Re: [IDMEF][Issue 8] Classification and ident

Krzysztof Zaraska wrote:

> On Thu, 8 Jan 2004, Herve Debar wrote:
> 
> 
>> From Krzysztof Zaraska:
>>Also, we would propose introducing the "id" field here, containing a
>>unique identifier for the vulnerability in given database, as we can 
>>see that "name" field is being rather used as a description, and, as 
>>such, doesn't have to be unique. Having the "id" field, the 
>>construction of the relevant URL is trivial (some combination of 
>>database's base URL and the identifier).
>>
>>Hervé:
>>If I'm correct in what you suggest, the name field could still be your 
>>ID, particularly if it is made unique like issue 1 suggests. or are 
>>you thinking of an "ident" pointer like there is for analyzer ?
> 
> 
> The "ident" pointer. 
> 
> A relevant comment from Yoann Vandoorselaere on issue #1:
> 
> | Today most IDS aggregate several possible type alert behind a single
> | description, as you can see Snort's doing here... 
> 
> | CVE references CAN-1999-0517 and CAN-2002-0013 are quite different, but
> | aggregated under the same "SNMP public access udp" name.
> 
> As you can see, only by looking up "SNMP public access udp" we cannot
> determine whether we're dealing with CAN-1999-0517 or CAN-2002-0013. 
> 
> Inclusion of unique ids/idents solves this problem. 
<snip>

Proposal:

move from
       1..n
Alert------Classification

to
       1..n            0..n
Alert-------Message--------Classification

Message has 2 fields
- ident (reference)
- meaning (whatever one wants to put there)

And classification is reserved for documentation.

Rationale:
This is closer to the current state of the art, where people associate 
a unique message with their alerts and add classification as 
documentation, either their own or publicly available others. This is 
also symetric with analyzer.

Comments ?

Hervé
-- 
Hervé Debar             <mailto:[email protected]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4