This module defines a YANG data module for consumer-facing interface to security controller.
Version: 2018-11-04
module ietf-policy-general { yang-version 1; namespace "urn:ietf:params:xml:ns:yang:ietf-policy-general"; prefix cf-interface; import ietf-yang-types { prefix yang; } import ietf-inet-types { prefix inet; } organization "IETF I2NSF (Interface to Network Security Functions) Working Group"; contact "WG Web: <http://tools.ietf.org/wg/i2nsf> WG List: <mailto:i2nsf@ietf.org> WG Chair: Adrian Farrel <mailto:Adrain@olddog.co.uk> WG Chair: Linda Dunbar <mailto:Linda.duhbar@huawei.com> Editor: Jaehoon Paul Jeong <mailto:pauljeong@skku.edu>"; description "This module defines a YANG data module for consumer-facing interface to security controller."; revision "2018-11-04" { description "fourth revision"; reference "draft-kumar-i2nsf-client-facing-interface-im-04"; } container policy { description "This object is a policy instance to have complete information such as where and when a policy need to be applied."; list rule { key "rule-id"; description "This is a container for rules."; leaf rule-id { type uint16; description "This is ID for rules."; } leaf name { type string; description "This field idenfifies the name of this object."; } leaf date { type yang:date-and-time; description "Date this object was created or last modified"; } leaf case { type string; description "to identify whether the rule belongs to web filter or enterprise mode."; } list event { key "event-id"; description "This represents the security event of a policy-rule."; leaf event-id { type string; mandatory true; description "This represents the event-id."; } leaf name { type string; description "This field idenfifies the name of this object."; } leaf date { type yang:date-and-time; description "Date this object was created or last modified"; } leaf event-type { type string; description "This field identifies the event of policy enforcement trigger type."; } leaf time-information { type string; description "This field contains time calendar such as BEGIN-TIME and END-TIME for one time enforcement or recurring time calendar for periodic enforcement."; } leaf event-map-group { type leafref { path "/threat-feed/event-map-group/event-map-group-id"; } description "This field contains security events or threat map in order to determine when a policy need to be activated. This is a reference to Evnet-Map-Group."; } leaf enable { type boolean; description "This determines whether the condition matches the security event or not."; } } // list event list condition { key "condition-id"; description "This represents the condition of a policy-rule."; leaf condition-id { type string; description "This represents the condition-id."; } leaf source { type string; description "This field identifies the source of the traffic. This could be reference to either 'Policy Endpoint Group' or 'Threat-Feed' or 'Custom-List' if Security Admin wants to specify the source; otherwise, the default is to match all traffic."; } leaf destination { type string; description "This field identifies the source of the traffic. This could be reference to either 'Policy Endpoint Group' or 'Threat-Feed' or 'Custom-List' if Security Admin wants to specify the source; otherwise, the default is to match all traffic."; } leaf match { type boolean; description "This field identifies the match criteria used to evaluate whether the specified action need to be taken or not. This could be either a Policy- Endpoint-Group identifying a Application set or a set of traffic rules."; } leaf match-direction { type string; description "This field identifies if the match criteria is to evaluated for both direction of the traffic or only in one direction with default of allowing in the other direction for stateful match conditions. This is optional and by default rule should apply in both directions."; } leaf exception { type string; description "This field identifies the exception consideration when a rule is evaluated for a given communication. This could be reference to Policy-Endpoint-Group object or set of traffic matching criteria."; } } // list condition list policy-action { key "policy-action-id"; description "This object represents actions that a Security Admin wants to perform based on a certain traffic class."; leaf policy-action-id { type string; mandatory true; description "this represents the policy-action-id."; } leaf name { type string; description "The name of the policy-action object."; } leaf date { type yang:date-and-time; description "When the object was created or last modified."; } leaf primary-action { type string; description "This field identifies the action when a rule is matched by NSF. The action could be one of 'PERMIT', 'DENY', 'RATE-LIMIT', 'TRAFFIC-CLASS', 'AUTHENTICATE-SESSION', 'IPS, 'APP-FIREWALL', etc."; } leaf secondary-action { type string; description "This field identifies additional actions if a rule is matched. This could be one of 'LOG', 