Section 4.1.1 - How Known

[jimsch]

Version -02

As part of the missing considerations - are consumers expected to mark with multiple tags or is there going to be some type of - "I deduced this based on other data in the attributes." This does not match either observation (it was not seen in network traffic) or authority (it was not external source of data).

[djhaynes]

Examples given in this section were: self, authority, observation, and verification.

The current information model defines a collectionTaskType which includes values like: network-observation, remote-acquisition, self-reported.

We probably need to make a more generic type that captures this information beyond just collection such as the case if the information was retrieved from a repository.

To your point Jim, maybe we need a "derived" value that covers the case where an attribute was deduced based on other data.

Thanks,

Danny

[jimsch]

This has changed a lot since the original comment. I think that adding derived would be fine

[djhaynes]

We should also add "authority" and "verified" to collectionTaskType. It looks like they were not carried over along with the other values (https://tools.ietf.org/html/draft-ietf-sacm-information-model-02#section-4.1.1)