Re: [IDMEF][Issue 8] Classification and ident

On Fri, 9 Jan 2004, Herve Debar wrote:

> Proposal:
> 
> move from
>        1..n
> Alert------Classification
> 
> to
>        1..n            0..n
> Alert-------Message--------Classification
> 
> Message has 2 fields
> - ident (reference)
> - meaning (whatever one wants to put there)
> 
> And classification is reserved for documentation.

I mostly agree, however:

1. Isn't "message" confusing with the root object?

2. What's the rationale for using > 1 Classification/documentation fields
per vulnerbility id?

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem