[Docs] [txt|pdf|xml|html] [Tracker] [Email] [Diff1] [Diff2] [Nits]

Versions: 00 01

Security Automation and Continuous Monitoring                   M. Cokus
Internet-Draft                                                 D. Haynes
Intended status: Informational                             D. Rothenberg
Expires: March 11, 2017                            The MITRE Corporation
                                                             J. Gonzalez
                                         Department of Homeland Security
                                                       September 7, 2016


                         OVAL(R) Results Model
                 draft-cokus-sacm-oval-results-model-01

Abstract

   This document specifies Version 5.11.1 of the OVAL Results Model
   which is used to express the results of an evaluation of a set of
   systems based on a set of OVAL Definitions and the target systems'
   OVAL System Characteristics.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on March 11, 2017.

Copyright Notice

   Copyright (c) 2016 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of



Cokus, et al.            Expires March 11, 2017                 [Page 1]


Internet-Draft             OVAL Results Model             September 2016


   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Requirements Language . . . . . . . . . . . . . . . . . .   3
   2.  DirectivesType  . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  DefaultDirectivesType . . . . . . . . . . . . . . . . . . . .   4
   4.  ClassDirectivesType . . . . . . . . . . . . . . . . . . . . .   5
   5.  DirectiveType . . . . . . . . . . . . . . . . . . . . . . . .   5
   6.  ResultsType . . . . . . . . . . . . . . . . . . . . . . . . .   6
   7.  SystemType  . . . . . . . . . . . . . . . . . . . . . . . . .   7
   8.  DefinitionType  . . . . . . . . . . . . . . . . . . . . . . .   7
   9.  CriteriaType  . . . . . . . . . . . . . . . . . . . . . . . .   9
   10. CriterionType . . . . . . . . . . . . . . . . . . . . . . . .  11
   11. ExtendDefinitionType  . . . . . . . . . . . . . . . . . . . .  13
   12. TestType  . . . . . . . . . . . . . . . . . . . . . . . . . .  15
   13. TestedItemType  . . . . . . . . . . . . . . . . . . . . . . .  17
   14. TestedVariableType  . . . . . . . . . . . . . . . . . . . . .  17
   15. ContentEnumeration  . . . . . . . . . . . . . . . . . . . . .  18
   16. ResultEnumeration . . . . . . . . . . . . . . . . . . . . . .  19
   17. OVAL Results Model Schema . . . . . . . . . . . . . . . . . .  20
   18. Intellectual Property Considerations  . . . . . . . . . . . .  59
   19. Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  59
   20. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  59
   21. Security Considerations . . . . . . . . . . . . . . . . . . .  59
   22. Change Log  . . . . . . . . . . . . . . . . . . . . . . . . .  60
     22.1.  -00 to -01 . . . . . . . . . . . . . . . . . . . . . . .  60
   23. References  . . . . . . . . . . . . . . . . . . . . . . . . .  60
     23.1.  Normative References . . . . . . . . . . . . . . . . . .  60
     23.2.  Informative References . . . . . . . . . . . . . . . . .  60
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  60

1.  Introduction

   The Open Vulnerability and Assessment Language (OVAL) [OVAL-WEBSITE]
   is an international, information security community effort to
   standardize how to assess and report upon the machine state of
   systems.  For over ten years, OVAL has been developed in
   collaboration with any and all interested parties to promote open and
   publicly available security content and to standardize the
   representation of this information across the entire spectrum of
   security tools and services.

   OVAL provides an established framework for making assertions about a
   system's state by standardizing the three main steps of the
   assessment process: representing the current machine state; analyzing



Cokus, et al.            Expires March 11, 2017                 [Page 2]


Internet-Draft             OVAL Results Model             September 2016


   the system for the presence of the specified machine state; and
   representing the results of the assessment which facilitates
   collaboration and information sharing among the information security
   community and interoperability among tools.

   This draft is the part of the OVAL contribution to the IETF SACM WG
   that standardizes the representation of the results of an evaluation.
   It is intended to serve as a starting point for the endpoint posture
   assessment data modeling needs of SACM specifically Evaluation
   Results.

1.1.  Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].

2.  DirectivesType

   The DirectivesType defines what result information has been included,
   and to what level of detail, in the OVAL Results, for each possible
   result value defined in the ResultEnumeration.

   +---------------------------+---------------+-------+---------------+
   | Property                  | Type          | Count | Description   |
   +---------------------------+---------------+-------+---------------+
   | definition_true           | DirectiveType | 1     | Defines what  |
   |                           |               |       | result        |
   |                           |               |       | information   |
   |                           |               |       | has been      |
   |                           |               |       | included for  |
   |                           |               |       | OVAL          |
   |                           |               |       | Definitions   |
   |                           |               |       | that evaluate |
   |                           |               |       | to 'true'.    |
   |                           |               |       |               |
   | definition_false          | DirectiveType | 1     | Defines what  |
   |                           |               |       | result        |
   |                           |               |       | information   |
   |                           |               |       | has been      |
   |                           |               |       | included for  |
   |                           |               |       | OVAL          |
   |                           |               |       | Definitions   |
   |                           |               |       | that evaluate |
   |                           |               |       | to 'false'.   |
   |                           |               |       |               |
   | definition_unknown        | DirectiveType | 1     | Defines what  |
   |                           |               |       | result        |



Cokus, et al.            Expires March 11, 2017                 [Page 3]


Internet-Draft             OVAL Results Model             September 2016


   |                           |               |       | information   |
   |                           |               |       | has been      |
   |                           |               |       | included for  |
   |                           |               |       | OVAL          |
   |                           |               |       | Definitions   |
   |                           |               |       | that evaluate |
   |                           |               |       | to 'unknown'. |
   |                           |               |       |               |
   | definition_error          | DirectiveType | 1     | Defines what  |
   |                           |               |       | result        |
   |                           |               |       | information   |
   |                           |               |       | has been      |
   |                           |               |       | included for  |
   |                           |               |       | OVAL          |
   |                           |               |       | Definitions   |
   |                           |               |       | that evaluate |
   |                           |               |       | to 'error'.   |
   |                           |               |       |               |
   | definition_not_evaluated  | DirectiveType | 1     | Defines what  |
   |                           |               |       | result        |
   |                           |               |       | information   |
   |                           |               |       | has been      |
   |                           |               |       | included for  |
   |                           |               |       | OVAL          |
   |                           |               |       | Definitions   |
   |                           |               |       | that evaluate |
   |                           |               |       | to 'not       |
   |                           |               |       | evaluated'.   |
   |                           |               |       |               |
   | definition_not_applicable | DirectiveType | 1     | Defines what  |
   |                           |               |       | result        |
   |                           |               |       | information   |
   |                           |               |       | has been      |
   |                           |               |       | included for  |
   |                           |               |       | OVAL          |
   |                           |               |       | Definitions   |
   |                           |               |       | that evaluate |
   |                           |               |       | to 'not       |
   |                           |               |       | applicable'.  |
   +---------------------------+---------------+-------+---------------+

                     Table 1: DirectivesType Construct

3.  DefaultDirectivesType

   The DefaultDirectivesType defines the result information to include
   in the OVAL Results for all OVAL Definitions regardless of class as
   defined in the ClassEnumeration.



Cokus, et al.            Expires March 11, 2017                 [Page 4]


Internet-Draft             OVAL Results Model             September 2016


   +----------------------------+---------+-------+--------------------+
   | Property                   | Type    | Count | Description        |
   +----------------------------+---------+-------+--------------------+
   | include_source_definitions | boolean | 0..1  | Specifies whether  |
   |                            |         |       | or not the source  |
   |                            |         |       | OVAL Definitions   |
   |                            |         |       | are included in    |
   |                            |         |       | the OVAL Results.  |
   |                            |         |       | When 'true' the    |
   |                            |         |       | source OVAL        |
   |                            |         |       | Definitions MUST   |
   |                            |         |       | be included in the |
   |                            |         |       | OVAL Results. When |
   |                            |         |       | 'false' the source |
   |                            |         |       | OVAL Definitions   |
   |                            |         |       | MUST NOT be        |
   |                            |         |       | included in the    |
   |                            |         |       | OVAL Results.      |
   |                            |         |       | Default Value:     |
   |                            |         |       | 'true'             |
   +----------------------------+---------+-------+--------------------+

                 Table 2: DefaultDirectivesType Construct

4.  ClassDirectivesType

   The ClassDirectivesType defines the result information to include in
   the OVAL Results for a specific class of OVAL Definitions as defined
   in the ClassEnumeration.  Please note that this will override the
   directives in the DefaultDirectivesType for the specified class.

   +----------+-----------------------+-------+------------------------+
   | Property | Type                  | Count | Description            |
   +----------+-----------------------+-------+------------------------+
   | class    | oval:ClassEnumeration | 1     | Specifies the class of |
   |          |                       |       | OVAL Definitions to    |
   |          |                       |       | which the defined OVAL |
   |          |                       |       | Results directives     |
   |          |                       |       | will be applied.       |
   +----------+-----------------------+-------+------------------------+

                  Table 3: ClassDirectivesType Construct

5.  DirectiveType

   The DirectiveType defines what result information, and to what level
   of detail, is included in OVAL Results.




Cokus, et al.            Expires March 11, 2017                 [Page 5]


Internet-Draft             OVAL Results Model             September 2016


   +----------+--------------------+-------+---------------------------+
   | Property | Type               | Count | Description               |
   +----------+--------------------+-------+---------------------------+
   | reported | boolean            | 1     | Specifies whether or not  |
   |          |                    |       | OVAL Definitions, with    |
   |          |                    |       | the specified result,     |
   |          |                    |       | should be included in the |
   |          |                    |       | OVAL Results.  If the     |
   |          |                    |       | reported property is set  |
   |          |                    |       | to 'true', OVAL           |
   |          |                    |       | Definitions that evaluate |
   |          |                    |       | to the specified result   |
   |          |                    |       | MUST be included in the   |
   |          |                    |       | OVAL Results. If the      |
   |          |                    |       | reported property is set  |
   |          |                    |       | to 'false', OVAL          |
   |          |                    |       | Definitions that evaluate |
   |          |                    |       | to the specified result   |
   |          |                    |       | MUST NOT be included in   |
   |          |                    |       | the OVAL Results.         |
   |          |                    |       |                           |
   | content  | ContentEnumeration | 0..1  | Specifies the level of    |
   |          |                    |       | detail that is included   |
   |          |                    |       | in the OVAL Results.      |
   |          |                    |       | Default Value: 'full'     |
   +----------+--------------------+-------+---------------------------+

                     Table 4: DirectiveType Construct

6.  ResultsType

   The ResultsType contains the evaluation results for all OVAL
   Definitions on all systems under test.

   +----------+------------+-------+-----------------------------------+
   | Property | Type       | Count | Description                       |
   +----------+------------+-------+-----------------------------------+
   | results  | SystemType | 1..*  | The evaluation results for all    |
   |          |            |       | OVAL Definitions on each system   |
   |          |            |       | under test.                       |
   +----------+------------+-------+-----------------------------------+

                      Table 5: ResultsType Construct








Cokus, et al.            Expires March 11, 2017                 [Page 6]


Internet-Draft             OVAL Results Model             September 2016


7.  SystemType

   The SystemType provides the evaluation results for the OVAL
   Definitions and OVAL Tests as well the OVAL System Characteristics
   for an individual system.

   +-----------------+----------------------------+------+-------------+
   | Property        | Type                       | Coun | Description |
   |                 |                            | t    |             |
   +-----------------+----------------------------+------+-------------+
   | definitions     | DefinitionType             | 0..* | The         |
   |                 |                            |      | evaluation  |
   |                 |                            |      | results of  |
   |                 |                            |      | the OVAL De |
   |                 |                            |      | finitions.  |
   |                 |                            |      |             |
   | tests           | TestType                   | 0..* | The         |
   |                 |                            |      | evaluation  |
   |                 |                            |      | results of  |
   |                 |                            |      | the OVAL    |
   |                 |                            |      | Tests.      |
   |                 |                            |      |             |
   | system_characte | oval-sc:oval_system_charac | 1    | A copy of   |
   | ristics         | teristics                  |      | the OVAL    |
   |                 |                            |      | System Char |
   |                 |                            |      | acteristics |
   |                 |                            |      | that were   |
   |                 |                            |      | evaluated   |
   |                 |                            |      | against the |
   |                 |                            |      | OVAL        |
   |                 |                            |      | Definitions |
   |                 |                            |      | to produce  |
   |                 |                            |      | the OVAL    |
   |                 |                            |      | Results.    |
   +-----------------+----------------------------+------+-------------+

                       Table 6: SystemType Construct

8.  DefinitionType

   The DefinitionType contains the results of the evaluation of an OVAL
   Definition.

