Re: How to define Log, Event, and Alert?

Hello all,

There are a threads on this very topic on a couple different lists at the moment; recent discussion is even covering the exact same ground.

Rather than re-invent the wheel, I would suggest that any and all interested parties join the CEE + XDAS standards effort as soon as possible.

In fact there are three ongoing things to get involved in:

- The CEE plans to expand its scope of activities under a Mitre-facilitated self-governing editorial board. The plan for now is that collaboration with XDAS participants and other contributors will take place under this framework. 
CALL TO ACTION: Sign up to join the CEE discussion list (http://cee.mitre.org/discussiongroup.html) to keep abreast of standardization and collaboration activities as they evolve under this framework.

- The collaboration environment, including a wiki, set up during the preparation for the CES, is being opened for access to all SIG attendees or interested parties. The same collaboration environment may be used to support CEE. Initially, this offer is for read only access but those that are interested in contributing can arrange an individual account. CALL TO ACTION: check out the wiki (which has documents on event standard terminology and use cases) at http://12.193.84.139:8080/ through the shared account (username: "visitor" and password "standards"), follow the links to "team sharing" and "standards" and you'll see the link to "wiki" and other links on the left.

- Going to Blackhat / Defcon? A face to face CEE Meet Up is planned. Current plans are to meet on Friday, 8 August 2008 at 12 noon outside the DefCon registration area at the Riviera Hotel & Casino. The group will organize there and then find a place to talk.


I will compile the responses on both the CEE and loganalysis lists into a discussion thread on the wiki, so folks can go back and review prior comments.  One problem with e-mail is that you don't see old messages if you join late ;-)

If folks want to get their own personal accounts on the collaboration site please let me know and I will add you.





----------------
David Corlette
GRC Solution Architect
[email protected]
703.663.5517

Novell, Inc.
Secure Your Enterprise with Sentinel from Novell
http://www.novell.com/products/sentinel/













>>> On Wed, Jul 23, 2008 at  4:21 PM, in message
<[email protected]>, "Anton Chuvakin"
<[email protected]> wrote: 
>>  I'm good with the definitions, except for the concept of an "event":
> 
> Same thing. Event is not necessarily "a state change."  It is a
> broader thing, basically,   "something that happened" (even though a
> state is the same - e.g. backup is proceeding, attack was seen, etc)
> 
> 
>>
>>> Event:
>>>        A discrete, distinct, and discernible state change in an
>>> environment.
>>
>> In some aspects, state changes such as processes dieing or starting
>> are surely events, but I also think that some logs which don't indicate
>> a state change such as login failures, port scanning, intrusion
>> detection logs, and so on are noteworthy and worth alerting on.
>>
>> Ron
>>
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> LogAnalysis mailing list
>> [email protected]
>> http://www.loganalysis.org/mailman/listinfo/loganalysis
>>
> 
>