Re: [IDMEF][Issue 11] Informational messages

>>>>> On Fri, 9 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> From Krzysztof Zaraska:  There is a need for INFORMATIONAL
  Herve> messages. For example, a honeypot traffic is by definition anomalous,
  Herve> however it should be treated differently whether it's malicious or
  Herve> not. Maybe these could be implemented as alert messages with severity
  Herve> = 0?

Is a honeypot considered an IDS?  Or at least, is it considered an IDS in the
context of the IDMEF requirements doc?  I think it's kind of a stretch.

Personally I think it's way too late in the game to go extending IDMEF in major
ways to handle things it was not intended to handle.

--Dave