Re: Cisco, ISS, Sourcefire agree to alert standard.

I followed the direction on the link and send an email with "FILE"
in the subject line. And, I did receive the SDEE spec (in html format).

The document I received was written by Jeff Platzer from Cisco on August
20, 2003 with the following abstract:

Network and host-based security devices may generate various types of
events that include alert, policy violation and audit events. The
security Device Event Exchange (SDEE) is a standard that specifies the
format of the messages as well as the protocol used to communicate the
events generated by security devices. The current version of SDEE only
specifies the messaging for the Intrusion Detection System (IDS) Alert
Event. While SDEE communications may consist of bindings to multiple
transport protocols, the current version of SDEE specifies only the
binding to HTTP.

I am pretty sure that I am not allowed to send/post the spec openly...
-Felix


Yoann Vandoorselaere wrote:

> On Thu, 2004-03-11 at 13:52 -0600, Klee Michaelis (kleem) wrote:
> 
> 
>>http://www.icsalabs.com/html/communities/ids/sdee/
> 
> 
> I think we all know about this URL. Unfortunally, the mechanism used for
> accessing the SDEE specification does not work at all. I do not know
> about a single person who succeed in gathering the draft.
> 
> This lead to questions concerning the openess of this doubtful standard.
> 

-- 
----------------------------------------------------------------------
Dr. S. (Shyhtsun) Felix Wu                           [email protected]
Associate Professor                      http://www.cs.ucdavis.edu/~wu
Computer Science Department                     office: 1-530-754-7070
University of California at Davis               fax:    1-530-752-4767
----------------------------------------------------------------------