'SYSLOG', 'SESSION-LOG', etc."; } leaf owner { type string; description "This field defines the owner of this policy. Only the owner is authorized to modify the contents of the policy."; } } // list policy-action } // list rule } // container policy container multi-tenancy { description "The descriptions of multi-tenancy."; list policy-domain { key "policy-domain-id"; description "this represent the list of policy domains"; leaf policy-domain-id { type uint16; description "This represents the list of domains."; } leaf name { type string; mandatory true; description "Name of the organization or customer representing this domain."; } leaf address { type string; description "address of an organization or customer."; } leaf contact { type string; mandatory true; description "contact information of the organization or customer."; } leaf date { type yang:date-and-time; mandatory true; description "The date when this account was created or last modified."; } list policy-tenant { key "policy-tenant-id"; description "This represents the list of tenants"; leaf policy-tenant-id { type uint16; description "The policy tenant id."; } leaf name { type string; mandatory true; description "Name of the Department or Division within an organization."; } leaf date { type yang:date-and-time; mandatory true; description "Date this account was created or last modified."; } leaf domain { type leafref { path "/multi-tenancy/policy-domain/policy-domain-id"; } description "This field identifies the domain to which this tenant belongs. This should be reference to a 'Policy-Domain' object."; } } // list policy-tenant leaf authentication-method { type leafref { path "/multi-tenancy/policy-mgnt-auth-method/policy-mgnt-auth-method-id"; } description "Authentication method to be used for this domain. It should be a reference to a 'policy-mgmt-auth-method' object."; } } // list policy-domain list policy-role { key "policy-role-id"; description "This represents the list of policy roles."; leaf policy-role-id { type uint16; mandatory true; description "This defines a set of permissions assigned to a user in an organization that want to manage its own Security Policies."; } leaf name { type string; mandatory true; description "This field identifies name of the role."; } leaf date { type yang:date-and-time; mandatory true; description "Date this role was created or last modified."; } leaf access-profile { type string; mandatory true; description "This field identifies the access profile for the role. The profile grants or denies access to policy objects. Multiple access profiles can be concatenated together."; } } // list policy-role list policy-user { key "policy-user-id"; description "This represents the list of policy users."; leaf policy-user-id { type uint16; description "This represents the policy-user-id."; } leaf name { type string; mandatory true; description "The name of a user."; } leaf date { type yang:date-and-time; mandatory true; description "Date this user was created or last modified"; } leaf password { type string; mandatory true; description "User password for basic authentication"; } leaf email { type string; mandatory true; description "The email account of a user"; } leaf scope-type { type string; description "identifies whether a user has domain-wide or tenant-wide privileges"; } leaf scope-reference { type string; description "This references policy-domain or policy-tenant to identify the scope."; } leaf role { type string; mandatory true; description "This references policy-role to define specific permissions"; } } // list policy-user list policy-mgnt-auth-method { key "policy-mgnt-auth-method-id"; description "The descriptions of policy management authentication methods."; leaf policy-mgnt-auth-method-id { type uint16; description "This represents the authentication method id."; } leaf name { type string; mandatory true; description "name of the authentication method"; } leaf date { type yang:date-and-time; mandatory true; description "date when the authentication method was created"; } leaf authentication-method { type enumeration { enum "password" { value 0; description "password-based authentication."; } enum "token" { value 1; description "token-based authentication."; } enum "certificate" { value 2; description "certificate-based authentication."; } } mandatory true; description "The description of authentication method; token-based, password, certificate, single-sign-on"; } leaf mutual-authentication { type boolean; mandatory true; description "To identify whether the authentication is mutual"; } leaf token-server { type inet:ipv4-address; mandatory true; description "The token-server information if the authentication method is token-based"; } leaf certificate-server { type inet:ipv4-address; mandatory true; description "The certificate-server information if the authentication method is certificate-based"; } leaf single-sing-on-server { type inet:ipv4-address; mandatory true; description "The