Re: Finishing Off IDWG

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--279708161-2023122022-1141307585=:30044
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII; format=flowed
Content-ID: <[email protected]>

Dear Mike,

I am sorry, I had drafted this mail earlier but could not send it due to 
XYZ reasons....

Anyway, let me be brief and to the point. We are a security group working 
on IDS and other issues. We have primarily used IDMEF and our sensors and 
servers communicate using the protocol.

As far as the importance and usability of standardisation goes, we feel 
IDMEF has gone a long way in describing and framing the requirements. 
However efforts can be carried out on enabling this to become a standard 
(realisig the importance of a standard).

Already there have been mails regarding use of Snort-IDMEF module (which I 
have personally used as part of correlation activities) and Prelude IDS 
are some of the major open source IDS beig in use.

I feel there has been some less discussions on how interoperability part 
of the IDMEF capable IDS haven's been thoroughly investigated.

Also as part of our work, we have suggested some modifications earlier to 
IDMEF which we couldnt get any response. That mail was sent by our group 
member Srinivas G. The mail is attache with this mail.

This is our view based on our experience and requirements of a 
standardised protocol, which we feel is very much essential and very well 
look forward to let it proceed as an experimental RFC.

Regards,
Mayank Bhatnagar
[email protected]

68 Electronics City ,
CDAC (Formerly NCST),
Bangalore-560100.
Ph: 080-2852 3300/2852 0239-1200
Fax: 080-2852 2590
__________________________________________________________________________

On Mon, 6 Feb 2006, Mike Erlinger wrote:

>
> Hi Everyone
>
> IDWG was on my list of things to do after the New Year.  Sam Hartman,
> the Security Area Director beat me to it.  Basically, the IDWG Working
> Group has been idle for over a year; IDMEF is still an Internet Draft;
> the IESG has issues with the use of both DTD and Schemas in IDMEF.
>
> Herve Debar, the primary author of IDMEF, is willing to make changes
> recommended by the IESG.  He has sent out email to the list asking
> for information about the use of IDMEF and whether a DTD or Schema
> is the better choice.  He will use the responses to drive a new
> document.  Once we have a new document, Sam will assist
> us in getting IDMEF published as an Experimental RFC.  This would
> finish the IDWG Working Group efforts and the Working Group would
> be closed.
>
> So, very soon Herve will post a new Internet Draft to the mailing
> list.  I will then post the ID to the ID database.  Once this is
> done, I would ask people to read the document and post any typo
> issues (since IDMEF passed a Working Group last call and was
> forwarded to the AD and IESG, we are past making serious
> modifications to the IDMEF, except as directed by the IESG).
>
> Once the Working Group is happy with the document, I would ask
> that it be published as an Experimental RFC.
>
> mike
>
> -- 
> Mike Erlinger, Professor and Chair Computer Science
> www:      http://www.cs.hmc.edu/~mike
> email:    [email protected]
> smail:    Computer Science Dept., Harvey Mudd College,
>          301 E. 12th Street, Claremont, CA, 91711
>          909-621-8912,   FAX: 909-607-8364
> "As for the future, your task is not to foresee, but to enable it"
>
--279708161-2023122022-1141307585=:30044
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII; NAME=idmef-srini
Content-Transfer-Encoding: BASE64
Content-ID: <[email protected]>
Content-Description: 
Content-Disposition: ATTACHMENT; FILENAME=idmef-srini

