idmef experience

the following message was bounced for an address issue:



Hello list,
 This is my first submission to the IDMEF discussion, so please forgive me
 if there are would be some 'common knowledge' issues which I am going to
 mention,  or things, which have already been discussed.

 I recently tried to develop RDBMS (database) structure based on IDMEF
 format, and came across a few things which I'd like to ask, or maybe advice
 on improvement:

 1. From what I noticed, there's no consitency in the XML tags spelling
 (i.e. some tags appear in lower or upper case, and the selected case
 doesn't seem to be dependent on teh data type or tag location). I would
 believe that it would simplify things greately, if there would be some kind
 of 'XML style' applied, which would dictate equal ranks of XML tags to be
 spelled similary.

 2.There are some types of data (i.e. IDENT) in descrption of IDMEF classes,
 which are described as optional in the specification, but at the same time
 these types of data are assigned a 'default' value. If you describe such
 field using data base terminology, this field should be described as
 'mandatory' (since it always exist). This doesn't affect XML format itself
 much, but it probably would greately confuse developers, who would be
 trying to implement the specification.

 The proper 'optional' data should not be assigned a default value, and
 shall be just not present within the data structure, if the parameter is
 declared as 'optional'.
 

 I am still in the proccess of implementing the IDMEF (v11) spec, so if
 there's interest, I will be posting my comments and remarks to the list, as
 soon as they appear.

Thank you for your attention,

best regards,
    Nick Bor.



-- 
Mike Erlinger, Professor and Chair Computer Science
www:      http://www.cs.hmc.edu/~mike
email:    [email protected]
smail:    Computer Science Dept., Harvey Mudd College,
          301 E. 12th Street, Claremont, CA, 91711 
          909-621-8912,   FAX: 909-607-8364