   +-----------------+------------------------+-------+----------------+
   | Property        | Type                   | Count | Description    |
   +-----------------+------------------------+-------+----------------+
   | definition_id   | oval:DefinitionIDPatte | 1     | The unique     |
   |                 | rn                     |       | identifier of  |



Cokus, et al.            Expires March 11, 2017                 [Page 7]


Internet-Draft             OVAL Results Model             September 2016


   |                 |                        |       | an OVAL        |
   |                 |                        |       | Definition     |
   |                 |                        |       | that was used  |
   |                 |                        |       | to generate    |
   |                 |                        |       | the OVAL       |
   |                 |                        |       | Results.       |
   |                 |                        |       |                |
   | version         | unsigned int           | 1     | The version of |
   |                 |                        |       | the globally   |
   |                 |                        |       | unique OVAL    |
   |                 |                        |       | Definition.    |
   |                 |                        |       |                |
   | variable_instan | unsigned int           | 0..1  | The unique     |
   | ce              |                        |       | identifier     |
   |                 |                        |       | that           |
   |                 |                        |       | differentiates |
   |                 |                        |       | between each   |
   |                 |                        |       | unique         |
   |                 |                        |       | instance of an |
   |                 |                        |       | OVAL           |
   |                 |                        |       | Definition. If |
   |                 |                        |       | an OVAL        |
   |                 |                        |       | Definition     |
   |                 |                        |       | utilizes an    |
   |                 |                        |       | OVAL Variable, |
   |                 |                        |       | a unique       |
   |                 |                        |       | instance of    |
   |                 |                        |       | each OVAL      |
   |                 |                        |       | Definition     |
   |                 |                        |       | must be        |
   |                 |                        |       | created for    |
   |                 |                        |       | each           |
   |                 |                        |       | collection of  |
   |                 |                        |       | values         |
   |                 |                        |       | assigned to    |
   |                 |                        |       | the OVAL       |
   |                 |                        |       | Variable.      |
   |                 |                        |       | Default Value: |
   |                 |                        |       | '1'            |
   |                 |                        |       |                |
   | class           | oval:ClassEnumeration  | 0..1  | The class of   |
   |                 |                        |       | the OVAL       |
   |                 |                        |       | Definition.    |
   |                 |                        |       |                |
   | result          | ResultEnumeration      | 1     | The result of  |
   |                 |                        |       | the evaluation |
   |                 |                        |       | of the OVAL    |
   |                 |                        |       | Definition.    |



Cokus, et al.            Expires March 11, 2017                 [Page 8]


Internet-Draft             OVAL Results Model             September 2016


   |                 |                        |       |                |
   | message         | oval:MessageType       | 0..*  | Any messages   |
   |                 |                        |       | that are       |
   |                 |                        |       | relayed from a |
   |                 |                        |       | tool at run-   |
   |                 |                        |       | time during    |
   |                 |                        |       | the evaluation |
   |                 |                        |       | of an OVAL     |
   |                 |                        |       | Definition.    |
   |                 |                        |       |                |
   | criteria        | CriteriaType           | 0..1  | Contains the   |
   |                 |                        |       | individual     |
   |                 |                        |       | results of the |
   |                 |                        |       | logical        |
   |                 |                        |       | statements     |
   |                 |                        |       | that form the  |
   |                 |                        |       | OVAL           |
   |                 |                        |       | Definition.    |
   +-----------------+------------------------+-------+----------------+

                     Table 7: DefinitionType Construct

9.  CriteriaType

   The CriteriaType combines the logical statements that form the OVAL
   Definition.

   +-------------------+-----------------------+-------+---------------+
   | Property          | Type                  | Count | Description   |
   +-------------------+-----------------------+-------+---------------+
   | operator          | oval:OperatorEnumerat | 1     | The logical   |
   |                   | ion                   |       | operator that |
   |                   |                       |       | is used to    |
   |                   |                       |       | combine the   |
   |                   |                       |       | individual    |
   |                   |                       |       | results of    |
   |                   |                       |       | the logical   |
   |                   |                       |       | statements    |
   |                   |                       |       | defined by    |
   |                   |                       |       | the child_cri |
   |                   |                       |       | teria         |
   |                   |                       |       | property.     |
   |                   |                       |       |               |
   | negate            | boolean               | 0..1  | Specifies     |
   |                   |                       |       | whether or    |
   |                   |                       |       | not the       |
   |                   |                       |       | evaluation    |
   |                   |                       |       | result of the |



Cokus, et al.            Expires March 11, 2017                 [Page 9]


Internet-Draft             OVAL Results Model             September 2016


   |                   |                       |       | OVAL          |
   |                   |                       |       | Definition,   |
   |                   |                       |       | referenced by |
   |                   |                       |       | the definitio |
   |                   |                       |       | n_ref         |
   |                   |                       |       | property,     |
   |                   |                       |       | should be     |
   |                   |                       |       | negated.      |
   |                   |                       |       | Default       |
   |                   |                       |       | Value:        |
   |                   |                       |       | 'false'       |
   |                   |                       |       |               |
   | result            | ResultEnumeration     | 1     | The           |
   |                   |                       |       | evaluation    |
   |                   |                       |       | result after  |
   |                   |                       |       | the operator  |
   |                   |                       |       | property and  |
   |                   |                       |       | negate        |
   |                   |                       |       | property have |
   |                   |                       |       | been applied. |
   |                   |                       |       |               |
   | criteria          | CriteriaType          | 1..*  | Logical       |
   |                   |                       |       | statements    |
   |                   |                       |       | that will be  |
   |                   |                       |       | combined      |
   |                   |                       |       | according to  |
   |                   |                       |       | the operator  |
   |                   |                       |       | property.     |
   |                   |                       |       |               |
   | applicability_che | boolean               | 0..1  | A boolean     |
   | ck                |                       |       | flag that     |
   |                   |                       |       | when 'true'   |
   |                   |                       |       | indicates     |
   |                   |                       |       | that the      |
   |                   |                       |       | criteria is   |
   |                   |                       |       | being used to |
   |                   |                       |       | determine     |
   |                   |                       |       | whether the   |
   |                   |                       |       | OVAL          |
   |                   |                       |       | Definition    |
   |                   |                       |       | applies to a  |
   |                   |                       |       | given system. |
   |                   |                       |       | No additional |
   |                   |                       |       | meaning is    |
   |                   |                       |       | assumed when  |
   |                   |                       |       | 'false'.      |
   +-------------------+-----------------------+-------+---------------+




Cokus, et al.            Expires March 11, 2017                [Page 10]


Internet-Draft             OVAL Results Model             September 2016


                      Table 8: CriteriaType Construct

10.  CriterionType

   The CriterionType is a logical statement that references an OVAL Test
   from an OVAL Definition.

   +---------------------+--------------------+-------+----------------+
   | Property            | Type               | Count | Description    |
   +---------------------+--------------------+-------+----------------+
   | test_ref            | oval:TestIDPattern | 1     | The unique     |
   |                     |                    |       | identifier of  |
   |                     |                    |       | an OVAL Test   |
   |                     |                    |       | contained in   |
   |                     |                    |       | the OVAL       |
   |                     |                    |       | Definitions    |
   |                     |                    |       | used to        |
   |                     |                    |       | generate the   |
   |                     |                    |       | OVAL Results.  |
   |                     |                    |       |                |
   | version             | unsigned int       | 1     | The version of |
   |                     |                    |       | the globally   |
   |                     |                    |       | unique OVAL    |
   |                     |                    |       | Test           |
   |                     |                    |       | referenced by  |
   |                     |                    |       | the test_ref   |
   |                     |                    |       | property.      |
   |                     |                    |       |                |
   | variable_instance   | unsigned int       | 0..1  | The unique     |
   |                     |                    |       | identifier     |
   |                     |                    |       | that           |
   |                     |                    |       | differentiates |
   |                     |                    |       | between each   |
   |                     |                    |       | unique         |
   |                     |                    |       | instance of an |
   |                     |                    |       | OVAL Test. If  |
   |                     |                    |       | an OVAL Test   |
   |                     |                    |       | utilizes an    |
   |                     |                    |       | OVAL Variable, |
   |                     |                    |       | a unique       |
   |                     |                    |       | instance of    |
   |                     |                    |       | each OVAL Test |
   |                     |                    |       | must be        |
   |                     |                    |       | created for    |
   |                     |                    |       | each           |
   |                     |                    |       | collection of  |
   |                     |                    |       | values         |
   |                     |                    |       | assigned to    |



Cokus, et al.            Expires March 11, 2017                [Page 11]


Internet-Draft             OVAL Results Model             September 2016


   |                     |                    |       | the OVAL       |
   |                     |                    |       | Variable.      |
   |                     |                    |       | Default Value: |
   |                     |                    |       | '1'            |
   |                     |                    |       |                |
   | negate              | boolean            | 0..1  | Specifies      |
   |                     |                    |       | whether or not |
   |                     |                    |       | the evaluation |
   |                     |                    |       | result of the  |
   |                     |                    |       | OVAL Test,     |
   |                     |                    |       | referenced by  |
   |                     |                    |       | the test_ref   |
   |                     |                    |       | property,      |
   |                     |                    |       | should be      |
   |                     |                    |       | negated.       |
   |                     |                    |       | Default Value: |
   |                     |                    |       | 'false'        |
   |                     |                    |       |                |
   | result              | ResultEnumeration  | 1     | The evaluation |
   |                     |                    |       | result of the  |
   |                     |                    |       | OVAL Test,     |
   |                     |                    |       | referenced by  |
   |                     |                    |       | the test_ref   |
   |                     |                    |       | property,      |
   |                     |                    |       | after the      |
   |                     |                    |       | negate         |
   |                     |                    |       | property has   |
   |                     |                    |       | been applied.  |
   |                     |                    |       |                |
   | applicability_check | boolean            | 0..1  | A boolean flag |
   |                     |                    |       | that when true |
   |                     |                    |       | indicates that |
   |                     |                    |       | the criterion  |
   |                     |                    |       | is being used  |
   |                     |                    |       | to determine   |
   |                     |                    |       | whether the    |
   |                     |                    |       | OVAL           |
   |                     |                    |       | Definition     |
   |                     |                    |       | applies to a   |
   |                     |                    |       | given system.  |
   |                     |                    |       | No additional  |
   |                     |                    |       | meaning is     |
   |                     |                    |       | assumed when   |
   |                     |                    |       | 'false'.       |
   +---------------------+--------------------+-------+----------------+

                     Table 9: CriterionType Construct




Cokus, et al.            Expires March 11, 2017                [Page 12]


Internet-Draft             OVAL Results Model             September 2016


11.  ExtendDefinitionType

   The ExtendDefinitionType is a logical statement that references
   another OVAL Definition.

