurs.</artwork>
</figure>
</section>
<section title="lockoutThreshold">
<figure>
<artwork>
elementId: TBD
name: lockoutThreshold
dataType: integer
status: current
description: Specifies the number of
invalid password authentications that can occur before an
account is marked "locked out."</artwork>
</figure>
</section>
<section title="passwordpolicy">
<figure>
<artwork>
elementId: TBD
name: passwordpolicy
dataType: list
structure: list (maxPasswdAge, minPasswdAge,
minPasswdLen, passwordHistLen, passwordComplexity,
reversibleEncryption)
status: current
description: Specifies
policy information associated with passwords.</artwork>
</figure>
</section>
<section title="maxPasswdAge">
<figure>
<artwork>
elementId: TBD
name: maxPasswdAge
dataType: integer
status: current
description: Specifies, in seconds (from
a DWORD), the maximum allowable password age. A value of
TIMEQ_FOREVER (max DWORD value, 4294967295) indicates
that the password never expires. The minimum valid value
for this element is ONE_DAY (86400). See the
USER_MODALS_INFO_0 structure returned by a call to
NetUserModalsGet().</artwork>
</figure>
</section>
<section title="minPasswdAge">
<figure>
<artwork>
elementId: TBD
name: minPasswdAge
dataType: integer
status: current
description: Specifies the minimum
number of seconds that can elapse between the time a password
changes and when it can be changed again. A value of
zero indicates that no delay is required between password
updates.</artwork>
</figure>
</section>
<section title="minPasswdLen">
<figure>
<artwork>
elementId: TBD
name: minPasswdLen
dataType: integer
status: current
description: Specifies the minimum
allowable password length. Valid values for this element are
zero through PWLEN.</artwork>
</figure>
</section>
<section title="passwordHistLen">
<figure>
<artwork>
elementId: TBD
name: passwordHistLen
dataType: integer
status: current
description: Specifies the length of
password history maintained. A new password cannot match any
of the previous usrmod0_password_hist_len passwords.
Valid values for this element are zero through DEF_MAX_PWHIST.</artwork>
</figure>
</section>
<section title="passwordComplexity">
<figure>
<artwork>
elementId: TBD
name: passwordComplexity
dataType: boolean
status: current
description: Indicates whether
passwords must meet the complexity requirements put forth
by the operating system.</artwork>
</figure>
</section>
<section title="reversibleEncryption">
<figure>
<artwork>
elementId: TBD
name: reversibleEncryption
dataType: boolean
status: current
description: Indicates whether
or not passwords are stored using reversible encryption.</artwork>
</figure>
</section>
<section title="portInfo">
<figure>
<artwork>
elementId: TBD
name: portInfo
dataType: list
structure: list (localAddress, localPort, transportProtocol,
pid, foreignAddress, foreignPort)
status: current
description: Information about open listening ports.</artwork>
</figure>
</section>
<section title="foreignPort">
<figure>
<artwork>
elementId: TBD
name: foreignPort
dataType: string
status: current
description: The TCP or UDP port to which
the program communicates.</artwork>
</figure>
</section>
<section title="printereffectiverights">
<figure>
<artwork>
elementId: TBD
name: printereffectiverights
dataType: list
structure: list (printerName, trusteeSid,
standardDelete, standardReadControl, standardWriteDac,
standardWriteOwner, standardSynchronize,
accessSystemSecurity, genericRead, genericWrite,
genericExecute, genericAll, printerAccessAdminister,
printerAccessUse, jobAccessAdminister, jobAccessRead)
status: current
description: Stores the effective rights of a printer that a
discretionary access control list (DACL) structure grants to a
specified trustee. The trustee's effective rights are determined
checking all access-allowed and access-denied access control
entries (ACEs) in the DACL.</artwork>
</figure>
</section>
<section title="printerName">
<figure>
<artwork>
elementId: TBD
name: printerName
dataType: string
status: current
description: Specifies the name of the
printer.</artwork>
</figure>
</section>
<section title="printerAccessAdminister">
<figure>
<artwork>
elementId: TBD
name: printerAccessAdminister
dataType: boolean
status: current
description:</artwork>
</figure>
</section>
<section title="printerAccessUse">
<figure>
<artwork>
elementId: TBD
name: printerAccessUse
dataType: boolean
status: current
description:</artwork>
</figure>
</section>
<section title="jobAccessAdminister">
<figure>
<artwork>
elementId: TBD
name: jobAccessAdminister
dataType: boolean
status: current
description:</artwork>
</figure>
</section>
<section title="jobAccessRead">
<figure>
<artwork>
elementId: TBD
name: jobAccessRead
dataType: boolean
status: current
description:</artwork>
</figure>
</section>
<section title="registry">
<figure>
<artwork>
elementId: TBD
name: registry
dataType: list
structure: list (hive, key, registryKeyName, lastWriteTime,
registryKeyType, registryKeyValue, windowsView)
status: current
description: Specifies information that can be
collected about a particular registry key.</artwork>
</figure>
</section>
<section title="hive">
<figure>
<artwork>
elementId: TBD
name: hive
dataType: enumeration
structure: HKEY_CLASSES_ROOT ; 0x1 ; This registry subtree
contains information that associates file types with programs
and configuration data for automation (e.g. COM
objects and Visual Basic Programs).
HKEY_CURRENT_CONFIG ; 0x2 ; This registry subtree contains
configuration data for the current hardware profile.
HKEY_CURRENT_USER ; 0x3 ; This registry subtree contains the
user profile of the user that is currently logged into the
system.
HKEY_LOCAL_MACHINE ; 0x4 ; This registry subtree contains
information about the local system.
HKEY_USERS ; 0x5 ; This registry subtree contains user-specific
data.
; 0x6 ; The empty string value is permitted here to allow
for detailed error reporting.
status: current
description: The
hive that the registry key belongs to.</artwork>
</figure>
</section>
<section title="registryKey">
<figure>
<artwork>
elementId: TBD
name: registryKey
dataType: string
status: current
description: Describes the registry key.
Note that the hive portion of the string should not be
included, as this data can be found under the hive
element.</artwork>
</figure>
</section>
<section title="registryKeyName">
<figure>
<artwork>
elementId: TBD
name: registryKeyName
dataType: string
status: current
description: Describes the name of a
registry key.</artwork>
</figure>
</section>
<section title="lastWriteTime">
<figure>
<artwork>
elementId: TBD
name: lastWriteTime
dataType: integer
status: current
description: The last time that the key or any of its value entries
were modified. The value of this entity represents the
FILETIME structure which is a 64-bit value representing the
number of 100-nanosecond intervals since January 1, 1601
(UTC). Last write time can be queried on any key, with hives
being classified as a type of key. When collecting only
information about a registry hive or key the last write time
will be the time the key or any of its entries were modified.
When collecting only information about a registry name the
last write time will be the time the containing key was
modified. Thus when collecting information about a registry
name, the last write time does not correlate directly
to the specified name. See the RegQueryInfoKey function
lpftLastWriteTime.</artwork>
</figure>
</section>
<section title="registryKeyType">
<figure>
<artwork>
elementId: TBD
name: registryKeyType
dataType: enumeration
structure: reg_binary ; 0x1 ; The reg_binary type
is used by registry keys that specify binary data in any
form.
reg_dword ; 0x2 ; The reg_dword type is used by
registry keys that specify an unsigned 32-bit integer.
reg_dword_little_endian ; 0x3 ; The reg_dword_little_endian
type is used by registry keys that specify an unsigned 32-bit
little-endian integer. It is designed to run on
little-endian computer architectures.
reg_dword_big_endian ; 0x4 ; The reg_dword_big_endian type
is used by registry keys that specify an unsigned 32-bit
big-endian integer. It is designed to run on big-endian
computer architectures.
reg_expand_sz ; 0x5 ; The reg_expand_sz type is used by
registry keys to specify a null-terminated
string that contains unexpanded references to environment
variables (for example, "%PATH%").
reg_link ; 0x6 ; The reg_link type is used by the registry
keys for null-terminated unicode strings. It is related to
target path of a symbolic link created by the
RegCreateKeyEx function.
reg_multi_sz ; 0x7 ; The reg_multi_sz type is used by
registry keys that specify an array of null-terminated
strings, terminated by two null characters.
reg_none; 0x8 ;
The reg_none type is used by registry keys that have no
defined value type.
reg_qword; 0x9 ; The reg_qword type is used by registry keys
that specify an unsigned 64-bit integer.
reg_qword_little_endian; 0xA ; The reg_qword_little_endian
type is used by registry keys that specify an unsigned
64-bit integer in little-endian computer architectures.
reg_sz; 0xB ; The reg_sz type is used by registry keys that
specify a single null-terminated string.
reg_resource_list; 0xC ; The reg_resource_list type is used
by registry keys that specify a resource list.
reg_full_resource_descriptor; 0xD ; The
reg_full_resource_descriptor type is used by registry
keys that specify a full resource descriptor.
reg_resource_requirements_list; 0xE ; The
reg_resource_requirements_list type is used by registry keys
that specify a resource requirements list.
; 0xF ; The empty string value is permitted here to allow
for detailed error reporting.
status: current
description:
Specifies the type of data stored by the registry key.</artwork>
</figure>
</section>
<section title="registryKeyValue">
<figure>
<artwork>
elementId: TBD
name: registryKeyValue
dataType: string
status: current
description: Holds the actual value
of the specified registry key. The representation of the
value as well as the associated datatype attribute
depends on type of data stored in the registry key. If the
value being tested is of type REG_BINARY, then the
datatype attribute should be set to 'binary' and the data
represented by the value entity should follow the
xsd:hexBinary form. (each binary octet is encoded as two hex
digits) If the value being tested is of type
REG_DWORD, REG_QWORD, REG_DWORD_LITTLE_ENDIAN,
REG_DWORD_BIG_ENDIAN, or REG_QWORD_LITTLE_ENDIAN then the
datatype attribute should be set to 'int' and the value
entity should represent the data as an unsigned integer.