single-sign-on-server information if the authentication method is single-sign-on-based"; } } // list policy-mgnt-auth-method } // container multi-tenancy container endpoint-group { description "A logical entity in their business environment, where a security policy is to be applied."; list meta-data-source { key "meta-data-source-id"; description "This represents the meta-data source."; leaf meta-data-source-id { type uint16; mandatory true; description "This represents the meta-data source id."; } leaf name { type string; mandatory true; description "This identifies the name of the meta-datas-ource."; } leaf date { type yang:date-and-time; mandatory true; description "This identifies the date this object was created or last modified."; } leaf tag-type { type boolean; description "This identifies the group type; user group, app group or device group."; } leaf tag-server-information { type inet:ipv4-address; description "The description of suthentication method; token-based, password, certificate, single-sign-on"; } leaf tag-application-protocol { type string; description "This filed identifies the protocol e.g. LDAP, Active Directory, or CMDB"; } leaf tag-server-credential { type string; description "This field identifies the credential information needed to access the tag server"; } } // list meta-data-source list user-group { key "user-group-id"; description "This represents the user group."; leaf user-group-id { type uint16; mandatory true; description "This represents the the user group id."; } leaf name { type string; description "This field identifies the name of user-group."; } leaf date { type yang:date-and-time; description "when this user-group was created or last modified."; } leaf group-type { type enumeration { enum "user-tag" { value 0; description "The user group is based on user-tag."; } enum "user-name" { value 1; description "The user group is based on user-name."; } enum "ip-address" { value 2; description "The user group is based on ip-address."; } } description "This describes the group type; User-tag, User-name or IP-address."; } leaf meta-data-server { type inet:ipv4-address; description "This references metadata source"; } leaf group-member { type string; description "This describes the user-tag information"; } leaf risk-level { type uint16; description "This represents the threat level; valid range may be 0 to 9."; } } // list user-group list device-group { key "device-group-id"; description "This represents a device group."; leaf device-group-id { type uint16; description "This represents a device group id."; } leaf name { type string; description "This field identifies the name of a device-group."; } leaf date { type yang:date-and-time; description "The date when this group was create or last modified."; } leaf group-type { type enumeration { enum "device-tag" { value 0; description "The device group is based on device-tag."; } enum "device-name" { value 1; description "The device group is based on device-name."; } enum "ip-address" { value 2; description "The device group is based on ip-address."; } } description "This describes the group type; device-tag, device-name or IP-address."; } leaf meta-data-server { type inet:ipv4-address; description "This references meta-data-source object."; } leaf group-member { type string; description "This describes the device-tag, device-name or IP-address information"; } leaf risk-level { type uint16; description "This represents the threat level; valid range may be 0 to 9."; } } // list device-group list application-group { key "application-group-id"; description "This represents an application group."; leaf application-group-id { type uint16; description "This represents an application group id."; } leaf name { type string; description "This field identifies the name of an application group"; } leaf date { type yang:date-and-time; description "The date when this group was created or last modified."; } leaf group-type { type enumeration { enum "application-tag" { value 0; description "The application group is based on application-tag."; } enum "device-name" { value 1; description "The application group is based on application-name."; } enum "ip-address" { value 2; description "The application group is based on ip-address."; } } description "This identifies the group type; application-tag, application-name or IP-address."; } leaf meta-data-server { type inet:ipv4-address; description "This references meta-data-source object."; } leaf group-member { type string; description "This describes the application-tag, application-name or IP-address information"; } leaf risk-level { type uint16; description "This represents the threat level; valid range may be 0 to 9."; } } // list application-group list location-group { key "location-group-id"; description "This represents a location group."; leaf location-group-id { type uint16; description "This represents a location group id."; } leaf name { type string; description "This field