   +------------------+-----------------------+-------+----------------+
   | Property         | Type                  | Count | Description    |
   +------------------+-----------------------+-------+----------------+
   | definition_ref   | oval:DefinitionIDPatt | 1     | The unique     |
   |                  | ern                   |       | identifier of  |
   |                  |                       |       | an OVAL        |
   |                  |                       |       | Definition     |
   |                  |                       |       | used to        |
   |                  |                       |       | generate the   |
   |                  |                       |       | OVAL Results.  |
   |                  |                       |       |                |
   | version          | unsigned int          | 1     | The version of |
   |                  |                       |       | the globally   |
   |                  |                       |       | unique OVAL    |
   |                  |                       |       | Definition     |
   |                  |                       |       | referenced by  |
   |                  |                       |       | the            |
   |                  |                       |       | definition_ref |
   |                  |                       |       | property.      |
   |                  |                       |       |                |
   | variable_instanc | unsigned int          | 0..1  | The unique     |
   | e                |                       |       | identifier     |
   |                  |                       |       | that           |
   |                  |                       |       | differentiates |
   |                  |                       |       | between each   |
   |                  |                       |       | unique         |
   |                  |                       |       | instance of an |
   |                  |                       |       | OVAL           |
   |                  |                       |       | Definition. If |
   |                  |                       |       | an OVAL        |
   |                  |                       |       | Definition     |
   |                  |                       |       | utilizes an    |
   |                  |                       |       | OVAL Variable, |
   |                  |                       |       | a unique       |
   |                  |                       |       | instance of    |
   |                  |                       |       | each OVAL      |
   |                  |                       |       | Definition     |
   |                  |                       |       | must be        |
   |                  |                       |       | created for    |
   |                  |                       |       | each           |
   |                  |                       |       | collection of  |
   |                  |                       |       | values         |
   |                  |                       |       | assigned to    |



Cokus, et al.            Expires March 11, 2017                [Page 13]


Internet-Draft             OVAL Results Model             September 2016


   |                  |                       |       | the OVAL       |
   |                  |                       |       | Variable.      |
   |                  |                       |       | Default Value: |
   |                  |                       |       | '1'            |
   |                  |                       |       |                |
   | negate           | boolean               | 0..1  | Specifies      |
   |                  |                       |       | whether or not |
   |                  |                       |       | the evaluation |
   |                  |                       |       | result of the  |
   |                  |                       |       | OVAL           |
   |                  |                       |       | Definition,    |
   |                  |                       |       | referenced by  |
   |                  |                       |       | the            |
   |                  |                       |       | definition_ref |
   |                  |                       |       | property,      |
   |                  |                       |       | should be      |
   |                  |                       |       | negated.       |
   |                  |                       |       | Default Value: |
   |                  |                       |       | 'false'        |
   |                  |                       |       |                |
   | result           | ResultEnumeration     | 1     | The evaluation |
   |                  |                       |       | result of the  |
   |                  |                       |       | OVAL           |
   |                  |                       |       | Definition,    |
   |                  |                       |       | referenced by  |
   |                  |                       |       | the            |
   |                  |                       |       | definition_ref |
   |                  |                       |       | property,      |
   |                  |                       |       | after the      |
   |                  |                       |       | negate         |
   |                  |                       |       | property has   |
   |                  |                       |       | been applied.  |
   |                  |                       |       |                |
   | applicability_ch | boolean               | 0..1  | A boolean flag |
   | eck              |                       |       | that when true |
   |                  |                       |       | indicates that |
   |                  |                       |       | the ExtendDefi |
   |                  |                       |       | nition is      |
   |                  |                       |       | being used to  |
   |                  |                       |       | determine      |
   |                  |                       |       | whether the    |
   |                  |                       |       | OVAL           |
   |                  |                       |       | Definition     |
   |                  |                       |       | applies to a   |
   |                  |                       |       | given system.  |
   |                  |                       |       | No additional  |
   |                  |                       |       | meaning is     |
   |                  |                       |       | assumed when   |



Cokus, et al.            Expires March 11, 2017                [Page 14]


Internet-Draft             OVAL Results Model             September 2016


   |                  |                       |       | 'false'.       |
   +------------------+-----------------------+-------+----------------+

                 Table 10: ExtendDefinitionType Construct

12.  TestType

   The TestType contains the result of an OVAL Test.

   +---------------+----------------------+-------+--------------------+
   | Property      | Type                 | Count | Description        |
   +---------------+----------------------+-------+--------------------+
   | test_id       | oval:TestIDPattern   | 1     | The unique         |
   |               |                      |       | identifier of an   |
   |               |                      |       | OVAL Test          |
   |               |                      |       | contained in the   |
   |               |                      |       | OVAL Definitions   |
   |               |                      |       | used to generate   |
   |               |                      |       | the OVAL Results.  |
   |               |                      |       |                    |
   | version       | unsigned int         | 1     | The version of the |
   |               |                      |       | globally unique    |
   |               |                      |       | OVAL Test          |
   |               |                      |       | referenced by the  |
   |               |                      |       | test_id property.  |
   |               |                      |       |                    |
   | variable_inst | unsigned int         | 0..1  | The unique         |
   | ance          |                      |       | identifier that    |
   |               |                      |       | differentiates     |
   |               |                      |       | between each       |
   |               |                      |       | unique instance of |
   |               |                      |       | an OVAL Test. If   |
   |               |                      |       | an OVAL Test       |
   |               |                      |       | utilizes an OVAL   |
   |               |                      |       | Variable, a unique |
   |               |                      |       | instance of each   |
   |               |                      |       | OVAL Test must be  |
   |               |                      |       | created for each   |
   |               |                      |       | collection of      |
   |               |                      |       | values assigned to |
   |               |                      |       | the OVAL Variable. |
   |               |                      |       | Default Value: '1' |
   |               |                      |       |                    |
   | check_existen | oval:ExistenceEnumer | 0..1  | Specifies how many |
   | ce            | ation                |       | OVAL Items must    |
   |               |                      |       | exist, on the      |
   |               |                      |       | system, in order   |
   |               |                      |       | for the OVAL Test  |



Cokus, et al.            Expires March 11, 2017                [Page 15]


Internet-Draft             OVAL Results Model             September 2016


   |               |                      |       | to evaluate to     |
   |               |                      |       | true. Default      |
   |               |                      |       | Value: 'at_least_o |
   |               |                      |       | ne_exists'         |
   |               |                      |       |                    |
   | check         | oval:CheckEnumeratio | 1     | Specifies how many |
   |               | n                    |       | of the collected   |
   |               |                      |       | OVAL Items must    |
   |               |                      |       | satisfy the        |
   |               |                      |       | requirements       |
   |               |                      |       | specified by the   |
   |               |                      |       | OVAL State(s) in   |
   |               |                      |       | order for the OVAL |
   |               |                      |       | Test to evaluate   |
   |               |                      |       | to true.           |
   |               |                      |       |                    |
   | state_operato | oval:OperatorEnumera | 0..1  | Specifies how to   |
   | r             | tion                 |       | logically combine  |
   |               |                      |       | the OVAL States    |
   |               |                      |       | referenced in the  |
   |               |                      |       | OVAL Test.         |
   |               |                      |       | Default Value:     |
   |               |                      |       | 'AND'              |
   |               |                      |       |                    |
   | result        | ResultEnumeration    | 1     | The evaluation     |
   |               |                      |       | result of the OVAL |
   |               |                      |       | Test referenced by |
   |               |                      |       | the test_id        |
   |               |                      |       | property.          |
   |               |                      |       |                    |
   | message       | oval:MessageType     | 0..*  | Any messages that  |
   |               |                      |       | are relayed from a |
   |               |                      |       | tool at run-time   |
   |               |                      |       | during the         |
   |               |                      |       | evaluation of an   |
   |               |                      |       | OVAL Test.         |
   |               |                      |       |                    |
   | tested_item   | TestedItemType       | 0..*  | Specifies a        |
   |               |                      |       | reference to each  |
   |               |                      |       | OVAL Item used in  |
   |               |                      |       | the evaluation of  |
   |               |                      |       | an OVAL Test.      |
   |               |                      |       |                    |
   | tested_variab | TestedVariableType   | 0..*  | Specifies each     |
   | le            |                      |       | OVAL Variable      |
   |               |                      |       | value used in the  |
   |               |                      |       | evaluation of an   |
   |               |                      |       | OVAL Test. This    |



Cokus, et al.            Expires March 11, 2017                [Page 16]


Internet-Draft             OVAL Results Model             September 2016


   |               |                      |       | includes the OVAL  |
   |               |                      |       | Variable values    |
   |               |                      |       | used in both OVAL  |
   |               |                      |       | Objects and OVAL   |
   |               |                      |       | States.            |
   +---------------+----------------------+-------+--------------------+

                       Table 11: TestType Construct

13.  TestedItemType

   The TestedItemType contains the result of evaluating a collected OVAL
   Item against the OVAL State(s), if any, as specified by the
   corresponding OVAL Test.

   +----------+--------------------+-------+---------------------------+
   | Property | Type               | Count | Description               |
   +----------+--------------------+-------+---------------------------+
   | item_id  | oval:ItemIDPattern | 1     | The unique identifier of  |
   |          |                    |       | an OVAL Item collected    |
   |          |                    |       | during OVAL Item          |
   |          |                    |       | Collection.               |
   |          |                    |       |                           |
   | result   | ResultEnumeration  | 1     | The evaluation result of  |
   |          |                    |       | the OVAL Item against the |
   |          |                    |       | OVAL State(s), if any, as |
   |          |                    |       | specified by the          |
   |          |                    |       | corresponding OVAL Test.  |
   |          |                    |       |                           |
   | message  | oval:MessageType   | 0..*  | Any messages that are     |
   |          |                    |       | relayed from a tool at    |
   |          |                    |       | run-time during the       |
   |          |                    |       | evaluation of an OVAL     |
   |          |                    |       | Item against an OVAL      |
   |          |                    |       | State.                    |
   +----------+--------------------+-------+---------------------------+

                    Table 12: TestedItemType Construct

14.  TestedVariableType

   The TestedVariableType specifies the value of an OVAL Variable used
   during the evaluation of an OVAL Test.








Cokus, et al.            Expires March 11, 2017                [Page 17]


Internet-Draft             OVAL Results Model             September 2016


   +-------------+------------------------+-------+--------------------+
   | Property    | Type                   | Count | Description        |
   +-------------+------------------------+-------+--------------------+
   | variable_id | oval:VariableIDPattern | 1     | The unique         |
   |             |                        |       | identifier of an   |
   |             |                        |       | OVAL Variable.     |
   |             |                        |       |                    |
   | value       | Any                    | 1     | A value of the     |
   |             |                        |       | OVAL Variable      |
   |             |                        |       | referenced by the  |
   |             |                        |       | variable_id        |
   |             |                        |       | property.          |
   +-------------+------------------------+-------+--------------------+

                  Table 13: TestedVariableType Construct

15.  ContentEnumeration

   The ContentEnumeration defines the acceptable levels of detail for
   the result information included in the OVAL Results.































Cokus, et al.            Expires March 11, 2017                [Page 18]


Internet-Draft             OVAL Results Model             September 2016


   +-------+-----------------------------------------------------------+
   | Value | Description                                               |
   +-------+-----------------------------------------------------------+
   | thin  | This value indicates that only the minimal amount of      |
   |       | information is represented in the OVAL Results. The       |
   |       | minimal set of information includes the following. The    |
   |       | definition_id property of DefinitionType will be          |
   |       | included. The result property of DefinitionType will be   |
   |       | included. The criteria property of DefinitionType will    |
   |       | not be included. The collected_objects and system_data    |
   |       | properties, of the system_characteristics property in     |
   |       | SystemType, will not be included.                         |
   |       |                                                           |
   | full  | This value indicates that a full detailed result of       |
   |       | information is represented in the OVAL Results. The       |
   |       | minimal set of information includes the following. The    |
   |       | definition_id property of DefinitionType will be          |
   |       | included. The result property of DefinitionType will be   |
   |       | included. The criteria property of DefinitionType will be |
   |       | included. The collected_objects and system_data           |
   |       | properties, of the system_characteristics property in     |
   |       | SystemType, will be included. The value 'full' is         |
   |       | equivalent to 'thin' with the collected_objects and       |
   |       | system_data properties, of the system_characteristics     |
   |       | property in SystemType, included.                         |
   +-------+-----------------------------------------------------------+

                  Table 14: ContentEnumeration Construct

16.  ResultEnumeration

   The ResultEnumeration defines the acceptable evaluation result values
   in the OVAL Language.


















