How to define Log, Event, and Alert?

This is a multipart message in MIME format.

--===============1186831929==
Content-class: urn:content-classes:message
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
	micalg=SHA1; boundary="----=_NextPart_000_0017_01C8ECB7.05461B30"

This is a multipart message in MIME format.

------=_NextPart_000_0017_01C8ECB7.05461B30
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

In support of the CEE effort to develop a log standard, we
are trying to accurately define the concepts of "log",
"event", and "alert". When we speak of these conceptually,
a majority of us have common understanding of what we mean.
However, this is not the case when presenting these terms
to management and other people outside of the log space.


Here is our initial shot at defining these terms:


Event:
	A discrete, distinct, and discernible state change in an
environment.

Alert (n):
	A warning or notification generated in response to an event.

Alert (v):
	The act of generating, transport, or displaying a warning or
notification in response to an event.

Log Entry:
	The record of an event in a log. Event log, event record, log
message, log record, and audit record are all synonyms that have been
used to refer to log entries. 

Log (n): 
	The record comprising one or more log entries accumulated over
a given period. This may be electronic (e.g. stored in memory, disk,
software, database, text file, etc), physical (e.g. on paper), or even
verbal (e.g., "Between 10:00 and 10:01 we received a series of several
thousand SYN packets that we acknowledged, but full TCP connections
were not completed. At 10:02, our server resources exceeded the
maximum tolerable level and crashed.").

Log (v):
	The act of recording or storing one or more events.



What do you think?
Can these definitions be changed/improved in anyway?
Is there any examples, synonyms, or clarifications that should be
added?


Thanks,

William Heinbockel
Infosec Engineer, Sr.
The MITRE Corporation
202 Burlington Rd. MS S145
Bedford, MA 01730
[email protected]
781-271-2615