DWORD and QWORD values represnt unsigned 32-bit and 64-bit
integers, respectively. If the value being tested is of type
REG_EXPAND_SZ, then the datatype attribute should be set to
'string' and the pre-expanded string should be
represented by the value entity. If the value being tested
is of type REG_MULTI_SZ, then only a single string (one
of the multiple strings) should be tested using the value
entity with the datatype attribute set to 'string'. In
order to test multiple values, multiple OVAL registry tests
should be used. If the specified registry key is of
type REG_SZ, then the datatype should be 'string' and the
value entity should be a copy of the string. If the
value being tested is of type REG_LINK, then the datatype
attribute should be set to 'string' and the
null-terminated Unicode string should be represented by the
value entity.</artwork>
</figure>
</section>
<section title="regkeyauditedpermissions">
<figure>
<artwork>
elementId: TBD
name: regkeyauditedpermissions
dataType: list
structure: list (key, trusteeSid, trusteeName,
standardDelete, standardReadControl, standardWriteDac,
standardWriteOwners, tandardSynchronize,
accessSystemSecurity, genericRead, genericWrite,
genericExecute, genericAll, keyQueryValue, keySetValue,
keyCreateSubKey, keyEnumerateSubKeys, keyNotify,
keyCreateLink, keyWow6464Key, keyWow6432Key, keyWow64Res,
windowsView)
status: current
description: Stores the audited access rights of a registry key
that a system access control list (SACL) structure grants to a
specified trustee. The trustee's audited access rights are
determined checking all access control entries (ACEs) in the SACL.</artwork>
</figure>
</section>
<section title="auditKeyQueryValue">
<figure>
<artwork>
elementId: TBD
name: auditKeyQueryValue
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description:</artwork>
</figure>
</section>
<section title="auditKeySetValue">
<figure>
<artwork>
elementId: TBD
name: auditKeySetValue
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description:</artwork>
</figure>
</section>
<section title="auditKeyCreateSubKey">
<figure>
<artwork>
elementId: TBD
name: auditKeyCreateSubKey
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description:</artwork>
</figure>
</section>
<section title="auditKeyEnumerateSubKeys">
<figure>
<artwork>
elementId: TBD
name: auditKeyEnumerateSubKeys
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description:</artwork>
</figure>
</section>
<section title="auditKeyNotify">
<figure>
<artwork>
elementId: TBD
name: auditKeyNotify
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description:</artwork>
</figure>
</section>
<section title="auditKeyCreateLink">
<figure>
<artwork>
elementId: TBD
name: auditKeyCreateLink
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description:</artwork>
</figure>
</section>
<section title="auditKeyWow6464Key">
<figure>
<artwork>
elementId: TBD
name: auditKeyWow6464Key
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description:</artwork>
</figure>
</section>
<section title="auditKeyWow6432Key">
<figure>
<artwork>
elementId: TBD
name: auditKeyWow6432Key
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description:</artwork>
</figure>
</section>
<section title="auditKeyWow64Res">
<figure>
<artwork>
elementId: TBD
name: auditKeyWow64Res
dataType: enumeration
structure: AUDIT_FAILURE ; 0x1 ; The audit type AUDIT_FAILURE is
used to perform audits on all unsuccessful occurrences of
specified events when auditing is enabled.
AUDIT_NONE ; 0x2 ; The audit type AUDIT_NONE is used to cancel
all auditing options for the specified events.
AUDIT_SUCCESS ; 0x3 ; The audit type AUDIT_SUCCESS is used to
perform audits on all successful occurrences of the specified
events when auditing is enabled.
AUDIT_SUCCESS_FAILURE ; 0x4 ; The audit type AUDIT_SUCCESS_FAILURE
is used to perform audits on all successful and unsuccessful
occurrences of the specified events when auditing is enabled.
; 0x5 ; The empty string value is permitted here to allow for
detailed error reporting.
status: current
description:</artwork>
</figure>
</section>
<section title="regkeyeffectiverights">
<figure>
<artwork>
elementId: TBD
name: regkeyeffectiverights
dataType: list
structure: list (hive, key, trusteeSid,
trusteeName, standardDelete, standardReadControl,
standardWriteDac, standardWriteOwner, standardSynchronize,
accessSystemSecurity, genericRead, genericWrite,
genericExecute, genericAll, keyQueryValue, keySetValue,
keyCreateSubKey, keyEnumerateSubKeys, keyNotify,
keyCreateLink, keyWow6464Key, keyWow6432Key, keyWow64Res,
windowsView)
status: current
description: Stores the effective rights of a registry key that a
discretionary access control list (DACL) structure grants to a
specified trustee. The trustee's effective rights are determined
checking all access-allowed and access-denied access control
entries (ACEs) in the DACL.</artwork>
</figure>
</section>
<section title="keyQueryValue">
<figure>
<artwork>
elementId: TBD
name: keyQueryValue
dataType: boolean
status: current
description: Specifies whether or not
permission is granted to query the key's value.</artwork>
</figure>
</section>
<section title="keySetValue">
<figure>
<artwork>
elementId: TBD
name: keySetValue
dataType: boolean
status: current
description: Specifies whether or not
permission is granted to set the key's value.</artwork>
</figure>
</section>
<section title="keyCreateSubKey">
<figure>
<artwork>
elementId: TBD
name: keyCreateSubKey
dataType: boolean
status: current
description: Specifies whether or not
permission is granted to create a subkey.</artwork>
</figure>
</section>
<section title="keyEnumerateSubKeys">
<figure>
<artwork>
elementId: TBD
name: keyEnumerateSubKeys
dataType: boolean
status: current
description: Specifies whether or
not permission is granted to list the subkeys associated
with key.</artwork>
</figure>
</section>
<section title="keyNotify">
<figure>
<artwork>
elementId: TBD
name: keyNotify
dataType: boolean
status: current
description:</artwork>
</figure>
</section>
<section title="keyCreateLink">
<figure>
<artwork>
elementId: TBD
name: keyCreateLink
dataType: boolean
status: current
description:</artwork>
</figure>
</section>
<section title="keyWow6464Key">
<figure>
<artwork>
elementId: TBD
name: keyWow6464Key
dataType: boolean
status: current
description:</artwork>
</figure>
</section>
<section title="keyWow6432Key">
<figure>
<artwork>
elementId: TBD
name: keyWow6432Key
dataType: boolean
status: current
description:</artwork>
</figure>
</section>
<section title="keyWow64Res">
<figure>
<artwork>
elementId: TBD
name: keyWow64Res
dataType: boolean
status: current
description:</artwork>
</figure>
</section>
<section title="service">
<figure>
<artwork>
elementId: TBD
name: service
dataType: list
structure: list (serviceName, displayName, description,
serviceType, tartType, currentState, controlsAccepted,
startName, path, pid, serviceFlag, dependencies)
status: current
description: Stores information about Windows services that are
present on the system.</artwork>
</figure>
</section>
<section title="displayName">
<figure>
<artwork>
elementId: TBD
name: displayName
dataType: string
status: current
description: Specifies the name of the
service as specified in administrative tools.</artwork>
</figure>
</section>
<section title="description">
<figure>
<artwork>
elementId: TBD
name: description
dataType: string
status: current
description: Specifies the description of
the service.</artwork>
</figure>
</section>
<section title="serviceType">
<figure>
<artwork>
elementId: TBD
name: serviceType
dataType: enumeration
structure: SERVICE_FILE_SYSTEM_DRIVER ; 0x1 ; The
SERVICE_FILE_SYSTEM_DRIVER type means that the service is
a file system driver. The DWORD value that this
corresponds to is 0x00000002.
