Re: Proposal for additional asset infos in IDMEF

All,

> I'd like to propose inclusion of additional information within IDMEF:

Here are some comments on the asset document. To make the OS info actually 
useful (which, given the circumstances with IDMEF, might well be an 
optional requirement...), one needs to go beyond arch+version. This level 
of granularity is insufficient for most of the automated correlation 
tasks. What is needed is a well-formed set of OS descriptors, such as:

vendor: MS
os_family: Windows
os_version: 5.1
os_name: 2003
os_service_pack: SP1

All of the above should be normalized.

More comments to follow.

Best,
-- 
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA
Security Strategist
Product Management Group
netForensics -  http://www.netForensics.com
732-393-6071
**************************************************************************************************
The contents of this email and any attachments are confidential.
They are intended for the named recipient(s) only.
If you have received this email in error please notify the system manager or  the 
sender immediately and do not disclose the contents to anyone or make copies.

** This e-mail  has been scanned for viruses, vandals and malicious content. **
**************************************************************************************************