Problem reporting PIDs with IDMEF

We are in the midst of an experiment that uses IDMEF 0.3 (ack!) for a bunch 
of sensors that report alerts to a single collection point. During the 
course of our preparation, we discovered that Windows 2000 at times reports 
very *large* numbers for new process IDs. The host based sensor that 
analyzes the Windows audit trail accurately reports the PID according to 
the log (I will not comment on the validity of the Windows log!!) The 
problem is that the IDMEF spec states that PIDs are of type integer, and 
the number is larger than that which can be stored in an integer on the 
alert collection host (Sparc Ultra 5 with Solaris 2.7).

Couple of questions. 1. Is there a particular reason that type "integer" 
was chosen? It would seem that "unsigned" would be better since operating 
systems tend to use positive numbers for PIDs. 2. The actual size of an 
integer is platform dependent. This is problematic in a networked 
heterogeneous environment. How do you propose handling situations where an 
integer value is valid on one host and sent to another where it is too 
large a value and considered invalid?

Thanks,
Laura