Re: [IDMEF][Issue 9] Alert routing

>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> From Krzysztof Zaraska on Situation 1:  I'd like to know a rationale
  Herve> for this. In Prelude it's a typical situation that C sees alerts
  Herve> generated by A. And it's therefore very useful to know where the alert
  Herve> actually originated. We were also proposing is a "path record" inside
  Herve> the alert, specifying the managers the alert has travelled through.

  Herve> Hervé:  The drawings just clarify that there must be a change of both
  Herve> analyzerid and alertid when going through B, at the moment. I'm open
  Herve> to discussion, if there is a concensus for a "path-record" attribute
  Herve> that would chain all analyzerids.

Many, many moons ago (like, in the very first XML DTD for IDMEF) I had put
an "analyzer chain" in there.  It worked more or less like "Received from"
headers in SMTP messages; each box the message passed through added its own
entry to the list (I forget which end it added it to, but that's a minor
issue).

This idea was, in no uncertain terms, hated by the group and it was removed.

Personally, I still think it's the right thing to do.

--Dave