Gr8 idea. However many folks on the list don’t have access to the wiki. Is there a process to get that access?
debo On 12/13/15, 5:12 AM, "George Vetticaden" <[email protected]> wrote: >Going forward, lets start documenting meeting notes here: >https://cwiki.apache.org/confluence/display/METRON/Meeting+Minutes > > >-- >George VetticadenPrincipal, COE >[email protected] >(630) 909-9138 > > > > > >On 12/12/15 8:24 AM, "George Vetticaden" <[email protected]> >wrote: > >>Team, >> >>Here are the meeting minutes from our first requirements meeting. >>For a first meeting, I believe it was productive. >> >>You can also find the notes from the meeting here: >>http://tinyurl.com/oehgnep >> >> >>-----Meeting Summary-------- >> >>Discussion of various requirements for Metron. We reviewed the following >>docs: >> >>1. Discover reviewed the following requirement doc: >>https://onedrive.live.com/view.aspx?cid=e12c061b74681e7c&page=view&resid= >>E >>1 >>2C061B74681E7C!5700&parId=E12C061B74681E7C!5694&authkey=!ANEjQgPa9cgzVts& >>a >>p >>p=Excel >> >> >>2. George reviewed the following requirement doc: >>https://onedrive.live.com/view.aspx?cid=e12c061b74681e7c&page=view&resid= >>E >>1 >>2C061B74681E7C!5699&parId=E12C061B74681E7C!5694&authkey=!ANEjQgPa9cgzVts& >>a >>p >>p=Word >> >> >> >> >>------Attendees----------- >> >> >> >>Discover Gerdes - Rackspace >> >>George Vetticaden - Hortonworks >> >>James Sirota - Hortonworks >> >>Noreen Santini - Hortonworks >> >>Oskar Zabik - Rackspace >> >>Mark Bittmann - b23 >> >>Debo Dutta - Cisco >> >> >> >> >> >>--------Notes----------- >> >> >> >>1. Need to come up with Taxonomy for Metron so everyone is speaking the >>same language. Need to finalize and define terms such as: >> >> 1. Event >> >> 2. Alert >> >> 3. Incident >> >> 4. Asset >> >> 5. Risk >> >> 6. Threat >> >> 7. Urgency >> >> >> >>2. For Rackspace, multi-tenancy requirements will be key. They will have >>multiple customers using shared infrastructure where data will need to >>flow into a single Metron cluster. So being able to identify an event >>associated with a specific customer are critical. >> >>3. Different Personas of the users of the system include: >> >> 1. Junior Security Analyst >> >> 2. Senior Security Analyst >> >> 3. Admin >> >> 4. Customer Facing / Executives >> >> >> >>4. Alerting Management Requirements >> >> 1. Suppress an Alert Temporarily and time based (suppress for 24 hours) >> >> 2. Suppress an Alert Permanently >> >> >> >>5. Need examples of correlation and SIEM rules >> >>6. Ability to search, pivot and build complex queries via UI (pivoting >>and >>clicking) will be important. E.g: Select a "Watchlisted Threat Alert", >>then click on Details, Select Destination Souce --> Right click and do >>Search as Source IP --> executes a Search >> >>7. Approach to Requirements and Design >> >> 1. For Legacy SIM functionality --> Start with UI requirements and drive >>platform requirement >> >> 2. For Next Analytical functionality --> Start with Analytics and then >>drive UI requirement >> >> >>8. What Next? >> >> 1. Need to create Customer Survey and send to SOC teams to collect and >>prioritize requirements >> >> 2. From requirements, create some wireframes >> >> 3. With wireframes, conduct "interviews" with various SOC teams with >>wireframes >> >> 4. Iterate on requirements and wireframes. >> >> >> >> >> >> >>------Post-Meeting Followup/Action Item-------- >> >> 1. George: Send out meeting minutes. >> >> 2. George: Send out shared doc for Customer Survey >> >> 3. George: Schedule weekly Requirements meeting invite every Thursday >>from 9 CST - 10:30 CST >> >> 4. Noreen and Oskar: Meet on UI and Customer Survey , start wireframes >>and then publish out meeting minutes to apache metron dev team >> >> >> >> >> >>-- >>George Vetticaden >>Principal, COE >>[email protected] >>(630) 909-9138 >> >> >> >> >> >>On 12/10/15 10:28 PM, "James Sirota" <[email protected]> wrote: >> >>>Based on demand let¹s do WebEx >>> >>>Here is a link: >>> >>>https://hortonworks.webex.com/hortonworks/j.php?MTID=m8273c3ef30a61911c9 >>>f >>>7 >>>e897c57c752a >>> >>> >>>Thanks, >>>James >>> >>> >>> >>> >>> >>>On 12/8/15, 6:02 PM, "Andrew Hartnett" <[email protected]> >>>wrote: >>> >>>>James didn't add enough info to the email. We are planning on a >>>>meeting >>>>Friday at 9am CST to discuss plans for the UI. James' ask for >>>>participants is to gauge which medium to hold the meeting. Since wire >>>>frames and other visual discussions are needed, we are looking at >>>>holding a Webex or another video conf. Any recommendations that come >>>>from this will be pushed to Jira. >>>> >>>>Andrew Hartnett >>>>Sr. Dev Warlord - Rackspace Managed Security >>>>210.744.4101 >>>> >>>>________________________________________ >>>>From: P. Taylor Goetz <[email protected]> >>>>Sent: Tuesday, December 8, 2015 4:18 PM >>>>To: [email protected] >>>>Subject: COMMERCIAL:Re: [DISCUSS] UI Requirements Meeting >>>> >>>>> On Dec 8, 2015, at 3:59 PM, James Sirota <[email protected]> >>>>>wrote: >>>>> >>>>> We will have a meeting to discuss the initial UI requirements for >>>>>Metron. If you want to participate please respond to this thread and >>>>>we¹ll send >>>> >>>>Is there a reason the invite couldn¹t be sent to the whole dev@ list? >>>> >>>>I would also suggest proposing a date/time a few days in advance so >>>>those in various time zones have enough notice to attend. >>>> >>>>And as Owen pointed out in another thread, only discussions and >>>>recommendations can come from any such meeting. Any decisions have to >>>>be >>>>made on the mailing lists. >>>> >>>>-Taylor >>>> >> >> >
