# WG Meeting: 2022-11-01
## Agenda
- Introductions / Re-introductions
- Pull Requests
- Stream ID Discussion
- Update on MITRE Round Table
- IETF Subject Identifiers in Last Call for Review
- Activity Events

## Attendees
- Atul Tulshibagwale (SGNL)
- James Fisher (Easy Dynamics)
- Frank Taylor (VMWare)
- Srinivas Challa (Workday)
- Edmund Jay ()
- Nancy Cam Winget (Cisco)

## Notes
### < Agenda item 1 >
-

## Action Items
- [Streams Pull Request](https://github.com/openid/sse/pull/9) (Shayne)
- Merged the namespace pull request (Atul)

### Multiple Streams
- It's not only about event types
- There needs to be a 1:1 mapping between Tx and Rx
- You may want to route streams differently based on country of origin of subjects
- Staging versus production streams may be different
- If you are updating versions, you may want to have some streams relaying events from the new version

### IETF SecEvents Subject Identifiers
- [Subject Idetifiers](https://datatracker.ietf.org/doc/draft-ietf-secevent-subject-identifiers/)

### WG Name Chagne
- No comments received that we know of
- If Tim confirms, we can change the name of the working group to "Shared Signals Framework" (SSF)

### Activity Events
- Workday would like to see events about user activity in the session
- The use-case is continuous authentication, to see if the user is performing any anomalous activity
- The IETF working group is considering use SCIM operations with SSE
- Current proposal in IETF - [SCIM Events](https://datatracker.ietf.org/doc/draft-ietf-scim-events/)
- Would "assurance level change work?" Probably not because the application may not know what the assurance level is
- User may be coming from a strange IP address range
- There may be a separate service that tracks user activity and provides events based on activity
- "user ran x report" could be an event
- "user accessed PII data" could be a more generally understood event, which can be sent.
- Atul and Srinivas to sync up offline about this