------=_NextPart_000_0017_01C8ECB7.05461B30
Content-Type: application/x-pkcs7-signature;
	name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIKxTCCA2Qw
ggJMoAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwWjESMBAGA1UEChMJbWl0cmUub3JnMR4wHAYDVQQL
ExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxJDAiBgNVBAMTG01JVFJFIENvcnBvcmF0aW9uIFJvb3Qg
Q0EtMTAeFw0wNjA2MDEwNDAwMDBaFw0xODA2MDEwNDAwMDBaMFoxEjAQBgNVBAoTCW1pdHJlLm9y
ZzEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSQwIgYDVQQDExtNSVRSRSBDb3Jwb3Jh
dGlvbiBSb290IENBLTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCva1qWPZiEJv5v
MtCbjt0cTu0Nbn15Q1cKqQBXKi8VSH9zZPmPxfWizJJ7JSqFJ5/sLUz3NsnUVjpLYBdFcxNXnOLj
XtmDPFOewm5T98NZc9wRRCiDzt4f8qsHFI19ShPiK3cN5UqtJf+i66QVLA1S6CNL6o2eGAsAl5Wn
xwOh2BfcWU5fNlHDVc9KKAlDDWpHjC2LLHAUbLP4ZzMIJKcLgLKFMtgM2AEfaSHzmi7WUdUHRCtC
blrF7qzPsy/jBLFrr8VcX+mb7saq95pEOilgcix0/naW7kJfM5ph7UBB+S1O/OhH+ZjQ4MjWnwE8
A/YDrQx1OVLAOi29Bsho/l8lAgMBAAGjNTAzMBIGA1UdEwEB/wQIMAYBAf8CAQMwHQYDVR0OBBYE
FMdwUQDYTf7kAdRolsU9n5qX/nQvMA0GCSqGSIb3DQEBBQUAA4IBAQAa+fVfCljimBlcfWwkfJXu
XNKWun9xloFKjnq6SPGgAIKi5LUDil60a0NaNGoGSO3I1xzYt7ncayh21qXulcVTDFqubSJdv51a
HTuJYcYUX72LN/gSq03UVLBCJzYm7ZLUlkb2YLo7xUeZ3coLFcT5AHR36kjG4cYHqXgH0liBl8jx
pN0gwgaci4sgPLUj1w4t8zoKH+zxGFwXwTP/P+etQqiJZ5T00fLLm5kz9mmnxxmmIvUGNdsCAhGh
dnF24pcrR43LNgyOBJ9DPUHBNq3kUQRO48WBKxBxflOtKzsICx/HEtIABcZn7deADHcY9spULZfB
nQYdEpyz5tgh7Y2qMIIDcTCCAlmgAwIBAgICFaEwDQYJKoZIhvcNAQEFBQAwXTESMBAGA1UEChMJ
bWl0cmUub3JnMR4wHAYDVQQLExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxJzAlBgNVBAMTHk1JVFJF
IENvcnBvcmF0aW9uIFByaW1hcnkgQ0EtMTAeFw0wODAxMDkxNzAwNDVaFw0wOTA3MDIxNzAwNDVa
MGExEjAQBgNVBAoTCW1pdHJlLm9yZzEPMA0GA1UECxMGcGVvcGxlMRowGAYKCZImiZPyLGQBARMK
aGVpbmJvY2tlbDEeMBwGA1UEAxMVSGVpbmJvY2tlbCBXaWxsaWFtIEouMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQCu9l+xf2SnNo8tm9vtI1DWCSahPu8H5rrSozpTQuMSUZYADtn8RtPcFY1F
SgNeLy89i4WAy3KlUbXeLA/JY7/mwTl8LkAIa8gyxxJUX89vfuHxEIAKFd1IK47LlIxyNNNcmkXe
N8a3n8akdlojkn0NzLNsvvWeOLFlV4ZLlwbViwIDAQABo4G6MIG3MA4GA1UdDwEB/wQEAwIF4DAd
BgNVHQ4EFgQUjDTpoP6zKMixsGOTl18N2i8qF0wwHwYDVR0jBBgwFoAUh7QPSI1iM0LBLVEaSB7C
nrsKsa0wRAYDVR0fBD0wOzA5oDegNYYzaHR0cDovL3d3dy5taXRyZS5vcmcvdGVjaC9taWkvcGtp
L2NhMV9taXRyZV9vcmcuY3JsMB8GA1UdEQQYMBaBFGhlaW5ib2NrZWxAbWl0cmUub3JnMA0GCSqG
SIb3DQEBBQUAA4IBAQAPb3zp4vSprG2RwQPPlD4WX5jaCi+Kq7s5aTF2m0UvsmeQAyjB4QFqlyVJ
Ljekf7MSWgmmk/QAmhOmLCA81lFE92ctKnlj7qA9MpE6gy3wYwA/R+DKx33+NmH9CJD51VKV831+
b1L9mM4EOOSx/iJRnWvzOYvT0IES8kABg7O5qAHcHGAA63Mwgj5SfUh3PSiRA0ONxacUHyRYEoUv
wZ2BLqMTMdUbYsx45TrEoN27XCaaR6WXvVI/zYBfPHyGCOWkR3LIV+DSsAPUboWzSnOVao3FUwmi
xODU1UGo1l8rHrbuk5LasvIN0FLZh+1fbXOxZak/3e23x2vUzD98BbQDMIID5DCCAsygAwIBAgIB