SERVICE_KERNEL_DRIVER ; 0x2 ; The SERVICE_KERNEL_DRIVER type
means that the service is a driver. The DWORD value that
this corresponds to is 0x00000001.
SERVICE_WIN32_OWN_PROCESS ; 0x3 ; The SERVICE_WIN32_OWN_PROCESS
type means that the service runs in its own process. The DWORD
value that this corresponds to is 0x00000010.
SERVICE_WIN32_SHARE_PROCESS ; 0x4 ; The
SERVICE_WIN32_SHARE_PROCESS type means that the service runs
in a process with other services. The DWORD value that this
corresponds to is 0x00000020.
SERVICE_INTERACTIVE_PROCESS ; 0x5 ; The
SERVICE_WIN32_SHARE_PROCESS type means that the service runs
in a process with other services. The DWORD value that this
corresponds to is 0x00000100.
; 0x6 ; The empty string value is permitted here to allow for
empty elements associated with error conditions.
status: current
description:
Specifies the type of the service.</artwork>
</figure>
</section>
<section title="startType">
<figure>
<artwork>
elementId: TBD
name: startType
dataType: enumeration
structure: SERVICE_AUTO_START ; 0x1 ; The SERVICE_AUTO_START type
means that the service is started automatically by the Service
Control Manager (SCM) during startup. The DWORD value that
this corresponds to is 0x00000002.
SERVICE_BOOT_START ; 0x2 ; The SERVICE_BOOT_START type means
that the driver service is started by the system loader. The
DWORD value that this corresponds to is 0x00000000.
SERVICE_DEMAND_START ; 0x3 ; The SERVICE_DEMAND_START type
means that the service is started by the Service Control
Manager (SCM) when StartService() is called. The DWORD value
that this corresponds to is 0x00000003.
SERVICE_DISABLED ; 0x4 ; The SERVICE_DISABLED type means
that the service cannot be started. The DWORD value that
this corresponds to is 0x00000004.
SERVICE_SYSTEM_START ; 0x5 ; The SERVICE_SYSTEM_START type
means that the service is a device driver started by
IoInitSystem(). The DWORD value that this corresponds to is
0x00000001.
; 0x6 ; The empty string value is permitted here to allow
for empty elements associated with error conditions.
status: current
description: Specifies when the service should be started.</artwork>
</figure>
</section>
<section title="currentState">
<figure>
<artwork>
elementId: TBD
name: currentState
dataType: enumeration
structure: SERVICE_CONTINUE_PENDING ; 0x1 ; The
SERVICE_CONTINUE_PENDING type means that the service has been
sent a command to continue, however, the command has
not yet been executed. The DWORD value that this corresponds
to is 0x00000005. SERVICE_PAUSE_PENDING ; 0x2 ; The
SERVICE_PAUSE_PENDING type means that the service has been
sent a command to pause, however, the command has not
yet been executed. The DWORD value that this corresponds to
is 0x00000006.
SERVICE_PAUSED ; 0x3 ; The SERVICE_PAUSED type means that
the service is paused. The DWORD value that this corresponds
to is 0x00000007.
SERVICE_RUNNING ; 0x4 ; The SERVICE_RUNNING type means that
the service is running. The DWORD value that this
corresponds to is 0x00000004.
SERVICE_START_PENDING ; 0x5 ; The SERVICE_START_PENDING type
means that the service has been sent a command to start,
however, the command has not yet been executed. The DWORD
value that this corresponds to is 0x00000002.
SERVICE_STOP_PENDING ; 0x6 ; The SERVICE_STOP_PENDING type
means that the service
has been sent a command to stop, however, the command has
not yet been executed. The DWORD value that this
corresponds to is 0x00000003.
SERVICE_STOPPED ; 0x7 ; The SERVICE_STOPPED type means that
the service is stopped. The DWORD value that this corresponds
to is 0x00000001.
; 0x8 ; The empty string value is permitted here to allow
for empty elements associated with error conditions.
status: current
description: Specifies the current state of
the service.</artwork>
</figure>
</section>
<section title="controlsAccepted">
<figure>
<artwork>
elementId: TBD
name: controlsAccepted
dataType: enumeration strucutre: SERVICE_ACCEPT_NETBINDCHANGE ; 0x1 ;
The SERVICE_ACCEPT_NETBINDCHANGE type means that the
service is a network component and can accept changes in its
binding without being stopped or restarted. The DWORD value
that this corresponds to is 0x00000010.
SERVICE_ACCEPT_PARAMCHANGE ; 0x2 ; The SERVICE_ACCEPT_PARAMCHANGE
type means that the service can re-read its
startup parameters without being stopped or restarted. The
DWORD value that this corresponds to is 0x00000008.
SERVICE_ACCEPT_PAUSE_CONTINUE ; 0x3 ; The
SERVICE_ACCEPT_PAUSE_CONTINUE type means that the service
can be paused or continued. The DWORD value that this
corresponds to is 0x00000002.