Cokus, et al.            Expires March 11, 2017                [Page 19]


Internet-Draft             OVAL Results Model             September 2016


   +------------+------------------------------------------------------+
   | Value      | Description                                          |
   +------------+------------------------------------------------------+
   | true       | This value indicates that the conditions of the      |
   |            | evaluation were satisfied.                           |
   |            |                                                      |
   | false      | This value indicates that the conditions of the      |
   |            | evaluation were not satisfied.                       |
   |            |                                                      |
   | unknown    | This value indicates that it could not be determined |
   |            | if the conditions of the evaluation were satisfied.  |
   |            |                                                      |
   | error      | This value indicates that an error occurred during   |
   |            | the evaluation.                                      |
   |            |                                                      |
   | not        | This value indicates that a choice was made not to   |
   | evaluated  | perform the evaluation.                              |
   |            |                                                      |
   | not        | This value indicates that the evaluation being       |
   | applicable | performed does not apply to the given platform.      |
   +------------+------------------------------------------------------+

                   Table 15: ResultEnumeration Construct

17.  OVAL Results Model Schema

   The XML Schema that implements this OVAL Results Model can be found
   below.


   <?xml version="1.0" encoding="utf-8"?>
   <xsd:schema
     xmlns:xsd="http://www.w3.org/2001/XMLSchema"
     xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
     xmlns:oval-sc="http://oval.mitre.org/XMLSchema/
     oval-system-characteristics-5"
     xmlns:oval-def="http://oval.mitre.org/XMLSchema/
     oval-definitions-5"
     xmlns:oval-res="http://oval.mitre.org/XMLSchema/
     oval-results-5"
     xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
     xmlns:sch="http://purl.oclc.org/dsdl/schematron"
     targetNamespace="http://oval.mitre.org/XMLSchema/
     oval-results-5"
     elementFormDefault="qualified" version="5.11">
     <xsd:import
       namespace="http://oval.mitre.org/XMLSchema/
       oval-common-5"



Cokus, et al.            Expires March 11, 2017                [Page 20]


Internet-Draft             OVAL Results Model             September 2016


       schemaLocation="oval-common-schema.xsd"/>
     <xsd:import
       namespace="http://oval.mitre.org/XMLSchema/
       oval-definitions-5"
       schemaLocation="oval-definitions-schema.xsd"/>
     <xsd:import
       namespace="http://oval.mitre.org/XMLSchema/
       oval-system-characteristics-5"
       schemaLocation="oval-system-characteristics-schema.xsd"/>
     <xsd:import
       namespace="http://www.w3.org/2000/09/xmldsig#"
       schemaLocation="xmldsig-core-schema.xsd"/>
     <xsd:annotation>
       <xsd:documentation>The following is a
         description of the elements, types, and
         attributes that compose the core schema for
         encoding Open Vulnerability and Assessment
         Language (OVAL) Results. Each of the
         elements, types, and attributes that make up
         the Core Results Schema are described in
         detail and should provide the information
         necessary to understand what each object
         represents. This document is intended for
         developers and assumes some familiarity with
         XML. A high level description of the
         interaction between these objects is not
         outlined here.</xsd:documentation>
       <xsd:appinfo>
         <schema>Core Results</schema>
         <version>5.11.1</version>
         <date>4/22/2015 09:00:00 AM</date>
         <terms_of_use>Copyright (C) 2010 United States Government.
           All Rights Reserved.</terms_of_use>
         <sch:ns prefix="oval-res"
           uri="http://oval.mitre.org/XMLSchema/oval-results-5"
         />
       </xsd:appinfo>
     </xsd:annotation>
   <!-- ====================================================== -->
   <!-- ====================================================== -->
   <!-- ====================================================== -->
     <xsd:element name="oval_results">
       <xsd:annotation>
         <xsd:documentation>The oval_results element
           is the root of an OVAL Results Document.
           Its purpose is to bind together the four
           major sections of a results document -
           generator, directives, oval_definitions,



Cokus, et al.            Expires March 11, 2017                [Page 21]


Internet-Draft             OVAL Results Model             September 2016


           and results - which are the children of
           the root element. It must contain exactly
           one generator section, one directives
           section, and one results
           section.</xsd:documentation>
       </xsd:annotation>
       <xsd:complexType>
         <xsd:sequence>
           <xsd:element name="generator"
             type="oval:GeneratorType">
             <xsd:annotation>
               <xsd:documentation>The required
                 generator section provides
                 information about when the results
                 document was compiled and under what
                 version.</xsd:documentation>
             </xsd:annotation>
           </xsd:element>
           <xsd:element name="directives"
             type="oval-res:DefaultDirectivesType">
             <xsd:annotation>
               <xsd:documentation>The required
                 directives section presents flags
                 describing what information has been
                 included in the results document.
                 This element represents the default
                 set of directives. These directives
                 apply to all classes of definitions
                 for which there is not a class
                 specific set of
                 directives.</xsd:documentation>
               <xsd:appinfo>
                 <sch:pattern
                   id="oval-res_directives_
                   include_oval_definitions">
                   <sch:rule
                     context="oval-res:oval_results/
                     oval-res:directives
                     [@include_source_definitions='true' or
                     @include_source_definitions='1' or
                     not(@include_source_definitions)]">
                     <sch:assert
                       test="ancestor::oval-res:oval_results
                       [oval-def:oval_definitions]"
                       > The source OVAL Definition
                       document must be included when
                       the directives
                       include_source_definitions



Cokus, et al.            Expires March 11, 2017                [Page 22]


Internet-Draft             OVAL Results Model             September 2016


                       attribute is set to true.
                     </sch:assert>
                   </sch:rule>
                   <sch:rule
                     context="oval-res:oval_results/
                     oval-res:directives
                     [@include_source_definitions='false' or
                     @include_source_definitions='0']">
                     <sch:assert
                       test="ancestor::oval-res:oval_results
                       [not(oval-def:oval_definitions)]"
                       > The source OVAL Definition
                       document must not be included
                       when the directives
                       include_source_definitions
                       attribute is set to false.
                     </sch:assert>
                   </sch:rule>
                 </sch:pattern>
               </xsd:appinfo>
             </xsd:annotation>
           </xsd:element>
           <xsd:element name="class_directives"
             type="oval-res:ClassDirectivesType"
             minOccurs="0" maxOccurs="5">
             <xsd:annotation>
               <xsd:documentation>The optional
                 class_directives section presents
                 flags describing what information
                 has been included in the results
                 document for a specific OVAL
                 Definition class. The directives for
                 a particlar class override the
                 default directives. Using OVAL
                 Results class_directives, an OVAL
                 Results document dealing with
                 vulnerabilities might by default
                 include only minimal information and
                 then include full details for all
                 vulnerability definitions that
                 evaluated to
                 true.</xsd:documentation>
             </xsd:annotation>
           </xsd:element>
           <xsd:element
             ref="oval-def:oval_definitions"
             minOccurs="0" maxOccurs="1">
             <xsd:annotation>



Cokus, et al.            Expires March 11, 2017                [Page 23]


Internet-Draft             OVAL Results Model             September 2016


               <xsd:documentation>The
                 oval_definitions section is optional
                 and dependent on the
                 include_source_definitions attribute
                 of the directives element. Its
                 purpose is to provide an exact copy
                 of the definitions evaluated for the
                 results
                 document.</xsd:documentation>
             </xsd:annotation>
           </xsd:element>
           <xsd:element name="results"
             type="oval-res:ResultsType">
             <xsd:annotation>
               <xsd:documentation>The required
                 results section holds all the
                 results of the evaluated
                 definitions.</xsd:documentation>
             </xsd:annotation>
           </xsd:element>
           <xsd:element ref="ds:Signature"
             minOccurs="0" maxOccurs="1">
             <xsd:annotation>
               <xsd:documentation>The optional
                 Signature element allows an XML
                 Signature as defined by the W3C to
                 be attached to the document. This
                 allows authentication and data
                 integrity to be provided to the
                 user. Enveloped signatures are
                 supported. More information about
                 the official W3C Recommendation
                 regarding XML digital signatures can
                 be found at
                 http://www.w3.org/TR/xmldsig-core/.
               </xsd:documentation>
             </xsd:annotation>
           </xsd:element>
         </xsd:sequence>
       </xsd:complexType>
       <xsd:unique name="UniqueDirectiveClass">
         <xsd:annotation>
           <xsd:documentation>The class attribute on
             class_directives must be
             unique.</xsd:documentation>
         </xsd:annotation>
         <xsd:selector
           xpath="oval-res:class_directives"/>



Cokus, et al.            Expires March 11, 2017                [Page 24]


Internet-Draft             OVAL Results Model             September 2016


         <xsd:field xpath="@class"/>
       </xsd:unique>
     </xsd:element>

   <!-- ====================================================== -->
   <!-- ==================  GENERATOR  ======================= -->
   <!-- ====================================================== -->
     <!--
                   The GeneratorType is defined by the
                   oval-common-schema.  Please refer to
                   that documentation for a description
                   of the complex type.
            -->
   <!-- ====================================================== -->
   <!-- ==================  DIRECTIVES  ====================== -->
   <!-- ====================================================== -->
     <xsd:complexType name="DirectivesType">
       <xsd:annotation>
         <xsd:documentation>The DirectivesType
           complex type presents a set of flags that
           describe what information has been
           included in the results document. There
           are six possible results (true, false,
           unknown, error, not evaluated, and not
           applicable) for the evaluation of an OVAL
           Definition. The directives state which of
           these results are being reported in the
           results document.</xsd:documentation>
       </xsd:annotation>
       <xsd:sequence>
         <xsd:element name="definition_true"
           type="oval-res:DirectiveType"/>
         <xsd:element name="definition_false"
           type="oval-res:DirectiveType"/>
         <xsd:element name="definition_unknown"
           type="oval-res:DirectiveType"/>
         <xsd:element name="definition_error"
           type="oval-res:DirectiveType"/>
         <xsd:element name="definition_not_evaluated"
           type="oval-res:DirectiveType"/>
         <xsd:element
           name="definition_not_applicable"
           type="oval-res:DirectiveType"/>
       </xsd:sequence>
     </xsd:complexType>
     <xsd:complexType name="DefaultDirectivesType">
       <xsd:annotation>
         <xsd:documentation>The DefaultDirectivesType



Cokus, et al.            Expires March 11, 2017                [Page 25]


Internet-Draft             OVAL Results Model             September 2016


           complex type presents the default set of
           flags that describe what information has
           been included in the results document. See
           the definition of the
           oval-res:DirectivesType for more
           information.</xsd:documentation>
         <xsd:documentation>The optional
           include_source_definitions attribute
           indicates whether or not the source OVAL
           Definitions document has been included in
           the results document. A value of false
           indicates that the source OVAL Definitions
           has not been included. By default the
           source document is
           included.</xsd:documentation>
       </xsd:annotation>
       <xsd:complexContent>
         <xsd:extension
           base="oval-res:DirectivesType">
           <xsd:attribute
             name="include_source_definitions"
             type="xsd:boolean" default="true"
             use="optional"/>
         </xsd:extension>
       </xsd:complexContent>
     </xsd:complexType>
     <xsd:complexType name="ClassDirectivesType">
       <xsd:annotation>
         <xsd:documentation>The ClassDirectivesType
           complex type presents a set of flags that
           describe what information has been
           included in the results document for a
           specific OVAL Definition class. See the
           definition of the oval-res:DirectivesType
           for more information.</xsd:documentation>
         <xsd:documentation>The required class
           attribute allows a set of directives to be
           specified for each supported OVAL
           Definition class (See the definition of
           the oval:ClassEnumeration for more
           information about the supported classes).
           A set of class specific directives
           overrides the default directives for the
           specified definition class. A given class
           may be specified once.</xsd:documentation>
       </xsd:annotation>
       <xsd:complexContent>
         <xsd:extension



Cokus, et al.            Expires March 11, 2017                [Page 26]