DQpEYXRlOiBUdWUsIDI1IEphbiAyMDA1IDIwOjU3OjA3ICswNTMwIChJU1Qp
DQpGcm9tOiBTcmluaXZhcyBHdW50dXBhbGxpIDxzcmluaXZhc0B5dWdhLm5j
c3QuZXJuZXQuaW4+DQpUbzogSURXRyBNYWlsaW5nIExpc3QgPGlkd2ctbEBo
bWMuZWR1Pg0KU3ViamVjdDogUHJvcG9zZWQgc3VnZ2VzdGlvbnMgdG8gSURN
RUYgZHJhZnQgdmVyc2lvbi0xMw0KDQoNCldlIGFyZSBhIHRlYW0gd29ya2lu
ZyBpbiB0aGUgZmllbGQgb2YgTmV0d29yayBhbmQgU3lzdGVtIFNlY3VyaXR5
IGF0IHRoZQ0KQ2VudHJlIGZvciBEZXZlbG9wbWVudCBvZiBBZHZhbmNlIENv
bXB1dGluZyhDREFDKSwgQmFuZ2Fsb3JlLCBJbmRpYS4gV2UNCmhhdmUgYmVl
biBmb2xsb3dpbmcgdGhlIElETUVGIGRyYWZ0IGZvciB0aGUgcGFzdCB0d28g
eWVhcnMgYW5kIGhhdmUgZm91bmQNCml0IHRvIGJlIHF1aXRlIGNvbXByZWhl
bnNpdmUgYW5kIHdlbGwgdGhvdWdodCBvdXQuIFRoaXMgaGFzIHByb21wdGVk
IHVzIHRvDQp1c2UgSURNRUYgYXMgYSBtZXNzYWdlIGZvcm1hdCBmb3IgY29t
bXVuaWNhdGlvbiBiZXR3ZWVuIHRoZSBJRFMgZW50aXRpZXMNCm9mIG91ciBJ
RFMuIEZvciB0aGlzIHdlIGFyZSB2ZXJ5IGdyYXRlZnVsIHRvIHRoZSBJbnRy
dXNpb24gRGV0ZWN0aW9uDQpXb3JraW5nIEdyb3VwLg0KDQpXb3JraW5nIG9u
IGludHJ1c2lvbiBkZXRlY3Rpb24gc3lzdGVtcywgd2UgYmVsaWV2ZSB0aGUg
bGF0ZXN0IHZlcnNpb24gb2YNCklETUVGKDEzKSBjYW4gYmUgZW5oYW5jZWQg
dG8gZmFjaWxpdGF0ZSBldmVuIG1vcmUgY29tcHJlaGVuc2l2ZQ0KY29tbXVu
aWNhdGlvbiBiZXR3ZWVuIHRoZSBJRFMgZW50aXRpZXMuIENvbnNpZGVyaW5n
IHRoZSBwcmVzZW50IElEUw0Kc2NlbmFyaW9zIGFuZCB0aGVpciBhcHBsaWNh
dGlvbnMsIG9uZSBmaW5kcyBtdWx0aXBsZSBJRFMgZW50aXRpZXMgZGVwbG95
ZWQNCmFsbCBvdmVyIHRoZSBuZXR3b3JrIGFuZCBhY3Jvc3MgbmV0d29ya3Mu
IEluIHN1Y2ggYW4gZW52aXJvbm1lbnQsIHRoZQ0KZW50aXRpZXMgd291bGQg
aGF2ZSBtdWNoIG1vcmUgdG8gc2hhcmUgdGhhbiBBbGVydHMgYW5kIEhlYXJ0
YmVhdHMuDQoNCkR1cmluZyBvdXIgd29yayBpbiB0aGUgZmllbGQgb2YgaW50
cnVzaW9uIGRldGVjdGlvbiwgd2UgcmVhbGlzZWQgdGhhdA0Kc2hhcmluZyBp
bmZvcm1hdGlvbiwgYWJvdXQgdGhlIGVudGl0aWVzIHRoZW1zZWx2ZXMgY2Fu
IG1ha2UgdGhlIHN5c3RlbQ0KbW9yZSByb2J1c3QgYW5kIHN1cnZpdmFibGUu
DQoNCkFzIElETUVGIGlzIHN1cHBvc2VkIHRvIGZ1bGZpbGwgYWxsIHRoZSBy
ZXF1aXJlbWVudHMgb2YgZm9ybWF0IG9mDQptZXNzYWdlcyB0aGF0IGNvdWxk
IGJlIGV4Y2hhbmdlZCBhbW9uZyBJRCBlbnRpdGllcywgd2UgZmVlbCwgdGhl
cmUgc2hvdWxkDQpiZSBzb21lIHdheSB0byBkZWFsIHdpdGggImNvbnRyb2wg
aW5mb3JtYXRpb24iIHRoYXQgYW4gSUQgZW50aXR5IHdvdWxkDQpsaWtlIHRv
IHNlbmQgdG8gb3RoZXIgZW50aXRpZXMuIEhlcmUsIHdlIHdvdWxkIGxpa2Ug
dG8gY29tcGxlbWVudCB0aGUgc2V0DQpvZiBtZXNzYWdlcyBzdXBwb3J0ZWQg
YnkgSURNRUYgYnkgYSBuZXcgZ3JvdXAsIHdoaWNoIHdlIGNhbGwsICJDb250
cm9sDQpNZXNzYWdlcyIuIFRoZSBwcm9wb3NlZCBncm91cCB3b3VsZCBjb25z
aXN0IG9mIDUgc2V0cyBvZiBtZXNzYWdlcywNCmNsYXNzaWZpZWQgYmFzZWQg
b24gdGhlIGtpbmQgb2YgY29udHJvbCBtZXNzYWdlIGFuZCB0aGUgYWN0aW9u
