Clarification: by access I meant ability to edit the wiki.
On 12/13/15, 8:27 AM, "Debo Dutta (dedutta)" <[email protected]> wrote: >Gr8 idea. However many folks on the list don’t have access to the wiki. Is >there a process to get that access? > >debo > >On 12/13/15, 5:12 AM, "George Vetticaden" <[email protected]> >wrote: > >>Going forward, lets start documenting meeting notes here: >>https://cwiki.apache.org/confluence/display/METRON/Meeting+Minutes >> >> >>-- >>George VetticadenPrincipal, COE >>[email protected] >>(630) 909-9138 >> >> >> >> >> >>On 12/12/15 8:24 AM, "George Vetticaden" <[email protected]> >>wrote: >> >>>Team, >>> >>>Here are the meeting minutes from our first requirements meeting. >>>For a first meeting, I believe it was productive. >>> >>>You can also find the notes from the meeting here: >>>http://tinyurl.com/oehgnep >>> >>> >>>-----Meeting Summary-------- >>> >>>Discussion of various requirements for Metron. We reviewed the following >>>docs: >>> >>>1. Discover reviewed the following requirement doc: >>>https://onedrive.live.com/view.aspx?cid=e12c061b74681e7c&page=view&resid >>>= >>>E >>>1 >>>2C061B74681E7C!5700&parId=E12C061B74681E7C!5694&authkey=!ANEjQgPa9cgzVts >>>& >>>a >>>p >>>p=Excel >>> >>> >>>2. George reviewed the following requirement doc: >>>https://onedrive.live.com/view.aspx?cid=e12c061b74681e7c&page=view&resid >>>= >>>E >>>1 >>>2C061B74681E7C!5699&parId=E12C061B74681E7C!5694&authkey=!ANEjQgPa9cgzVts >>>& >>>a >>>p >>>p=Word >>> >>> >>> >>> >>>------Attendees----------- >>> >>> >>> >>>Discover Gerdes - Rackspace >>> >>>George Vetticaden - Hortonworks >>> >>>James Sirota - Hortonworks >>> >>>Noreen Santini - Hortonworks >>> >>>Oskar Zabik - Rackspace >>> >>>Mark Bittmann - b23 >>> >>>Debo Dutta - Cisco >>> >>> >>> >>> >>> >>>--------Notes----------- >>> >>> >>> >>>1. Need to come up with Taxonomy for Metron so everyone is speaking the >>>same language. Need to finalize and define terms such as: >>> >>> 1. Event >>> >>> 2. Alert >>> >>> 3. Incident >>> >>> 4. Asset >>> >>> 5. Risk >>> >>> 6. Threat >>> >>> 7. Urgency >>> >>> >>> >>>2. For Rackspace, multi-tenancy requirements will be key. They will have >>>multiple customers using shared infrastructure where data will need to >>>flow into a single Metron cluster. So being able to identify an event >>>associated with a specific customer are critical. >>> >>>3. Different Personas of the users of the system include: >>> >>> 1. Junior Security Analyst >>> >>> 2. Senior Security Analyst >>> >>> 3. Admin >>> >>> 4. Customer Facing / Executives >>> >>> >>> >>>4. Alerting Management Requirements >>> >>> 1. Suppress an Alert Temporarily and time based (suppress for 24 hours) >>> >>> 2. Suppress an Alert Permanently >>> >>> >>> >>>5. Need examples of correlation and SIEM rules >>> >>>6. Ability to search, pivot and build complex queries via UI (pivoting >>>and >>>clicking) will be important. E.g: Select a "Watchlisted Threat Alert", >>>then click on Details, Select Destination Souce --> Right click and do >>>Search as Source IP --> executes a Search >>> >>>7. Approach to Requirements and Design >>> >>> 1. For Legacy SIM functionality --> Start with UI requirements and >>>drive >>>platform requirement >>> >>> 2. For Next Analytical functionality --> Start with Analytics and then >>>drive UI requirement >>> >>> >>>8. What Next? >>> >>> 1. Need to create Customer Survey and send to SOC teams to collect and >>>prioritize requirements >>> >>> 2. From requirements, create some wireframes >>> >>> 3. With wireframes, conduct "interviews" with various SOC teams with >>>wireframes >>> >>> 4. Iterate on requirements and wireframes. >>> >>> >>> >>> >>> >>> >>>------Post-Meeting Followup/Action Item-------- >>> >>> 1. George: Send out meeting minutes. >>> >>> 2. George: Send out shared doc for Customer Survey >>> >>> 3. George: Schedule weekly Requirements meeting invite every Thursday >>>from 9 CST - 10:30 CST >>> >>> 4. Noreen and Oskar: Meet on UI and Customer Survey , start wireframes >>>and then publish out meeting minutes to apache metron dev team >>> >>> >>> >>> >>> >>>-- >>>George Vetticaden >>>Principal, COE >>>[email protected] >>>(630) 909-9138 >>> >>> >>> >>> >>> >>>On 12/10/15 10:28 PM, "James Sirota" <[email protected]> wrote: >>> >>>>Based on demand let¹s do WebEx >>>> >>>>Here is a link: >>>> >>>>https://hortonworks.webex.com/hortonworks/j.php?MTID=m8273c3ef30a61911c >>>>9 >>>>f >>>>7 >>>>e897c57c752a >>>> >>>> >>>>Thanks, >>>>James >>>> >>>> >>>> >>>> >>>> >>>>On 12/8/15, 6:02 PM, "Andrew Hartnett" <[email protected]> >>>>wrote: >>>> >>>>>James didn't add enough info to the email. We are planning on a >>>>>meeting >>>>>Friday at 9am CST to discuss plans for the UI. James' ask for >>>>>participants is to gauge which medium to hold the meeting. Since wire >>>>>frames and other visual discussions are needed, we are looking at >>>>>holding a Webex or another video conf. Any recommendations that come >>>>>from this will be pushed to Jira. >>>>> >>>>>Andrew Hartnett >>>>>Sr. Dev Warlord - Rackspace Managed Security >>>>>210.744.4101 >>>>> >>>>>________________________________________ >>>>>From: P. Taylor Goetz <[email protected]> >>>>>Sent: Tuesday, December 8, 2015 4:18 PM >>>>>To: [email protected] >>>>>Subject: COMMERCIAL:Re: [DISCUSS] UI Requirements Meeting >>>>> >>>>>> On Dec 8, 2015, at 3:59 PM, James Sirota <[email protected]> >>>>>>wrote: >>>>>> >>>>>> We will have a meeting to discuss the initial UI requirements for >>>>>>Metron. If you want to participate please respond to this thread and >>>>>>we¹ll send >>>>> >>>>>Is there a reason the invite couldn¹t be sent to the whole dev@ list? >>>>> >>>>>I would also suggest proposing a date/time a few days in advance so >>>>>those in various time zones have enough notice to attend. >>>>> >>>>>And as Owen pointed out in another thread, only discussions and >>>>>recommendations can come from any such meeting. Any decisions have to >>>>>be >>>>>made on the mailing lists. >>>>> >>>>>-Taylor >>>>> >>> >>> >> >