Internet-Draft             OVAL Results Model             September 2016


           base="oval-res:DirectivesType">
           <xsd:attribute name="class"
             type="oval:ClassEnumeration"
             use="required"/>
         </xsd:extension>
       </xsd:complexContent>
     </xsd:complexType>
     <xsd:complexType name="DirectiveType">
       <xsd:annotation>
         <xsd:documentation>An individual directive
           element determines whether or not a
           specific type of result is included in the
           results document. The required reported
           attribute controls this by providing a
           true or false for the specific directive.
           The optional content attribute controls
           how much information about the specific
           result is provided. For example, thin
           content would only be the id of the
           definition and the result, while a full
           content set would be the definition id
           with the result along with results for all
           the individual tests and extended
           definitions. Please refer to the
           oval-res:ContentEnumeration for details
           about the different content
           options.</xsd:documentation>
       </xsd:annotation>
       <xsd:attribute name="reported"
         type="xsd:boolean" use="required"/>
       <xsd:attribute name="content"
         type="oval-res:ContentEnumeration"
         use="optional" default="full"/>
     </xsd:complexType>
   <!-- ====================================================== -->
   <!-- ===============  OVAL DEFINITIONS  =================== -->
   <!-- ====================================================== -->
   <!--
           The oval_definitions element is defined by the oval
           definitions schema.  Please refer to that
           documentation for a description of the valid elements
           and types.
    -->
   <!-- ====================================================== -->
   <!-- ====================  RESULTS  ======================= -->
   <!-- ====================================================== -->
     <xsd:complexType name="ResultsType">
       <xsd:annotation>



Cokus, et al.            Expires March 11, 2017                [Page 27]


Internet-Draft             OVAL Results Model             September 2016


         <xsd:documentation>The ResultsType complex
           type is a container for one or more system
           elements. Each system element defines the
           results associated with an individual
           system. Please refer to the description of
           SystemType for more information about an
           individual system
           element.</xsd:documentation>
       </xsd:annotation>
       <xsd:sequence>
         <xsd:element name="system"
           type="oval-res:SystemType" minOccurs="1"
           maxOccurs="unbounded">
           <xsd:key name="definitionInstanceKey">
             <xsd:annotation>
               <xsd:documentation>Enforce uniqueness
                 in the combination of OVAL id,
                 version, and variable_instance in
                 order to differentiate the
                 individual definition
                 elements.</xsd:documentation>
             </xsd:annotation>
             <xsd:selector
               xpath="oval-res:definitions/oval-res:definition"/>
             <xsd:field xpath="@definition_id"/>
             <xsd:field xpath="@version"/>
             <xsd:field xpath="@variable_instance"/>
           </xsd:key>
           <xsd:key name="testVersionKey">
             <xsd:annotation>
               <xsd:documentation>Enforce uniqueness
                 in the combination of the individual
                 test ids, version, and the
                 variable_instance of the
                 test.</xsd:documentation>
             </xsd:annotation>
             <xsd:selector
               xpath="oval-res:tests/oval-res:test"/>
             <xsd:field xpath="@test_id"/>
             <xsd:field xpath="@version"/>
             <xsd:field xpath="@variable_instance"/>
           </xsd:key>
           <xsd:keyref
             name="definitionInstanceKeyRef"
             refer="oval-res:definitionInstanceKey">
             <xsd:annotation>
               <xsd:documentation>Requires each
                 definition reference (used by



Cokus, et al.            Expires March 11, 2017                [Page 28]


Internet-Draft             OVAL Results Model             September 2016


                 extend_definitions) to refer to a
                 valid definition
                 id.</xsd:documentation>
             </xsd:annotation>
             <xsd:selector xpath=".//*"/>
             <xsd:field xpath="@definition_ref"/>
             <xsd:field xpath="@version"/>
             <xsd:field xpath="@variable_instance"/>
           </xsd:keyref>
           <xsd:keyref name="testVersionKeyRef"
             refer="oval-res:testVersionKey">
             <xsd:annotation>
               <xsd:documentation>Requires each test
                 reference to refer to a valid test
                 id.</xsd:documentation>
             </xsd:annotation>
             <xsd:selector xpath=".//*"/>
             <xsd:field xpath="@test_ref"/>
             <xsd:field xpath="@version"/>
             <xsd:field xpath="@variable_instance"/>
           </xsd:keyref>
         </xsd:element>
       </xsd:sequence>
     </xsd:complexType>
     <xsd:complexType name="SystemType">
       <xsd:annotation>
         <xsd:documentation>The SystemType complex
           type holds the evaluation results of the
           definitions and tests, as well as a copy
           of the OVAL System Characteristics used to
           perform the evaluation. The definitions
           section holds the results of the
           definitions and the tests section holds
           the results of the tests. The
           oval_system_characteristics section is a
           copy of the System Characteristics
           document used to perform the evaluation of
           the OVAL Definitions.</xsd:documentation>
         <xsd:appinfo>
           <sch:pattern id="oval-res_system">
             <sch:rule
               context="oval-res:system[oval-res:tests]">
               <!-- Confirm that something somewhere
                 expects full results -->
               <sch:assert
                 test="/oval-res:oval_results/
                 oval-res:directives/*[@reported='true' or
                 @reported='1']/@content='full'



Cokus, et al.            Expires March 11, 2017                [Page 29]


Internet-Draft             OVAL Results Model             September 2016


                 or /oval-res:oval_results/
                 oval-res:directives/*[(@reported='true' or
                 @reported='1') and not(@content)] or
                 /oval-res:oval_results/
                 oval-res:class_directives/*
                 [@reported='true' or @reported='1']/
                 @content='full' or /oval-res:oval_results/
                 oval-res:class_directives/*
                 [(@reported='true' or @reported='1') and
                 not(@content)]"
                 > The tests element should not be
                 included unless full results are to
                 be provided (see directives)
               </sch:assert>
             </sch:rule>
             <sch:rule
               context="oval-res:system
               [not(oval-res:tests)]">
               <!-- Confirm that nothing anywhere
                 expects full results -->
               <sch:assert
                 test="not(oval-res:oval_results/
                 oval-res:directives/*
                 [@reported='true' or @reported='1']/
                 @content='full') and
                 not(/oval-res:oval_results/
                 oval-res:directives/*
                 [(@reported='true' or @reported='1') and
                 not(@content)]) and
                 not(/oval-res:oval_results/
                 oval-res:class_directives/*
                 [@reported='true' or
                 @reported='1']/@content='full') and
                 not(/oval-res:oval_results/
                 oval-res:class_directives/*
                 [(@reported='true' or
                 @reported='1') and
                 not(@content)])"
                 > The tests element should be
                 included when full results are
                 specified (see directives)
               </sch:assert>
             </sch:rule>
           </sch:pattern>
         </xsd:appinfo>
       </xsd:annotation>
       <xsd:sequence>
         <xsd:element name="definitions"



Cokus, et al.            Expires March 11, 2017                [Page 30]


Internet-Draft             OVAL Results Model             September 2016


           type="oval-res:DefinitionsType"
           minOccurs="0" maxOccurs="1"/>
         <xsd:element name="tests"
           type="oval-res:TestsType" minOccurs="0"
           maxOccurs="1"/>
         <xsd:element
           ref="oval-sc:oval_system_characteristics">
           <xsd:annotation>
             <xsd:appinfo>
               <sch:pattern id="oval-res_mask_rule">
                 <sch:rule
                   context="/oval-res:oval_results/
                   oval-res:results/oval-res:system/
                   oval-sc:oval_system_characteristics/
                   oval-sc:system_data/*/*|
                   /oval-res:oval_results/oval-res:results/
                   oval-res:system/
                   oval-sc:oval_system_characteristics/
                   oval-sc:system_data/*/*/*">
                   <sch:assert
                     test="not(@mask) or
                     @mask='false' or
                     @mask='0' or .=''"
                     >item <sch:value-of
                       select="../@id"/> - a value
                     for the <sch:value-of
                       select="name()"/> entity
                     should only be supplied if the
                     mask attribute is
                     'false'.</sch:assert>
                 </sch:rule>
               </sch:pattern>
             </xsd:appinfo>
           </xsd:annotation>
         </xsd:element>
       </xsd:sequence>
     </xsd:complexType>
     <xsd:complexType name="DefinitionsType">
       <xsd:annotation>
         <xsd:documentation>The DefinitionsType
           complex type is a container for one or
           more definition elements. Each definition
           element holds the result of the evaluation
           of an OVAL Definition. Please refer to the
           description of DefinitionType for more
           information about an individual definition
           element.</xsd:documentation>
       </xsd:annotation>



Cokus, et al.            Expires March 11, 2017                [Page 31]


Internet-Draft             OVAL Results Model             September 2016


       <xsd:sequence>
         <xsd:element name="definition"
           type="oval-res:DefinitionType"
           minOccurs="1" maxOccurs="unbounded"/>
       </xsd:sequence>
     </xsd:complexType>
     <xsd:complexType name="DefinitionType">
       <xsd:annotation>
         <xsd:documentation>The DefinitionType
           complex type holds the result of the
           evaluation of an OVAL Definition. The
           message element holds an error message or
           some other string that the analysis engine
           wishes to pass along. In addition, the
           optional criteria element provides the
           results of the individual pieces of the
           criteria. Please refer to the description
           of the CriteriaType for more
           information.</xsd:documentation>
         <xsd:documentation>The required
           definition_id attribute is the OVAL id of
           the definition.</xsd:documentation>
         <xsd:documentation>The required version
           attribute is the specific version of the
           OVAL Definition used during
           analysis.</xsd:documentation>
         <xsd:documentation>The optional
           variable_instance attribute is a unique id
           that differentiates each unique instance
           of a definition. Capabilities that use
           OVAL may reference the same definition
           multiple times and provide different
           variable values each time the definition
           is referenced. This will result in
           multiple instances of a definition being
           included in the OVAL Results document
           (definitions that do not use variables can
           only have one unique instance). The
           inclusion of this unique instance
           identifier allows the OVAL Results
           document to associate the correct objects
           and items for each combination of supplied
           values.</xsd:documentation>
         <xsd:documentation>The optional class
           attribute ...</xsd:documentation>
         <xsd:documentation>The required result
           attribute holds the result of the
           evaluation. Please refer to the



Cokus, et al.            Expires March 11, 2017                [Page 32]


Internet-Draft             OVAL Results Model             September 2016


           description of the ResultEnumeration for
           details about the different result
           values.</xsd:documentation>
         <xsd:appinfo>
           <sch:pattern id="oval-res_directives">
             <!-- Check definition_true
               reported='true' and content='full' -->
             <sch:rule
               context="oval-res:definition
               [@result='true' and oval-res:criteria]">
               <!-- Check that the global directives say to
                 report this and that there are no class
                 directives for this class (to override
                 the global directive), or that the class
                 directive for this class says to report
                 this. -->
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_true/
                 @reported='true' or
                 /oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_true/
                 @reported='1') and
                 not(oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class])) or
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_true/
                 @reported='true' or
                 /oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_true/
                 @reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of TRUE
                 should not be included (see
                 directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_true/
                 @content='full') and



Cokus, et al.            Expires March 11, 2017                [Page 33]


Internet-Draft             OVAL Results Model             September 2016


                 not(/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class])) or
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_true/
                 @content='full')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of TRUE
                 should contain THIN content (see
                 directives) </sch:assert>
             </sch:rule>

             <!-- Check definition_true
               reported='true' and content='thin' -->
             <sch:rule
               context="oval-res:definition[@result='true'
               and not(oval-res:criteria)]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_true/
                 @reported='true' or
                 /oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_true/
                 @reported='1') and not
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class])) or
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_true/
                 @reported='true' or
                 /oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_true/@reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of TRUE
                 should not be included (see
                 directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/



Cokus, et al.            Expires March 11, 2017                [Page 34]


Internet-Draft             OVAL Results Model             September 2016


                 oval-res:directives/
                 oval-res:definition_true/@content='thin')
                 and not(/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class])) or
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_true/
                 @content='thin')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of TRUE
                 should contain FULL content (see
                 directives) </sch:assert>
             </sch:rule>

