Re: [IDMEF][Issue 8] Classification and ident

Herve Debar <[email protected]> Sun, 11 Jan 2004 14:11:19 +0100

Newsgroups	gmane.ietf.idwg
Organization	France Telecom R et D
Message-ID	<[email protected]>

Krzysztof Zaraska wrote:

> On Fri, 9 Jan 2004, Herve Debar wrote:
> 
> 
>>Proposal:
>>
>>move from
>>       1..n
>>Alert------Classification
>>
>>to
>>       1..n            0..n
>>Alert-------Message--------Classification
>>
>>Message has 2 fields
>>- ident (reference)
>>- meaning (whatever one wants to put there)
>>
>>And classification is reserved for documentation.
> 
> 
> I mostly agree, however:
> 
> 1. Isn't "message" confusing with the root object?
Possibly. I didn't want to use signature, though.
> 
> 2. What's the rationale for using > 1 Classification/documentation fields
> per vulnerbility id?
Multiple CVE, BID, ... ?

Hervé
-- 
Hervé Debar             <mailto:[email protected]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4