SERVICE_ACCEPT_PRESHUTDOWN ; 0x4 ; The
SERVICE_ACCEPT_PRESHUTDOWN type means that the service can
receive pre-shutdown notifications. The DWORD value
that this corresponds to is 0x00000100.
SERVICE_ACCEPT_SHUTDOWN ; 0x5 ; The SERVICE_ACCEPT_SHUTDOWN
type means that the service can receive shutdown notifications.
The DWORD value that this corresponds to is 0x00000004.
SERVICE_ACCEPT_STOP ; 0x6 ; The SERVICE_ACCEPT_STOP type
means that the service can be stopped. The DWORD value
that this corresponds to is 0x00000001.
SERVICE_ACCEPT_HARDWAREPROFILECHANGE ; 0x7 ; The
SERVICE_ACCEPT_HARDWAREPROFILECHANGE type means that the
service can receive notifications when the system's
hardware profile changes. The DWORD value that this
corresponds to is 0x00000020.
SERVICE_ACCEPT_POWEREVENT ; 0x8 ; The SERVICE_ACCEPT_POWEREVENT
type means that the service can receive notifications when the
system's power status has changed. The DWORD value that this
corresponds to is 0x00000040.
SERVICE_ACCEPT_SESSIONCHANGE ; 0x9 ; The
SERVICE_ACCEPT_SESSIONCHANGE type means that the service can
receive notifications when the system's session
status has changed. The DWORD value that this corresponds
to is 0x00000080.
SERVICE_ACCEPT_TIMECHANGE ; 0xA ; The SERVICE_ACCEPT_TIMECHANGE
type means that the service can receive notifications when
the system time changes. The DWORD value that this corresponds
to is 0x00000200.
SERVICE_ACCEPT_TRIGGEREVENT ; 0xB ; The
SERVICE_ACCEPT_TRIGGEREVENT type means that the service can
receive notifications when an event that the service
has registered for occurs on the system. The DWORD value that
this corresponds to is 0x00000400.
; 0xC ; The empty string value is permitted here to allow
for empty elements associated with error conditions.
status: current
description: Specifies the control codes that a service will
accept and process.</artwork>
</figure>
</section>
<section title="startName">
<figure>
<artwork>
elementId: TBD
name: startName
dataType: string
status: current
description: Specifies the account under
which the process should run.</artwork>
</figure>
</section>
<section title="serviceFlag">
<figure>
<artwork>
elementId: TBD
name: serviceFlag
dataType: boolean
status: current
description: Specifies whether the
service is in a system process that must always run (true)
or if the service is in a non-system process or is not
running (false).</artwork>
</figure>
</section>
<section title="dependencies">
<figure>
<artwork>
elementId: TBD
name: dependencies
dataType: string
status: current
description: Specifies the dependencies
of this service on other services.</artwork>
</figure>
</section>
<section title="serviceeffectiverights">
<figure>
<artwork>
elementId: TBD
name: serviceeffectiverights
dataType: list
structure: list (serviceName, trusteeSid,
standardDelete, standardReadControl, standardWriteDac,
standardWriteOwner, genericRead, genericWrite,
genericExecute, serviceQueryConfs, erviceChangeConf,
serviceQueryStat, serviceEnumDependents, serviceStart,
serviceStop, servicePause, serviceInterrogate,
serviceUserDefined)
status: current
description: Stores the
effective rights of a service that a discretionary access
control list (DACL) structure grants to a specified
trustee. The trustee's effective rights are determined by
checking all access-allowed and access-denied access
control entries (ACEs) in the DACL.</artwork>
</figure>
</section>
<section title="trusteeSid">
<figure>
<artwork>
elementId: TBD
name: trusteeSid
dataType: string
status: current
description: Specifies the SID that is
associated with a user, group, system, or program (such as a
Windows service).</artwork>
</figure>
</section>
<section title="serviceQueryConf">
<figure>
<artwork>
elementId: TBD
name: serviceQueryConf
dataType: boolean
status: current
description: Specifies whether or
not permission is granted to query the service configuration.</artwork>
</figure>
</section>
<section title="serviceChangeConf">
<figure>
<artwork>
elementId: TBD
name: serviceChangeConf
dataType: boolean
status: current
description: Specifies whether or
not permission is granted to change service configuration.</artwork>
</figure>
</section>
<section title="serviceQueryStat">
<figure>
<artwork>
elementId: TBD
name: serviceQueryStat
dataType: boolean
status: current
description: Specifies whether or
not permission is granted to query the service control
manager about the status of the service.</artwork>
</figure>
</section>
<section title="serviceEnumDependents">
<figure>
<artwork>
elementId: TBD
name: serviceEnumDependents
dataType: boolean
status: current
description: Specifies whether
or not permission is granted to query for an enumeration of
all the services dependent on the service.</artwork>
</figure>
</section>
<section title="serviceStart">
<figure>
<artwork>
elementId: TBD
name: serviceStart
dataType: boolean
status: current
description: Specifies whether or not
permission is granted to start the service.</artwork>
</figure>
</section>
<section title="serviceStop">
<figure>
<artwork>
elementId: TBD
name: serviceStop
dataType: boolean
status: current
description: Specifies whether or not
permission is granted to stop the service.</artwork>
</figure>
</section>
<section title="servicePause">
<figure>
<artwork>
elementId: TBD
name: servicePause
dataType: boolean
status: current
description: Specifies whether or not
permission is granted to pause or continue the service.</artwork>
</figure>
</section>
<section title="serviceInterrogate">
<figure>
<artwork>
elementId: TBD
name: serviceInterrogate
dataType: boolean
status: current
description: Specifies whether or not permission is granted to
request the service to report its status immediately.</artwork>
</figure>
</section>
<section title="serviceUserDefined">
<figure>
<artwork>
elementId: TBD
name: serviceUserDefined
dataType: boolean
status: current
description: Specifies whether or
not permission is granted to specify a user-defined
control code.</artwork>
</figure>
</section>
<section title="sharedresourceauditedpermissions">
<figure>
<artwork>
elementId: TBD
name: sharedresourceauditedpermissions
dataType: list
structure: list (netname, trusteeSid,
standardDelete, standardReadControl, standardWriteDac,
standardWriteOwner, standardSynchronize,
accessSystemSecurity, genericRead, genericWrite,
genericExecute, genericAll)
status: current
description: Stores
the audited access rights of a shared resource that a system
access control list (SACL) structure grants to a
specified trustee. The trustee's audited access rights are
determined checking all access control entries (ACEs)
in the SACL.</artwork>
</figure>
</section>
<section title="netname">
<figure>
<artwork>
elementId: TBD
name: netname
dataType: string
status: current
description: Specifies the name associated
with a particular shared resource.</artwork>
</figure>
</section>