             <!-- Check definition_false reported='true'
               and content='full' -->
             <sch:rule
               context="oval-res:definition[@result='false'
               and oval-res:criteria]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_false/
                 @reported='true' or
                 /oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_false/
                 @reported='1') and
                 not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_false/
                 @reported='true' or
                 /oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_false/@reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of FALSE
                 should not be included (see
                 directives) </sch:assert>
               <sch:assert



Cokus, et al.            Expires March 11, 2017                [Page 35]


Internet-Draft             OVAL Results Model             September 2016


                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_false/@content='full')
                 and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_false/@content='full')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of FALSE
                 should contain THIN content (see
                 directives) </sch:assert>
             </sch:rule>

             <!-- Check definition_false reported='true'
               and content='thin' -->
             <sch:rule
               context="oval-res:definition[@result='false' and
               not(oval-res:criteria)]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/oval-res:definition_false/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:directives/oval-res:definition_false/
                 @reported='1') and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_false/@reported='true' or
                 /oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_false/@reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of FALSE
                 should not be included (see
                 directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/oval-res:definition_false/
                 @content='thin') and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_false/@content='thin')">
                 <sch:value-of
                   select="@definition_id"/> -



Cokus, et al.            Expires March 11, 2017                [Page 36]


Internet-Draft             OVAL Results Model             September 2016


                 definitions with a result of FALSE
                 should contain FULL content (see
                 directives) </sch:assert>
             </sch:rule>

             <!-- Check definition_unknown reported='true'
               and content='full' -->
             <sch:rule
               context="oval-res:definition[@result='unknown'
               and oval-res:criteria]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_unknown/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_unknown/@reported='1')
                 and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_unknown/@reported='true'
                 or /oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_unknown/@reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of UNKNOWN
                 should not be included (see
                 directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/oval-res:definition_unknown/
                 @content='full') and not(oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_unknown/@content='full')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of UNKNOWN
                 should contain THIN content (see
                 directives) </sch:assert>
             </sch:rule>

             <!-- Check definition_unknown reported='true'
               and content='thin' -->



Cokus, et al.            Expires March 11, 2017                [Page 37]


Internet-Draft             OVAL Results Model             September 2016


             <sch:rule
               context="oval-res:definition[@result='unknown'
               and not(oval-res:criteria)]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/oval-res:definition_unknown/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_unknown/@reported='1')
                 and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_unknown/@reported='true' or
                 /oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_unknown/@reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of UNKNOWN
                 should not be included (see
                 directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_unknown/@content='thin')
                 and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/oval-res:definition_unknown/
                 @content='thin')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of UNKNOWN
                 should contain FULL content (see
                 directives) </sch:assert>
             </sch:rule>

             <!-- Check definition_error reported='true'
               and content='full' -->
             <sch:rule
               context="oval-res:definition[@result='error'
               and oval-res:criteria]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/oval-res:definition_error/
                 @reported='true' or /oval-res:oval_results/



Cokus, et al.            Expires March 11, 2017                [Page 38]


Internet-Draft             OVAL Results Model             September 2016


                 oval-res:directives/oval-res:definition_error/
                 @reported='1') and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_error/@reported='true' or
                 /oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_error/@reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of ERROR
                 should not be included (see
                 directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/oval-res:definition_error/
                 @content='full') and not(oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_error/@content='full')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of ERROR
                 should contain THIN content (see
                 directives) </sch:assert>
             </sch:rule>

             <!-- Check definition_error reported='true' and
               content='thin' -->
             <sch:rule
               context="oval-res:definition[@result='error'
               and not(oval-res:criteria)]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/oval-res:definition_error/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:directives/oval-res:definition_error/
                 @reported='1') and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_unknown/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_unknown/@reported='1')">
                 <sch:value-of



Cokus, et al.            Expires March 11, 2017                [Page 39]


Internet-Draft             OVAL Results Model             September 2016


                   select="@definition_id"/> -
                 definitions with a result of ERROR
                 should not be included (see
                 directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/oval-res:definition_error/
                 @content='thin') and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_error/@content='thin')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of ERROR
                 should contain FULL content (see
                 directives) </sch:assert>
             </sch:rule>

             <!-- Check definition_not_evaluated
               reported='true' and content='full' -->
             <sch:rule
               context="oval-res:definition[@result='not evaluated'
               and oval-res:criteria]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_evaluated/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_evaluated/@reported='1')
                 and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_not_evaluated/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_not_evaluated/
                 @reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of NOT
                 EVALUATED should not be included
                 (see directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/



Cokus, et al.            Expires March 11, 2017                [Page 40]


Internet-Draft             OVAL Results Model             September 2016


                 oval-res:definition_not_evaluated/
                 @content='full') and not
                 (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class =
                 ./@class]/oval-res:definition_not_evaluated/
                 @content='full')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of NOT
                 EVALUATED should contain THIN
                 content (see directives)
               </sch:assert>
             </sch:rule>

             <!-- Check definition_not_evaluated
               reported='true' and content='thin' -->
             <sch:rule
               context="oval-res:definition
               [@result='not evaluated' and
               not(oval-res:criteria)]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_evaluated/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_evaluated/
                 @reported='1') and not(/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class =
                 ./@class]/oval-res:definition_not_evaluated/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_not_evaluated/
                 @reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of NOT
                 EVALUATED should not be included
                 (see directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_evaluated/
                 @content='thin') and not



Cokus, et al.            Expires March 11, 2017                [Page 41]


Internet-Draft             OVAL Results Model             September 2016


                 (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]/
                 oval-res:definition_not_evaluated/
                 @content='thin')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of NOT
                 EVALUATED should contain FULL
                 content (see directives)
               </sch:assert>
             </sch:rule>

             <!-- Check definition_not_applicable
               reported='true' and content='full' -->
             <sch:rule
               context="oval-res:definition
               [@result='not applicable' and
               oval-res:criteria]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_applicable/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_applicable/
                 @reported='1') and not
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class])) or
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_not_applicable/
                 @reported='true' or
                 /oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_not_applicable/
                 @reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of NOT
                 APPLICABLE should not be included
                 (see directives) </sch:assert>
               <sch:assert
                 test="((/oval-res:oval_results/



Cokus, et al.            Expires March 11, 2017                [Page 42]


Internet-Draft             OVAL Results Model             September 2016


                 oval-res:directives/
                 oval-res:definition_not_applicable/
                 @content='full') and not
                 (oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]))
                 or (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_not_applicable/
                 @content='full')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of NOT
                 APPLICABLE should contain THIN
                 content (see directives)
               </sch:assert>
             </sch:rule>

             <!-- Check definition_not_applicable
               reported='true' and content='thin' -->
             <sch:rule
               context="oval-res:definition
               [@result='not applicable' and
               not(oval-res:criteria)]">
               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_applicable/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_applicable/
                 @reported='1') and not
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class])) or
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_not_applicable/
                 @reported='true' or /oval-res:oval_results/
                 oval-res:class_directives[@class = ./@class]
                 /oval-res:definition_not_applicable/
                 @reported='1')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of NOT
                 APPLICABLE should not be included
                 (see directives) </sch:assert>



Cokus, et al.            Expires March 11, 2017                [Page 43]


Internet-Draft             OVAL Results Model             September 2016


               <sch:assert
                 test="((/oval-res:oval_results/
                 oval-res:directives/
                 oval-res:definition_not_applicable/
                 @content='thin') and not
                 (oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class])) or
                 (/oval-res:oval_results/
                 oval-res:class_directives
                 [@class = ./@class]/
                 oval-res:definition_not_applicable/
                 @content='thin')">
                 <sch:value-of
                   select="@definition_id"/> -
                 definitions with a result of NOT
                 APPLICABLE should contain FULL
                 content (see directives)
               </sch:assert>
             </sch:rule>
           </sch:pattern>
         </xsd:appinfo>
       </xsd:annotation>
       <xsd:sequence>
         <xsd:element name="message"
           type="oval:MessageType" minOccurs="0"
           maxOccurs="unbounded"/>
         <xsd:element name="criteria"
           type="oval-res:CriteriaType" minOccurs="0"
           maxOccurs="1"/>
       </xsd:sequence>
       <xsd:attribute name="definition_id"
         type="oval:DefinitionIDPattern"
         use="required"/>
       <xsd:attribute name="version"
         type="xsd:nonNegativeInteger" use="required"/>
       <xsd:attribute name="variable_instance"
         type="xsd:nonNegativeInteger" use="optional"
         default="1"/>
       <xsd:attribute name="class"
         type="oval:ClassEnumeration" use="optional"/>
       <xsd:attribute name="result"
         type="oval-res:ResultEnumeration"
         use="required"/>
     </xsd:complexType>
     <xsd:complexType name="CriteriaType">
       <xsd:annotation>
         <xsd:documentation>The CriteriaType complex



Cokus, et al.            Expires March 11, 2017                [Page 44]


Internet-Draft             OVAL Results Model             September 2016


           type describes the high level container
           for all the tests and represents the meat
           of the definition. Each criteria can
           contain other criteria elements in a
           recursive structure allowing complex
           logical trees to be constructed. Each
           referenced test is represented by a
           criterion element. Please refer to the
           description of the CriterionType for more
           information about and individual criterion
           element. The optional extend_definition
           element allows existing definitions to be
           included in the criteria. Refer to the
           description of the ExtendDefinitionType
           for more information.</xsd:documentation>
         <xsd:documentation>The required operator
           attribute provides the logical operator
           that binds the different statements inside
           a criteria together. The optional negate
           attribute signifies that the result of an
           extended definition should be negated
           during analysis. For example, consider a
           definition that evaluates TRUE if a
           certain software is installed. By negating
           the definition, it now evaluates to TRUE
           if the software is NOT installed. The
           required result attribute holds the result
           of the evaluation of the criteria. Note
           that this would be after any negation
           operation has been applied. Please refer
           to the description of the
           ResultEnumeration for details about the
           different result
           values.</xsd:documentation>
         <xsd:documentation>The optional
           applicability_check attribute provides a
           Boolean flag that when true indicates that
           the criteria is being used to determine
           whether the OVAL Definition applies to a
           given system.</xsd:documentation>
       </xsd:annotation>
       <xsd:choice minOccurs="1"
         maxOccurs="unbounded">
         <xsd:element name="criteria"
           type="oval-res:CriteriaType"/>
         <xsd:element name="criterion"
           type="oval-res:CriterionType"/>
         <xsd:element name="extend_definition"



Cokus, et al.            Expires March 11, 2017                [Page 45]


Internet-Draft             OVAL Results Model             September 2016


           type="oval-res:ExtendDefinitionType"/>
       </xsd:choice>
       <xsd:attribute name="applicability_check"
         type="xsd:boolean" use="optional"/>
       <xsd:attribute name="operator"
         type="oval:OperatorEnumeration"
         use="required"/>
       <xsd:attribute name="negate"
         type="xsd:boolean" use="optional"
         default="false"/>
       <xsd:attribute name="result"
         type="oval-res:ResultEnumeration"
         use="required"/>
     </xsd:complexType>
     <xsd:complexType name="CriterionType">
       <xsd:annotation>
         <xsd:documentation>The CriterionType complex
           type identifies a specific test that is
           included in the definition's
           criteria.</xsd:documentation>
         <xsd:documentation>The optional
           applicability_check attribute provides a
           Boolean flag that when true indicates that
           the criterion is being used to determine
           whether the OVAL Definition applies to a
           given system.</xsd:documentation>
         <xsd:documentation>The required test_ref
           attribute is the actual id of the included
           test.</xsd:documentation>
         <xsd:documentation>The required version
           attribute is the specific version of the
           OVAL Test used during
           analysis.</xsd:documentation>
         <xsd:documentation>The optional
           variable_instance attribute differentiates
           between unique instances of a test. This
           can happen when a test includes a variable
           reference and different variable values
           are used by different
           definitions.</xsd:documentation>
         <xsd:documentation>The optional negate
           attribute signifies that the result of an
           individual test should be negated during
           analysis. For example, consider a test
           that evaluates to TRUE if a specific patch
           is installed. By negating this test, it
           now evaluates to TRUE if the patch is NOT
           installed.</xsd:documentation>



Cokus, et al.            Expires March 11, 2017                [Page 46]