identifies the name of a location group"; } leaf date { type yang:date-and-time; description "The date when this group was created or last modified."; } leaf group-type { type enumeration { enum "location-tag" { value 0; description "The location group is based on location-tag."; } enum "location-name" { value 1; description "The location group is based on location-name."; } enum "ip-address" { value 2; description "The location group is based on ip-address."; } } description "This identifies the group type; location-tag, location-name or IP-address."; } leaf meta-data-server { type inet:ipv4-address; description "This references meta-data-source object."; } leaf group-member { type string; description "This describes the location-tag, location-name or IP-address information"; } leaf risk-level { type uint16; description "This represents the threat level; valid range may be 0 to 9."; } } // list location-group } // container endpoint-group container threat-feed { description "this describes the list of threat-feed."; list threat-feed { key "threat-feed-id"; description "This represents the threat feed within the threat-prevention-list."; leaf threat-feed-id { type uint16; mandatory true; description "This represents the threat-feed-id."; } leaf name { type string; description "Name of the theat feed."; } leaf date { type yang:date-and-time; description "when the threat-feed was created."; } leaf feed-type { type enumeration { enum "unknown" { value 0; description "feed-type is unknown."; } enum "ip-address" { value 1; description "feed-type is IP address."; } enum "url" { value 2; description "feed-type is URL."; } } mandatory true; description "This determined whether the feed-type is IP address based or URL based."; } leaf feed-server { type inet:ipv4-address; description "this contains threat feed server information."; } leaf feed-priority { type uint16; description "this describes the priority of the threat from 0 to 5, where 0 means the threat is minimum and 5 meaning the maximum."; } } // list threat-feed list custom-list { key "custom-list-id"; description "this describes the threat-prevention custom list."; leaf custom-list-id { type uint16; description "this describes the custom-list-id."; } leaf name { type string; description "Name of the custom-list."; } leaf date { type yang:date-and-time; description "when the custom list was created."; } leaf list-type { type enumeration { enum "unknown" { value 0; description "list-type is unknown."; } enum "ip-address" { value 1; description "list-type is IP address."; } enum "mac-address" { value 2; description "list-type is MAC address."; } enum "url" { value 3; description "list-type is URL."; } } mandatory true; description "This determined whether the feed-type is IP address based or URL based."; } leaf list-property { type enumeration { enum "unknown" { value 0; description "list-property is unknown."; } enum "blacklist" { value 1; description "list-property is blacklist."; } enum "whitelist" { value 2; description "list-property is whitelist."; } } mandatory true; description "This determined whether the list-type is blacklist or whitelist."; } leaf list-content { type string; description "This describes the contents of the custom-list."; } } // list custom-list list malware-scan-group { key "malware-scan-group-id"; description "This represents the malware-scan-group."; leaf malware-scan-group-id { type uint16; mandatory true; description "This is the malware-scan-group-id."; } leaf name { type string; description "Name of the malware-scan-group."; } leaf date { type yang:date-and-time; description "when the malware-scan-group was created."; } leaf signature-server { type inet:ipv4-address; description "This describes the signature server of the malware-scan-group."; } leaf file-types { type string; description "This contains a list of file types needed to be scanned for the virus."; } leaf malware-signatures { type string; description "This contains a list of malware signatures or hash."; } } // list malware-scan-group list event-map-group { key "event-map-group-id"; description "This represents the event map group."; leaf event-map-group-id { type uint16; mandatory true; description "This is the event-map-group-id."; } leaf name { type string; description "Name of the event-map."; } leaf date { type yang:date-and-time; description "when the event-map was created."; } leaf security-events { type string; description "This contains a list of security events."; } leaf threat-map { type string; description "This contains a list of threat levels."; } } // list event-map-group } // container threat-feed container telemetry-data { description "Telemetry provides visibility into the network activities which can be tapped for further security analytics, e.g., detecting potential vulnerabilities, malicious activities, etc."; list telemetry-data { key "telemetry-data-id"; description "This is ID for telemetry-data."; leaf telemetry-data-id { type uint16; mandatory true; description "This is ID for telemetry-data-id."; } leaf name { type string; description "Name of the telemetry-data object."; } leaf date { type yang:date-and-time; description "This field states when the telemery-data object was created."; } leaf logs { type boolean; description "This field identifies whether logs need to be collected."; } leaf syslogs { type boolean; description "This field identifies whether System logs need to be collected."; } leaf snmp { type boolean; description "This field identifies whether 'SNMP traps' and 'SNMP alarms' need to be collected."; } leaf sflow { type boolean; description "This field identifies whether 'sFlow' data need to be collected."; } leaf netflow { type boolean; description "This field identifies whether 'NetFlow' data need to be collected."; } leaf interface-stats { type boolean; description "This field identifies whether 'Interface' data such as packet bytes and counts need to be collected."; } } // list telemetry-data list telemetry-source { key "telemetry-source-id"; description "This is ID for telemetry-source."; leaf telemetry-source-id { type uint16; mandatory true; description "This is ID for telemetry-source-id."; } leaf name { type string; description "This identifies the name of this object."; } leaf date { type yang:date-and-time; description "Date this object was created or last modified"; } leaf source-type { type enumeration { enum "network-nsf" { value 0; description "NSF telemetry source type is network-nsf."; } enum "firewall-nsf" { value 1; description "NSF telemetry source type is firewall-nsf."; } enum "ids-nsf" { value 2; description "NSF telemetry source type is ids-nsf."; } enum "ips-nsf" { value 3; description "NSF telemetry source type is ips-nsf."; } enum "proxy-nsf" { value 4; description "NSF telemetry source type is proxy-nsf."; } enum "other-nsf" { value 5; description "NSF telemetry source type is other-nsf."; } } description "This should have one of the following type of the NSF telemetry source: NETWORK-NSF, FIREWALL-NSF, IDS-NSF, IPS-NSF, PROXY-NSF, VPN-NSF, DNS, ACTIVE-DIRECTORY, IP Reputation Authority, Web Reputation Authority, Anti-Malware Sandbox, Honey Pot, DHCP, Other Third Party, ENDPOINT"; } leaf nsf-source { type inet:ipv4-address; description "This field contains information such as IP address and protocol (UDP or TCP) port number of the NSF providing telemetry data."; } leaf nsf-credentials { type string; description "This field contains username and password to authenticate with the NSF."; } leaf collection-interval { type uint16; units "seconds"; default '5000'; description "This field contains time in milliseconds between each data collection. For example, a value of 5000 means data is streamed to collector every 5 seconds. Value of 0 means data streaming is event-based"; } leaf collection-method { type enumeration { enum "unknown" { value 0; description "collection-method is unknown."; } enum "push-based" { value 1; description "collection-method is PUSH-based."; } enum "pull-based" { value 2; description "collection-method is PULL-based."; } } description "This field contains a method of collection, i.e., whether it is PUSH-based or PULL-based."; } leaf heartbeat-interval { type uint16; units "seconds"; description "time in seconds the source sends telemetry heartbeat."; } leaf qos-marking { type uint16; description "DSCP value must be contained in this field."; } } // list telemetry-source list telemetry-destination { key "telemetry-destination-id"; description "This object contains information related to telemetry destination. The destination is usually a collector which is either a part of Security Controller or external system such as Security Information and Event Management (SIEM)."; leaf telemetry-destination-id { type uint16; description "this represents the telemetry-destination-id"; } leaf name { type string; description "This identifies the name of this object."; } leaf date { type yang:date-and-time; description "Date this object was created or last modified"; } leaf collector-source { type inet:ipv4-address; description "This field contains information such as IP address and protocol (UDP or TCP) port number for the collector's destination."; } leaf collector-credentials { type string; description "This field contains the username and password for the collector."; } leaf data-encoding { type string; description "This field contains the telemetry data encoding in the form of schema."; } leaf data-transport { type enumeration { enum "grpc" { value 0; description "telemetry data protocol is grpc."; } enum "buffer-over-udp" { value 1; description "telemetry data protocol is buffer over UDP."; } } description "This field contains streaming telemetry data protocols. This could be gRPC, protocol buffer over UDP, etc."; } } // list telemetry-destination } // container telemetry-data } // module ietf-policy-general
© 2023 YumaWorks, Inc. All rights reserved.