<section title="sharedresourceeffectiverights">
<figure>
<artwork>
elementId: TBD
name: sharedresourceeffectiverights
dataType: list
structure: list (netname, trusteeSid,
standardDelete, standardReadControl, standardWriteDac,
standardWriteOwner, standardSynchronize,
accessSystemSecurity, genericRead, genericWrite,
genericExecute, genericAll)
status: current
description: Stores
the effective rights of a shared resource that a
discretionary access control list (DACL) structure grants
to a specified trustee. The trustee's effective rights are
determined checking all access-allowed and access-denied
access control entries (ACEs) in the DACL.</artwork>
</figure>
</section>
<section title="user">
<figure>
<artwork>
elementId: TBD
name: user
dataType: list
structure: list (username, enabled, group, lastLogon)
status: current
description: Specifies the groups to which a user belongs.</artwork>
</figure>
</section>
<section title="enabled">
<figure>
<artwork>
elementId: TBD
name: enabled
dataType: boolean
status: current
description: Represents whether the
particular user is enabled or not.</artwork>
</figure>
</section>
<section title="lastLogon">
<figure>
<artwork>
elementId: TBD
name: lastLogon
dataType: integer
status: current
description: The date and time when the
last logon occurred.</artwork>
</figure>
</section>
<section title="groupSid">
<figure>
<artwork>
elementId: TBD
name: groupSid
dataType: string
status: current
description: Represents the SID of a
particular group. If the specified user belongs to more than
one group, then multiple groupSid elements are
applicable. If the specified user is not a member of a single
group, then a single groupSid element should be
incldued with a status of 'does not exist'. If there is an
error determining the groups that the user belongs to,
then a single groupSid element should be included with a
status of 'error'.</artwork>
</figure>
</section>
</section>
<section anchor="Acknowledgements" title="Acknowledgements">
<t>Many of the specifications in this document have been developed in a public-private
partnership with vendors and end-users. The hard work of the SCAP community is
appreciated in advancing these efforts to their current level of adoption.</t>
<t>Over the course of developing the initial draft, Brant Cheikes, Matt Hansbury, Daniel
Haynes, Scott Pope, Charles Schmidt, and Steve Venema have contributed text to many sections of this
document.</t>
</section>
<section anchor="IANA" title="IANA Considerations">
<t>This document specifies an initial set of Information Elements for SACM in
<xref target="information-model-elements"/>. An Internet Assigned Numbers
Authority (IANA) registry will be created and populated with the Information
Elements in <xref target="information-model-elements"/>. New assignments
for SACM Information Elements will be administered by IANA through Expert
Review <xref target="RFC2434"/>. The designated experts MUST check the
requested Information Elements for completeness and accuracy of the
submission with respect to the template and requirements expressed in
<xref target="structure-of-information-elements"/> and
<xref target="naming-convention"/>. Requests for Information Elements that
duplicate the functionality of existing Information Elements SHOULD be
declined. The smallest available Information Element identifier SHOULD be
assigned to a new Information Element. The definition of new Information
Elements MUST be published using a well-established and persistent publication
medium.</t>
</section>
<section title="Security Considerations" anchor="security-considerations">
<t>Posture Assessments need to be performed in a safe and secure manner. In that
regard, there are multiple aspects of security that apply to the communications
between components as well as the capabilities themselves. This information
model only contains an initial listing of items that need to be considered
with respect to security and will need to be augmented as the model continues
to be developed.</t>
<t>Security considerations include:<list style="hanging" hangIndent="8">
<t hangText="Authentication:">Every SACM Component and asset needs to be
able to identify itself and verify the identity of other SACM
Components and assets.</t>
<t hangText="Confidentiality:">Communications between SACM Components need
to be protected from eavesdropping or unauthorized collection. Some
communications between SACM Components and assets may need to be protected
as well.</t>
<t hangText="Integrity:">The information exchanged between SACM Components
needs to be protected from modification. Some exchanges between assets
and SACM Components will also have this requirement.</t>
<t hangText="Restricted Access:">Access to the information collected,
evaluated, reported, and stored should only be viewable and consumable to
authenticated and authorized entities.</t>
</list></t>
<t>Considerations with respect to the operational aspects of collection, evaluation,
and storage security automation information can be found in
<xref target="operational-considerations"/>.</t>
<t>Considerations concerning the privacy of security automation information can be
found in <xref target="privacy-considerations"/>.</t>
</section>
<section title="Operational Considerations" anchor="operational-considerations">
<t>The following sections outline a series of operational considerations for SACM
deployments within an organization. This section may be expanded to include
other considerations as the WG gains additional operational experience
with SACM deployments and extending the information model.</t>
<section title="Endpoint Designation" anchor="endpoint-designation">
<t>In order to successfully carry out endpoint posture assessment, it is
necessary to be able to identify the endpoints on a network and track the
changes to them over time. Specifically, enabling SACM Components to:
<list style="symbols">
<t>Tell whether two endpoint attribute assertions concern the same
endpoint</t>
<t>Respond to compliance measurements, for example by reporting,
remediating, and quarantining (SACM does not specify these responses,
but SACM exists to enable them).</t>
</list>
</t>
<t>Ideally, every endpoint would be identified by a unique identifier present on
the endpoint, but, this is complicated due to different factors such as the
variety of endpoints on a network, the ability of tools to reliably access such
an identifer, and the ability of tools to correlate disparate identifiers. As a
result, it is necessary for an endpoint to be identified by a set of attributes
that uniquely identify it on a network. The set of attributes that uniquely
identify an endpoint on a network will likely vary by organization; however, there are
a number of properties to consider when selecting identifying attributes as some
are better suited for identification purposes than others.