Internet-Draft             OVAL Results Model             September 2016


         <xsd:documentation>The required result
           attribute holds the result of the
           evaluation. Please refer to the
           description of the ResultEnumeration for
           details about the different result
           values.</xsd:documentation>
       </xsd:annotation>
       <xsd:attribute name="applicability_check"
         type="xsd:boolean" use="optional"/>
       <xsd:attribute name="test_ref"
         type="oval:TestIDPattern" use="required"/>
       <xsd:attribute name="version"
         type="xsd:nonNegativeInteger" use="required"/>
       <xsd:attribute name="variable_instance"
         type="xsd:nonNegativeInteger" use="optional"
         default="1"/>
       <xsd:attribute name="negate"
         type="xsd:boolean" use="optional"
         default="false"/>
       <xsd:attribute name="result"
         type="oval-res:ResultEnumeration"
         use="required"/>
     </xsd:complexType>
     <xsd:complexType name="ExtendDefinitionType">
       <xsd:annotation>
         <xsd:documentation>The ExtendDefinitionType
           complex type identifies a specific
           definition that has been extended by the
           criteria.</xsd:documentation>
         <xsd:documentation>The optional
           applicability_check attribute provides a
           Boolean flag that when true indicates that
           the extend_definition is being used to
           determine whether the OVAL Definition
           applies to a given
           system.</xsd:documentation>
         <xsd:documentation>The required
           definition_ref attribute is the actual id
           of the extended
           definition.</xsd:documentation>
         <xsd:documentation>The required version
           attribute is the specific version of the
           OVAL Definition used during
           analysis.</xsd:documentation>
         <xsd:documentation>The optional
           variable_instance attribute is a unique id
           that differentiates each unique instance
           of a definition. Capabilities that use



Cokus, et al.            Expires March 11, 2017                [Page 47]


Internet-Draft             OVAL Results Model             September 2016


           OVAL may reference the same definition
           multiple times and provide different
           variable values each time the definition
           is referenced. This will result in
           multiple instances of a definition being
           included in the OVAL Results document
           (definitions that do not use variables can
           only have one unique instance). The
           inclusion of this unique instance
           identifier allows the OVAL Results
           document to associate the correct objects
           and items for each combination of supplied
           values.</xsd:documentation>
         <xsd:documentation>The optional negate
           attribute signifies that the result of an
           extended definition should be negated
           during analysis. For example, consider a
           definition that evaluates TRUE if certain
           software is installed. By negating the
           definition, it now evaluates to TRUE if
           the software is NOT
           installed.</xsd:documentation>
         <xsd:documentation>The required result
           attribute holds the result of the
           evaluation. Please refer to the
           description of the ResultEnumeration for
           details about the different result
           values.</xsd:documentation>
       </xsd:annotation>
       <xsd:attribute name="applicability_check"
         type="xsd:boolean" use="optional"/>
       <xsd:attribute name="definition_ref"
         type="oval:DefinitionIDPattern"
         use="required"/>
       <xsd:attribute name="version"
         type="xsd:nonNegativeInteger" use="required"/>
       <xsd:attribute name="variable_instance"
         type="xsd:nonNegativeInteger" use="optional"
         default="1"/>
       <xsd:attribute name="negate"
         type="xsd:boolean" use="optional"
         default="false"/>
       <xsd:attribute name="result"
         type="oval-res:ResultEnumeration"
         use="required"/>
     </xsd:complexType>
     <xsd:complexType name="TestsType">
       <xsd:annotation>



Cokus, et al.            Expires March 11, 2017                [Page 48]


Internet-Draft             OVAL Results Model             September 2016


         <xsd:documentation>The TestsType complex
           type is a container for one or more test
           elements. Each test element holds the
           result of the evaluation of an OVAL Test.
           Please refer to the description of
           TestType for more information about an
           individual test
           element.</xsd:documentation>
       </xsd:annotation>
       <xsd:sequence>
         <xsd:element name="test"
           type="oval-res:TestType" minOccurs="1"
           maxOccurs="unbounded"/>
       </xsd:sequence>
     </xsd:complexType>
     <xsd:complexType name="TestType">
       <xsd:annotation>
         <xsd:documentation>The TestType complex type
           provides a reference to every item that
           matched the object section of the original
           test as well as providing an overall test
           result based on those items. The optional
           message element holds an error message or
           some other string that the analysis engine
           wishes to pass along. The optional
           tested_variable elements hold the value of
           each variable used by the test during
           evaluation. This includes the values used
           in both OVAL Objects and OVAL States. If a
           variable represents a collection of
           values, then multiple tested_variable
           elements would exist with the same
           variable_id attribute. Please refer to the
           description of oval-res:TestedVariableType
           for more information.</xsd:documentation>
         <xsd:documentation>The required test_id
           attribute identifies the test and must
           conform to the format specified by the
           oval:TestIDPattern simple
           type.</xsd:documentation>
         <xsd:documentation>The required version
           attribute is the specific version of the
           OVAL Test used during
           analysis.</xsd:documentation>
         <xsd:documentation>The optional
           variable_instance attribute differentiates
           between unique instances of a test. This
           can happen when a test includes a variable



Cokus, et al.            Expires March 11, 2017                [Page 49]


Internet-Draft             OVAL Results Model             September 2016


           reference and different values for that
           variable are used by different
           definitions.</xsd:documentation>
         <xsd:documentation>The check_existence,
           check, and state_operator attributes
           reflect the values that were specified on
           the test as it was evaluated. These
           evaluation control attributes are copied
           into the OVAL Results file to enable post
           processing of results documents. More
           information on each of these attributes is
           provided with the definition of the
           oval-def:TestType.</xsd:documentation>
         <xsd:documentation>The required result
           attribute holds the result of the
           evaluation after all referenced items have
           been examined and the evaluation control
           attributes have been applied. Please refer
           to the description of the
           oval-res:ResultEnumeration for details
           about the different result values. In
           general, the overall result of an OVAL
           Test is determined by combining the
           results of each matching item based first
           on the check_existence attribute, then the
           check attribute, and finally the
           state_operator
           attribute.</xsd:documentation>
         <xsd:documentation>The following section
           provides a more detailed description of
           how the result for an OVAL Test is
           determined when using an OVAL System
           Characteristics document. An OVAL System
           Characteristics document can contain an
           optional collected_objects section. When
           the collected_objects section is present
           the following rules specify how the
           overall result for an OVAL Test is
           determined: When an
           oval-sc:collected_objects/oval-sc:object
           with an id that matches the OVAL Object id
           that is referenced by the OVAL Test is not
           found, the result for the OVAL Test must
           be "unknown". When the flag attribute of
           the corresponding
           oval-sc:collected_objects/oval-sc:object
           is "error", the result of the OVAL Test
           must be "error". When the flag attribute



Cokus, et al.            Expires March 11, 2017                [Page 50]


Internet-Draft             OVAL Results Model             September 2016


           of the corresponding
           oval-sc:collected_objects/oval-sc:object
           is "not collected", the result of the OVAL
           Test must be "unknown". When the flag
           attribute of the corresponding
           oval-sc:collected_objects/oval-sc:object
           is "not applicable", the result of the
           OVAL Test must be "not applicable". When
           the flag attribute of the corresponding
           oval-sc:collected_objects/oval-sc:object
           is "does not exist", the result of the
           OVAL Test is determined by examining the
           check_existence attribute's value and if
           the check_existence attribute is
           "none_exist" or "any_exist" the OVAL Test
           should evaluate to "true", for all other
           values of the check_existence attribute
           the OVAL Test should evaluate to "false".
           The check and state_operator attributes do
           not need to be considered in this
           condition. When the flag attribute of the
           corresponding
           oval-sc:collected_objects/oval-sc:object
           is "complete", the result of the OVAL Test
           is determined by first evaluating the
           check_existence attribute specified by the
           OVAL Test and then evaluating the check
           and state_operator attributes. The check
           attribute only needs to be considered if
           the result of evaluating the
           check_existence attribute is "true". When
           the flag attribute of the corresponding
           oval-sc:collected_objects/oval-sc:object
           is "incomplete", the result of the OVAL
           Test must be "unknown" with the following
           exceptions: 1) When the check_existence
           attribute of the OVAL Test is set to
           "none_exist" and the collected object has
           1 or more item references with a status of
           "exists", a result of "false" must be
           reported; 2) When the check_existence
           attribute of the OVAL Test is set to
           "only_one_exists", the collected object
           has more than 1 item reference with a
           status of "exists", a result of "false"
           must be reported; 3) If after evaluating
           the check_existence attribute a non "true"
           result has not been determined, the check



Cokus, et al.            Expires March 11, 2017                [Page 51]


Internet-Draft             OVAL Results Model             September 2016


           attribute must be considered as follows:
           3a) If the check attribute evaluation
           results in "false", then the OVAL Test
           result must be "false"; 3b) If the check
           attribute is set to
           "at_least_one_satisfies" and its
           evaluation results in "true", the OVAL
           Test result must be "true". When the
           collected_objects section is not present
           in the OVAL System Characteristics
           document, the evaluation engine must
           search the system characteristics for all
           Items that match the OVAL Object
           referenced by the OVAL Test. The set of
           matching OVAL Items is then evaluated
           first based on the check_existence
           attribute, then the check attribute, and
           finally the state_operator
           attribute.</xsd:documentation>
         <xsd:appinfo>
           <sch:pattern id="oval-res_testids">
             <sch:rule context="oval-res:test">
               <sch:assert
                 test="@test_id = ../../oval-res:definitions//
                 oval-res:criterion/@test_ref"
                   ><sch:value-of select="@test_id"/>
                 - the specified test is not used in
                 any definition's
                 criteria</sch:assert>
             </sch:rule>
           </sch:pattern>
         </xsd:appinfo>
       </xsd:annotation>
       <xsd:sequence>
         <xsd:element name="message"
           type="oval:MessageType" minOccurs="0"
           maxOccurs="unbounded"/>
         <xsd:element name="tested_item"
           type="oval-res:TestedItemType"
           minOccurs="0" maxOccurs="unbounded"/>
         <xsd:element name="tested_variable"
           type="oval-res:TestedVariableType"
           minOccurs="0" maxOccurs="unbounded"/>
       </xsd:sequence>
       <xsd:attribute name="test_id"
         type="oval:TestIDPattern" use="required"/>
       <xsd:attribute name="version"
         type="xsd:nonNegativeInteger" use="required"/>



Cokus, et al.            Expires March 11, 2017                [Page 52]


Internet-Draft             OVAL Results Model             September 2016


       <xsd:attribute name="variable_instance"
         type="xsd:nonNegativeInteger" use="optional"
         default="1"/>
       <xsd:attribute name="check_existence"
         type="oval:ExistenceEnumeration"
         use="optional" default="at_least_one_exists"/>
       <xsd:attribute name="check"
         type="oval:CheckEnumeration" use="required"/>
       <xsd:attribute name="state_operator"
         type="oval:OperatorEnumeration"
         use="optional" default="AND"/>
       <xsd:attribute name="result"
         type="oval-res:ResultEnumeration"
         use="required"/>
     </xsd:complexType>
     <xsd:complexType name="TestedItemType">
       <xsd:annotation>
         <xsd:documentation>The TestedItemType
           complex type holds a reference to a system
           characteristic item that matched the
           object specified in a test. Details of the
           item can be found in the
           oval_system_characteristics section of the
           OVAL Results document by using the
           required item_id. The optional message
           element holds an error message or some
           other message that the analysis engine
           wishes to pass along. The required result
           attribute holds the result of the
           evaluation of the individual item as it
           relates to the state specified by the
           test. If the test did not include a state
           reference then the result attribute will
           be set to 'not evaluated'. Please refer to
           the description of the ResultEnumeration
           for details about the different result
           values.</xsd:documentation>
       </xsd:annotation>
       <xsd:sequence>
         <xsd:element name="message"
           type="oval:MessageType" minOccurs="0"
           maxOccurs="unbounded"/>
       </xsd:sequence>
       <xsd:attribute name="item_id"
         type="oval:ItemIDPattern" use="required"/>
       <xsd:attribute name="result"
         type="oval-res:ResultEnumeration"
         use="required"/>



