Re: How to define Log, Event, and Alert?

Hi Bill,

You might want to check out some of the glossaries that have some 
definitions of the words you're looking at.

ATIS/ANSI  http://www.atis.org/tg2k/
IETF  http://www.ietf.org/rfc/rfc4949.txt
ITU  http://www.itu.int/itudoc/itu-t/com17/activity/def004.html
   and http://www.itu.int/itudoc/itu-t/com17/activity/add002.html

Regards,
Chris

On Wed, 23 Jul 2008, Bill Heinbockel wrote:

>> In support of the CEE effort to develop a log standard, we
>> are trying to accurately define the concepts of "log",
>> "event", and "alert". When we speak of these conceptually,
>> a majority of us have common understanding of what we mean.
>> However, this is not the case when presenting these terms
>> to management and other people outside of the log space.
>>
>>
>> Here is our initial shot at defining these terms:
>>
>>
>> Event:
>> 	A discrete, distinct, and discernible state change in an
>> environment.
>>
>> Alert (n):
>> 	A warning or notification generated in response to an event.
>>
>> Alert (v):
>> 	The act of generating, transport, or displaying a warning or
>> notification in response to an event.
>>
>> Log Entry:
>> 	The record of an event in a log. Event log, event record, log
>> message, log record, and audit record are all synonyms that have been
>> used to refer to log entries.
>>
>> Log (n):
>> 	The record comprising one or more log entries accumulated over
>> a given period. This may be electronic (e.g. stored in memory, disk,
>> software, database, text file, etc), physical (e.g. on paper), or even
>> verbal (e.g., "Between 10:00 and 10:01 we received a series of several
>> thousand SYN packets that we acknowledged, but full TCP connections
>> were not completed. At 10:02, our server resources exceeded the
>> maximum tolerable level and crashed.").
>>
>> Log (v):
>> 	The act of recording or storing one or more events.
>>
>>
>>
>> What do you think?
>> Can these definitions be changed/improved in anyway?
>> Is there any examples, synonyms, or clarifications that should be
>> added?
>>
>>
>> Thanks,
>>
>> William Heinbockel
>> Infosec Engineer, Sr.
>> The MITRE Corporation
>> 202 Burlington Rd. MS S145
>> Bedford, MA 01730
>> [email protected]
>> 781-271-2615
>>
>>