IGV4cGVjdGVkDQpmcm9tIHRoZSByZWNlaXZlcnMgdml6LiwgaW5zdHJ1Y3Rp
b25hbCwgb3BlcmF0aW9uYWwsIGFubm91bmNlbWVudHMsDQpzdWNjZXNzIGFu
ZCBleGNlcHRpb24gbWVzc2FnZXMuDQpTaW5jZSB0aGUgaW5mb3JtYXRpb24g
c2hhcmVkIGlzIG5laXRoZXIgYW4gQWxlcnQgY2F0ZWdvcnksIG5vciBhDQpI
ZWFydEJlYXQsIHdlIHByb3Bvc2UgdG8gaW50cm9kdWNlIGEgbmV3IGhlaXIg
b2YgdGhlIElETUVGLU1lc3NhZ2UuDQoiQ29udHJvbC1NZXNzYWdlIiBzZWVt
cyB0byBiZSBhbiBhcHByb3ByaWF0ZSBuYW1lLiBNb3Jlb3ZlciwgdGhlDQpp
bmZvcm1hdGlvbiBjYW5ub3QgYmUgc2VudCB1c2luZyB0aGUgZXhpc3Rpbmcg
SURNRUYgc3RydWN0dXJlIChlaXRoZXINCkFsZXJ0IG9yIEhlYXJ0YmVhdCku
IFRoZSBDb250cm9sLU1lc3NhZ2UgZnVydGhlciBjYW4gaGF2ZSBoaWVyYXJj
aHkNCnNpbWlsYXIgdG8gdGhlIG9uZSB3aXRoIEFsZXJ0Lg0KDQpDZXJ0YWlu
IGFkdmFudGFnZXMgYnkgaGF2aW5nIHN1Y2ggY29udHJvbCBhcmU6DQogICBh
LiBTeW5jaHJvbml6YXRpb24gaXMgYWNoaWV2ZWQgYmV0d2VlbiB0aGUgSURT
IGVudGl0aWVzDQogICBiLiBFbnRpdGllcyBjYW4gYmUgYmV0dGVyIGluZm9y
bWVkIGFuZCBiZSB1cC10by1kYXRlIGFib3V0DQogICAgICBjby1vcGVyYXRp
bmcgaWRzLWVudGl0aWVzDQogICBjLiBQb3NzaWJpbGl0eSBvZiB0YXNrIGRl
bGVnYXRpb24NCiAgIGQuIEFubm91bmNlbWVudCBvZiBmaW5lciBwZXJmb3Jt
YW5jZSBkZXRhaWxzIG9mIGVudGl0aWVzLg0KICAgZS4gT3BlcmF0aW9uYWwg
c3RhdHVzIG9mIGVudGl0aWVzDQoNClRoZSBwb3NpdGlvbiBvZiB0aGUgcHJv
cG9zZWQgIkNvbnRyb2wtTWVzc2FnZSIgYWdhaW5zdCB0aGUgY3VycmVudA0K
bWVzc2FnZXMgY2FuIGJlIHZpc3VhbGlzZWQgYXMgZm9sbG93cywNCg0KICAg
ICAgICAgICAgICAgICAgICstLS0tLS0tLS0tLS0tLS0rDQogICAgICAgICAg
ICAgICAgICAgfCBJRE1FRi1NZXNzYWdlIHwNCiAgICAgICAgICAgICAgICAg
ICArLS0tLS0tLS0tLS0tLS0tKw0KICAgICAgICAgICAgICAgICAgICAgICAg
ICAvX1wNCiAgICAgICAgICAgICAgICAgICAgICAgICAgIHwNCiAgICAgICAr
LS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tKw0KICAgICAgIHwg
ICAgICAgICAgICAgIHwgICAgICAgICAgICAgICAgICB8DQogICstLS0tLS0t
KyAgICArLS0tLS0tLS0tLS0rICAgICstLS0tLS0tLS0tLS0tLS0tLSsNCiAg
IHwgQWxlcnQgfCAgICB8IEhlYXJ0YmVhdCB8ICAgIHwgQ29udHJvbC1NZXNz
YWdlIHwNCiAgICstLS0tLS0tKyAgICArLS0tLS0tLS0tLS0rICAgICstLS0t
LS0tLS0tLS0tLS0tLSsNCg0KV2UgbG9vayBmb3J3YXJkIGZvciB5b3VyIGZl
ZWRiYWNrIG9uIHRoZSBwcm9wb3NhbC4NCg0KVGhhbmtzICYgcmVnYXJkcywN
CnNyaW5pdmFzLg0KDQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLQ0KU3Jpbml2YXMgR3VudHVwYWxsaQ0KQ2VudHJlIGZvciBE
ZXZlbG9wbWVudCBvZiBBZHZhbmNlZCBDb21wdXRpbmcsDQpOYXZpIE11bWJh
aSA0MDA2MTQsIEluZGlhLg0KUGhvbmU6ICs5MS0yMi0yNzU2MDAxMyBUZWxl
ZmF4OiArOTEtMjItMjc1NjAwMDQNCldlYnNpdGU6IGh0dHA6Ly93d3cubmNz
dC5lcm5ldC5pbg0KZW1haWw6c3Jpbml2YXNAeXVnYS5uY3N0LmVybmV0Lmlu
DQoNCg==

--279708161-2023122022-1141307585=:30044--