<list style="hanging" hangIndent="8">
<t hangText="Multiplicity:">Is the attribute typically associated with a single endpoint
or with multiple endpoints? If the attribute is associated with a single
endpoint, it is better for identifying an endpoint on a network.</t>
<t hangText="Persistence:">How likely is the attribute to change? Does it never change?
Does it only change when the endpoint is reprovisioned? Does it only change
due to an event? Does it change on an ad-hoc and often unpredictable basis?
Does it constantly change? The less likely it is for an attribute to change
over time, the better it is for identifying an endpoint on a network.</t>
<t hangText="Immutability:">How difficult is it to change the attribute? Is the attribute
hardware rooted and never changes? Can the attribute be changed by a
user/process with the appropriate access? Can the attribute be changed
without controlled access. The less likely an attribute is to change over
time, the better chance it will be usable to identify an endpoint over time.</t>
<t hangText="Verifiable:">Can the attribute be corroborated? Can the attribute be externally
verified with source authentication? Can the attribute be externally verified
without source authentication? Is it impossible to externally verify the
attribute. Attributes that can be externally verified are more likely to be
accurate and are better for identifying endpoints on a network.
</t>
</list>
</t>
<t>With that said, requiring SACM Components and end users to constantly refer to a set
of attributes to identify an endpoint, is particularly burdensome. As a result, SACM
supports the concept of a target endpoint label which associates an identifier (unique
to a SACM domain) with the set of attributes used by an organization to identify
endpoints on a network. Once defined for an endpoint, the target endpoint label can be
used in place of the set of identifying attributes.</t>
</section>
<section title="Timestamp Accuracy" anchor="timestamp-accuracy">
<t>An organization will likely have different collectors deployed across the network that
will be configured to collect posture attributes on varying frequencies (periodic, ad-hoc,
event-driven, on endpoint, off endpoint, etc.). Some collectors will detect changes as soon
as they occur whereas others will detect them at a later point during a periodic scan or
when an event has triggered the collection of posture attributes. Furthermore, some changes
will be detected on the endpoint and others will be observed off of the endpoint. As a result
of these differences, the accuracy of the timestamp associated with the collected information
will vary. For example, if a collector is only running once every 12 hours, the change probably
happened at some point in time prior to the scan and the timestamp is likely not accurate. Due
to this, it is important for system administrators to determine if the accuracy of a timestamp
is good enough for their intended purposes.
</t>
</section>
</section>
<section title="Privacy Considerations" anchor="privacy-considerations">
<t>In the IETF, there are privacy concerns with respect to endpoint
identity and monitoring. This is especially true when the
activity on an endpoint can be linked to a particular person. For
example, by correlating endpoint attributes such as usernames,
certificates, etc. with browser activity, it may be possible to
gain insight in to user behavior and trends beyond what is
required to carry out endpoint posture assessments. In the hands
of the wrong person, this information could be used to negatively
influence a user's behavior or to plan attacks against the
organization's infrastructure.</t>
<t>As a result, SACM data models should incorporate a mechanism by
which an organization can designate which endpoint attributes are
considered sensitive with respect to privacy. This will allow
SACM Components to handle endpoint attributes in a manner
consistent with the organization's privacy policies. Furthermore,
organization's should put the proper mechanism in place to ensure
endpoint attributes are protected when transmitted, stored, and
accessed to ensure only authorized parties are granted access.</t>
<t>It should also be noted that some of this is often mitigated by
organizational policies that require a user of an organization's
network to consent to some level of monitoring in return for
access to the network and other resources. The information that
is monitored and collected will vary by organization and further
highlights the need for a mechanism by which an organization can
specify what constitutes privacy sensitive information for them.</t>
</section>
</middle>
<!-- *****BACK MATTER ***** -->
<back>
<!-- References split into informative and normative -->
<!-- There are 2 ways to insert reference entries from the citation libraries:
1. define an ENTITY at the top, and use "ampersand character"RFC2629; here (as shown)
2. simply use a PI "less than character"?rfc include="reference.RFC.2119.xml"?> here
(for I-Ds: include="reference.I-D.narten-iana-considerations-rfc2434bis.xml")
Both are cited textually in the same manner: by using xref elements.