Cokus, et al.            Expires March 11, 2017                [Page 53]


Internet-Draft             OVAL Results Model             September 2016


     </xsd:complexType>
     <xsd:complexType name="TestedVariableType">
       <xsd:annotation>
         <xsd:documentation>The TestedVariableType
           complex type holds the value of a variable
           used during the evaluation of a test. Of
           special importance are the values of any
           external variables used since these values
           are not captured in either the definition
           or system characteristic documents. If a
           variable is represented by a collection of
           values, then multiple elements of
           TestedVariableType, each with the same
           variable_id attribute, would exist. The
           required variable_id attribute is the
           unique id of the variable that was
           used.</xsd:documentation>
       </xsd:annotation>
       <xsd:simpleContent>
         <xsd:extension base="xsd:anySimpleType">
           <xsd:attribute name="variable_id"
             type="oval:VariableIDPattern"
             use="required"/>
         </xsd:extension>
       </xsd:simpleContent>
     </xsd:complexType>
   <!-- ====================================================== -->
   <!-- ==================  SIGNATURE  ======================= -->
   <!-- ====================================================== -->
     <!--
                   The signature element is defined by the xmldsig
                   schema.  Please refer to that documentation for
                   a description of the valid elements and types.
                   More information about the official W3C
                   Recommendation regarding XML digital signatures
                   can be found at http://www.w3.org/TR/xmldsig-core/.
           -->
   <!-- ====================================================== -->
   <!-- =================  ENUMERATIONS  ===================== -->
   <!-- ====================================================== -->
     <xsd:simpleType name="ContentEnumeration">
       <xsd:annotation>
         <xsd:documentation>The ContentEnumeration
           defines the valid values for the
           directives controlling the amount of
           expected depth found in the results
           document. Each directive specified at the
           top of an OVAL Results document defines



Cokus, et al.            Expires March 11, 2017                [Page 54]


Internet-Draft             OVAL Results Model             September 2016


           how much information should be included in
           the document for each of the different
           result types. The amount of content that
           is expected with each value is defined by
           Schematron statements embedded throughout
           the OVAL Results Schema. Currently, the
           enumeration defines two values: thin and
           full. Please refer to the documentation of
           each individual value of this enumeration
           for more information about what each
           means.</xsd:documentation>
       </xsd:annotation>
       <xsd:restriction base="xsd:string">
         <xsd:enumeration value="thin">
           <xsd:annotation>
             <xsd:documentation>A value of 'thin'
               means only the minimal amount of
               information will be provided. This is
               the id associated with an evaluated
               OVAL Definition and the result of the
               evaluation. The criteria child element
               of a definition should not be present
               when providing thin results. In
               addition, system characteristic
               information for the objects used by
               the given definition should not be
               presented.</xsd:documentation>
           </xsd:annotation>
         </xsd:enumeration>
         <xsd:enumeration value="full">
           <xsd:annotation>
             <xsd:documentation>A value of 'full'
               means that very detailed information
               will be provided allowing in-depth
               reports to be generated from the
               results. In addition to the results of
               the evaluated definition, the results
               of all extended definitions and tests
               included in the criteria as well as
               the actual information collected off
               the system must be
               presented.</xsd:documentation>
           </xsd:annotation>
         </xsd:enumeration>
       </xsd:restriction>
     </xsd:simpleType>
     <xsd:simpleType name="ResultEnumeration">
       <xsd:annotation>



Cokus, et al.            Expires March 11, 2017                [Page 55]


Internet-Draft             OVAL Results Model             September 2016


         <xsd:documentation>The ResultEnumeration
           defines the acceptable result values for
           the DefinitionType, CriteriaType,
           CriterionType, ExtendDefinitionType,
           TestType, and TestedItemType
           constructs.</xsd:documentation>
       </xsd:annotation>
       <xsd:restriction base="xsd:string">
         <xsd:enumeration value="true">
           <xsd:annotation>
             <xsd:documentation>When evaluating a
               definition or test, a result value of
               'true' means that the characteristics
               being evaluated match the information
               represented in the system
               characteristic document. When
               evaluating a tested_item, and a state
               exists, a result value of 'true'
               indicates that the item matches the
               state.</xsd:documentation>
           </xsd:annotation>
         </xsd:enumeration>
         <xsd:enumeration value="false">
           <xsd:annotation>
             <xsd:documentation>When evaluating a
               definition or test, a result value of
               'false' means that the characteristics
               being evaluated do not match the
               information represented in the system
               characteristic document. When
               evaluating a tested_item, and a state
               exists, a result value of 'false'
               indicates that the item does not match
               the state.</xsd:documentation>
           </xsd:annotation>
         </xsd:enumeration>
         <xsd:enumeration value="unknown">
           <xsd:annotation>
             <xsd:documentation>When evaluating a
               definition or test, a result value of
               'unknown' means that the
               characteristics being evaluated cannot
               be found in the system characteristic
               document (or the characteristics can
               be found but collected object flag is
               'not collected'). For example, assume
               that a definition tests a file, but
               data pertaining to that file cannot be



Cokus, et al.            Expires March 11, 2017                [Page 56]


Internet-Draft             OVAL Results Model             September 2016


               found and is not recorded in the
               System Characteristics document. The
               lack of an item (in the system_data
               section) for this file in the System
               Characteristics document means that no
               attempt was made to collect
               information about the file. In this
               situation, there is no way of knowing
               what the result would be if the file
               was collected. Note that finding a
               collected_object element in the system
               characteristic document is not the
               same as finding a matching element of
               the system. When evaluating an OVAL
               Test, the lack of a matching object on
               a system (for example, file not found)
               does not cause a result of unknown
               since an test considers both the state
               of an item and its existence. In this
               case the test result would be based on
               the existence check specified by the
               check_existence attribute on the test.
               When evaluating a tested_item, and a
               state exists, a result value of
               'unknown' indicates that it could not
               be determined whether or not the item
               and state match. For example, if a
               registry_object with a hive equal to
               HKEY_LOCAL_MACHINE, a key with the
               xsi:nil attribute set to 'true', and a
               name with the xsi:nil attribute set to
               'true' was collected and compared
               against a registry_state with key
               entity equal to 'SOFTWARE', the
               tested_item result would be 'unknown'
               because an assertion of whether or not
               the item matches the state could not
               be determined since the key entity of
               the item was not
               collected.</xsd:documentation>
           </xsd:annotation>
         </xsd:enumeration>
         <xsd:enumeration value="error">
           <xsd:annotation>
             <xsd:documentation>When evaluating a
               definition or test, a result value of
               'error' means that the characteristics
               being evaluated exist in the system



Cokus, et al.            Expires March 11, 2017                [Page 57]


Internet-Draft             OVAL Results Model             September 2016


               characteristic document but there was
               an error either collecting information
               or in performing analysis. For
               example, if there was an error
               returned by an api when trying to
               determine if an object exists on a
               system. Another example would be:
               xsi:nil might be set on an object
               entity, but then the entity is
               compared to a state entity with a
               value, thus producing an error. When
               evaluating a tested_item, and a state
               exists, a result value of 'error'
               indicates that there was either an
               error collecting the item or there was
               an error analyzing the item against
               the state. For example, a tested_item
               will receive a result value of 'error'
               if an attempt is made to compare a
               state entity against an item entity
               that has a status of
               'error'.</xsd:documentation>
           </xsd:annotation>
         </xsd:enumeration>
         <xsd:enumeration value="not evaluated">
           <xsd:annotation>
             <xsd:documentation>When evaluating a
               definition or test, a result value of
               'not evaluated' means that a choice
               was made not to evaluate the given
               definition or test. The actual result
               is not known since if evaluation had
               occurred the result could have been
               either true or false. When evaluating
               a tested_item, a result value of 'not
               evaluated' indicates that a state was
               not specified and is equivalent to an
               existence check.</xsd:documentation>
           </xsd:annotation>
         </xsd:enumeration>
         <xsd:enumeration value="not applicable">
           <xsd:annotation>
             <xsd:documentation>When evaluating a
               definition or test, a result value of
               'not applicable' means that the
               definition or test being evaluated is
               not valid on the given platform. For
               example, trying to collect Linux RPM



Cokus, et al.            Expires March 11, 2017                [Page 58]


Internet-Draft             OVAL Results Model             September 2016


               information on a Windows system is not
               possible and so a result of not
               applicable is used. Another example
               would be in trying to collect RPM
               information on a linux system that
               does not have the RPM packaging system
               installed.</xsd:documentation>
           </xsd:annotation>
         </xsd:enumeration>
       </xsd:restriction>
     </xsd:simpleType>
   </xsd:schema>


18.  Intellectual Property Considerations

   Copyright (C) 2010 United States Government.  All Rights Reserved.

   DHS, on behalf of the United States, owns the registered OVAL
   trademarks, identifying the OVAL STANDARDS SUITE and any component
   part, as that suite has been provided to the IETF Trust.  A "(R)"
   will be used in conjunction with the first use of any OVAL trademark
   in any document or publication in recognition of DHS's trademark
   ownership.

19.  Acknowledgements

   The authors wish to thank DHS for sponsoring the OVAL effort over the
   years which has made this work possible.  The authors also wish to
   thank the original authors of this document Jonathan Baker, Matthew
   Hansbury, and Daniel Haynes of the MITRE Corporation as well as the
   OVAL Community for its assistance in contributing and reviewing the
   original document.  The authors would also like to acknowledge Dave
   Waltermire of NIST for his contribution to the development of the
   original document.

20.  IANA Considerations

   This memo includes no request to IANA.

21.  Security Considerations

   While OVAL is just a set of data models and does not directly
   introduce security concerns, it does provide a mechanism by which to
   represent endpoint posture assessment information.  This information
   could be extremely valuable to an attacker allowing them to learn
   about very sensitive information including, but, not limited to:
   security policies, systems on the network, criticality of systems,



Cokus, et al.            Expires March 11, 2017                [Page 59]


Internet-Draft             OVAL Results Model             September 2016


   software and hardware inventory, patch levels, user accounts and much
   more.  To address this concern, all endpoint posture assessment
   information should be protected while in transit and at rest.
   Furthermore, it should only be shared with parties that are
   authorized to receive it.

   Another possible security concern is due to the fact that content
   expressed as OVAL has the ability to impact how a security tool
   operates.  For example, content may instruct a tool to collect
   certain information off a system or may be used to drive follow-up
   actions like remediation.  As a result, it is important for security
   tools to ensure that they are obtaining OVAL content from a trusted
   source, that it has not been modified in transit, and that proper
   validation is performed in order to ensure it does not contain
   malicious data.

22.  Change Log

22.1.  -00 to -01

   There are no textual changes associated with this revision.  This
   revision simply reflects a resubmission of the document so that it
   remains in active status.

23.  References

23.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <http://www.rfc-editor.org/info/rfc2119>.

23.2.  Informative References

   [OVAL-WEBSITE]
              The MITRE Corporation, "The Open Vulnerability and
              Assessment Language", 2015,
              <http://ovalproject.github.io/>.

Authors' Addresses










Cokus, et al.            Expires March 11, 2017                [Page 60]


Internet-Draft             OVAL Results Model             September 2016


   Michael Cokus
   The MITRE Corporation
   903 Enterprise Parkway, Suite 200
   Hampton, VA  23666
   USA

   Email: msc@mitre.org


   Daniel Haynes
   The MITRE Corporation
   202 Burlington Road
   Bedford, MA  01730
   USA

   Email: dhaynes@mitre.org


   David Rothenberg
   The MITRE Corporation
   202 Burlington Road
   Bedford, MA  01730
   USA

   Email: drothenberg@mitre.org


   Juan Gonzalez
   Department of Homeland Security
   245 Murray Lane
   Washington, DC  20548
   USA

   Email: juan.gonzalez@dhs.gov

















Cokus, et al.            Expires March 11, 2017                [Page 61]


Html markup produced by rfcmarkup 1.129b, available from https://tools.ietf.org/tools/rfcmarkup/