Re: [prelude-devel] [IDMEF][Issue 9] Alert routing (fwd)

>>>>> On Fri, 9 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> Yoann Vandoorselaere wrote:

  +> I previously tried to express the need to be able to give a "name" to
  +> an analyzer, and that the analyzerID field might not be the best place
  +> for doing so as there might be real concern on checking whether a name
  +> is unique to the whole IDS environment, and that practicaly combining
  +> "analyzerID" + "manager analizerID", for uniqueness might not be doable in
  +> a given implementation.

  Herve> I will create an issue for adding a textual name to an analyzer
  Herve> representation.

An analyzer can have a hostname (foo.bar.com), as the name is part of Node,
which is in turn part of Analyzer.  But I assume you're wanting something
like "Outside IDS 1" or something descriptive like that.

If we want to do this, I would suggest adding a "description" (or something)
field to Node.  That way you could have such descriptions on anything that
can be a Node (it would be left as an exercise for the analyzer or manager
to assign data to that field).

--Dave