If you use the PI option, xml2rfc will, by default, try to find included files in the same
directory as the including file. You can also define the XML_LIBRARY environment variable
with a value containing a set of directories to search. These can be either in the local
filing system or remote ones accessed by http (http://domain/dir/... ).-->
<references title="Normative References">
<!--?rfc include="http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml"?-->
&RFC2119;
<reference anchor="PEN" target="https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers">
<front>
<title>Private Enterprise Numbers</title>
<author>
<organization>Internet Assigned Numbers Authority</organization>
</author>
<date month="July" year="2016"/>
</front>
</reference>
</references>
<references title="Informative References">
<!-- Here we use entities that we defined at the beginning. -->
&RFC3580; &RFC4949; &RFC5209; &RFC2434;
&RFC5793; &RFC7012; &RFC7632;
&I-D.ietf-sacm-requirements; &I-D.ietf-sacm-terminology;
</references>
<section title="Change Log">
<section title="Changes in Revision 01" anchor="changes-in-revision-01">
<t>Added some proposed normative text.</t>
<t>For provenance:
<list style="symbol">
<t>Added a class "Method"</t>
<t>Added the produced-using relationship between an AVP and a method</t>
<t>Added the produced-by relationship between a Guidance and a SACM Component</t>
<t>Added the hosted-by relationship between a SACM Component and an Endpoint</t>
</list>
</t>
<t>asserted-by and summarized-by have been renamed to produced-by.</t>
<t>"User" is now "Account". If a user has different credentials, SACM
cannot know that they belong to the same user. But, per Kim W, many
organizations do have accounts that associate credentials.</t>
<t>The multiplicity of the based-on relationships has been corrected.</t>
<t>More relationships now have labels, per UML convention.</t>
<t>The diagram no longer has causal arrow. They had become redundant and were
nonstandard and clutter.</t>
<t>Renamed "credential" to "identity", following industry usage. A credential includes
proof, such as a key or password. A username or a distinguished name is called an
"identity".</t>
<t>Removed Session, because an endpoint's network activity is not SACM's initial focus</t>
<t>Removed Authorization, for the same reason</t>
<t>Added many-to-many relationship between Hardware Component and Endpoint, for clarity</t>
<t>Added many-to-many relationship between Software Component and Endpoint, for clarity</t>
<t>Added "contains" relationship between Network Interface and Network Interface</t>
<t>Removed relationship between Network Interface and Account. The endpoint knows the identity it used to gain network access. The PDP also knows that. But they probably do not know the account.</t>
<t>Added relationship between Network Interface and Identity. The endpoint and the PDP will typically know the identity.</t>
<t>Made identity-to-account a many-to-one relationship.</t>
</section>
<section title="Changes in Revision 02" anchor="changes-in-revision-02">
<t>Added Section Identifying Attributes.</t>
<t>Split the figure into Figure Model of Endpoint and Figure Information Elements.</t>
<t>Added Figure Information Elements Take 2, proposing a triple-store model.</t>
<t>Some editorial cleanup</t>
</section>
<section title="Changes in Revision 03">
<t>Moved <xref target="changes-in-revision-01"/>, <xref target="changes-in-revision-02"/>, and Mapping to SACM Use Cases into the Appendix. Added a reference to it in <xref target="INTRO"/></t>
<t>Added the <xref target="structure-of-information-elements"/> section. Provided notes for the type of information we need to add in this section.</t>
<t>Added the <xref target="information-model-assets"/> section. Moved sections on Endpoint, Hardware Component, Software Component, Hardware Instance, and Software Instance there. Provided notes for the type of information we need to add in this section.</t>
<t>Removed the Provenance of Information Section. SACM is not going to solve provenance rather give organizations enough information to figure it out.</t>
<t>Updated references to the Endpoint Security Posture Assessment: Enterprise Use Cases document to reflect that it was published as an RFC.</t>
<t>Fixed the formatting of a few figures.</t>
<t>Included references to <xref target="RFC3580"/> where RADIUS is mentioned.</t>
</section>
<section title="Changes in Revision 04">
<t>Integrated the IPFIX <xref target="RFC7012"/> syntax
into <xref target="structure-of-information-elements"/>.</t>
<t>Converted many of the existing SACM Information
Elements to the IPFIX syntax.</t>
<t>Included existing IPFIX Information Elements and
datatypes that could likely be reused for SACM in <xref
target="information-model-elements"/> and <xref
target="structure-of-information-elements"/>
respectively.</t>
<t>Removed the sections related to reports as described
in https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/30.</t>
<t>Cleaned up other text throughout the document.</t>
</section>
<section title="Changes in Revision 05">
<t>Merged proposed changes from the I-D IM into
the WG IM (https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/41).</t>
<t>Fixed some formatting warnings.</t>
<t>Removed a duplicate IE and added a few IE datatypes
that were missing.</t>
</section>
<section title="Changes in Revision 06">
<t>Clarified that the SACM statement and content-element subjects are conceptual
and that they do not need to be explicitly defined in a data model as long as
the necessary information is provided.</t>
<t>Updated the IPFIX syntax used to define Information Elements. There are still
a couple of open issues that need to be resolved.</t>
<t>Updated some of the Information Elements contained in Section 7 to use the revised
IPFIX syntax. The rest of the Information Elements will be converted in a later
revision.</t>
<t>Performed various clean-up and refactoring in Sections 6 and 7. Still need to
go through Section 8.</t>
<t>Removed appendices that were not referenced in the body of the draft. The text
from them is still available in previous revisions of this document if needed.</t>
</section>
<section title="Changes in Revision 07">
<t>Made various changes to the IPFIX syntax based on discussions at the IETF 96 Meeting.
Changes included the addition of a structure property to the IE specification template,
the creation of an enumeration datatype, and the
specification of an IE naming convention.</t>
<t>Provided text to define Collection Guidance, Evaluation Guidance, Classification Guidance,
Storage Guidance, and Evaluation Results.</t>
<t>Included additional IEs related to software, configuration, and the vulnerability assessment
scenario.</t>
<t>Added text for the IANA considerations, security considerations, operational considerations,
and privacy considerations sections.</t>
<t>Performed various other editorial changes and clean-up.</t>
</section>
</section>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-24 07:27:30 |