BTANBgkqhkiG9w0BAQUFADBaMRIwEAYDVQQKEwltaXRyZS5vcmcxHjAcBgNVBAsTFUNlcnRpZmlj
YXRlIEF1dGhvcml0eTEkMCIGA1UEAxMbTUlUUkUgQ29ycG9yYXRpb24gUm9vdCBDQS0xMB4XDTA2
MDYwMzE3MTMyMloXDTEyMDYwMzE3MTMyMlowXTESMBAGA1UEChMJbWl0cmUub3JnMR4wHAYDVQQL
ExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxJzAlBgNVBAMTHk1JVFJFIENvcnBvcmF0aW9uIFByaW1h
cnkgQ0EtMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMjwe1ZdEIKoELdLvENnbkbO
3mVD54ZX5SjxTzFxhvoqhqSJmLOp32xT7J9KvBapJRbJv1BFdiSUN3O0q8H66nvQqwm1RYe+tTsW
SO351FolGrDT9iDRtfWgH60PCKCbABLRsx3iGnEvjOQjeAtMn1AugqQWU3PWZXYy1Grbya+NOytY
vu1p60bDFSoSAn4Jojv14lUfWHl8s3kahay8umLSQibiXdEEX8CrSkaXpOaFOuyM6+wpRw7TybO1
Dk4zGAUtn0887QvsMDk6evgN2WxMprkHAGUcJhpI1QXtkfDIl9ukdNiIoM/vdN2QC/+m6b8dA55K
5UdlBa9SgRnwapkCAwEAAaOBsTCBrjASBgNVHRMBAf8ECDAGAQH/AgECMA4GA1UdDwEB/wQEAwIB
hjAdBgNVHQ4EFgQUh7QPSI1iM0LBLVEaSB7CnrsKsa0wHwYDVR0jBBgwFoAUx3BRANhN/uQB1GiW
xT2fmpf+dC8wSAYDVR0fBEEwPzA9oDugOYY3aHR0cDovL3d3dy5taXRyZS5vcmcvdGVjaC9taWkv
cGtpL3Jvb3RjYTFfbWl0cmVfb3JnLmNybDANBgkqhkiG9w0BAQUFAAOCAQEATW5u664p7N0iAj27
Xl/akjdfkSQpaosf6cNyAHu7utCytFfY1WfRNmvnNDGYkqI3XMFOa18SNjiNsMCH+sFQaO+oyDnP
iIkEZQvlfGGrRpqIm6j//Fgz85bnf1kAM5I61Np7ofCnciRvp9ZB/+u+9i262tgiJPJrvBcqXmge
T9riCc3RPjxqPNmYslOvNLpIifchelJhF7nIge+7RkAUcTJenj8yKwK0J3+PEpgYRQ+V2C62rnjo
huxPgMw/fYoNTOlh3MVl7adwyK1ahPw2a9eOjSWglqoPTaBNeHJqRJZZ6Vi7S55+VAWCfkAqM5m3
tUiVzjsp2dFcTJxnYezaoDGCAr0wggK5AgEBMGMwXTESMBAGA1UEChMJbWl0cmUub3JnMR4wHAYD
VQQLExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxJzAlBgNVBAMTHk1JVFJFIENvcnBvcmF0aW9uIFBy
aW1hcnkgQ0EtMQICFaEwCQYFKw4DAhoFAKCCAbAwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAc
BgkqhkiG9w0BCQUxDxcNMDgwNzIzMTUyNjU5WjAjBgkqhkiG9w0BCQQxFgQUjvmpmXQikZFRkhW4
qw8usnckNrIwZwYJKoZIhvcNAQkPMVowWDAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYI
KoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwBwYFKw4DAhowCgYIKoZIhvcNAgUw
cgYJKwYBBAGCNxAEMWUwYzBdMRIwEAYDVQQKEwltaXRyZS5vcmcxHjAcBgNVBAsTFUNlcnRpZmlj
YXRlIEF1dGhvcml0eTEnMCUGA1UEAxMeTUlUUkUgQ29ycG9yYXRpb24gUHJpbWFyeSBDQS0xAgIV
oTB0BgsqhkiG9w0BCRACCzFloGMwXTESMBAGA1UEChMJbWl0cmUub3JnMR4wHAYDVQQLExVDZXJ0
aWZpY2F0ZSBBdXRob3JpdHkxJzAlBgNVBAMTHk1JVFJFIENvcnBvcmF0aW9uIFByaW1hcnkgQ0Et
MQICFaEwDQYJKoZIhvcNAQEBBQAEgYBbuYTB3D3RG9h6WUeQIBuinA/Y+9qh6v+axiI2L4ypL1d/
Kb6dlgOSxDwosky9RxH+qPrnljkr2pkiewnBdZtPF2Q/7pojGO0wHDzxaJvr6gXdHlRyJ+UdM7vH
ODf/svewfQyYaOuuWaMr/d7fFtiS7FWxb4Vny2L+hCeClrLeQQAAAAAAAA==

------=_NextPart_000_0017_01C8ECB7.05461B30--

--===============1186831929==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
LogAnalysis mailing list
[email protected]
http://www.loganalysis.org/mailman/listinfo/loganalysis
--===============1186831929==--