Subject: do we care about IAP?

From: Randy Presuhn <[email-masked]>
Date: Tue, 20 Feb 2001 09:10:19 -0800 (PST)

Hi -

FYI -

A draft just appeared in the intrusion detection working group,
<draft-ietf-idwg-iap-04.txt>, entitled "IAP: Intrusion Alert
Protocol".

 -------------------------------------------------------
 Randy Presuhn           [email-masked]
 Voice: +1 408 546-1006  BMC Software, Inc.  1-3141
 Fax:   +1 408 965-0359  2141 North First Street
 http://www.bmc.com/     San José, California 95131  USA
 -------------------------------------------------------
 My opinions and BMC's are independent variables.
 -------------------------------------------------------

---

From: Randy Presuhn <[email-masked]>
Date: Thu, 22 Feb 2001 10:57:36 -0800 (PST)

Hi -

Forwarding a posting from Wes.

|From [email-masked] Thu Feb 22 10:55:31 PST 2001
|X-Authentication-Warning: wanderer.hardakers.net: hardaker set sender to [email-masked] using -f
|To: Randy Presuhn <[email-masked]>
|Cc: [email-masked]
|Subject: Re: do we care about IAP?
|References: <[email-masked]>
|From: Wes Hardaker <[email-masked]>
|X-URL: http://dcas.ucdavis.edu/~hardaker
|Organization: Network Associates - NAI Labs
|X-Face: #qW^}a%m*T^{A:Cp}$R\"38+d}41-Z}uU8,r%F#c#s:~Nzp0G9](s?,K49KJ]s"*7gvRgA
| SrAvQc4@/}L7Qc=w{)]ACO\R{LF@S{pXfojjjGg6c;q6{~C}CxC^^&~(F]`1W)%9j/iS/
| IM",B1M.?{w8ckLTYD'`|kTr\i\cgY)P4
|Date: 22 Feb 2001 07:31:18 -0800
|In-Reply-To: <[email-masked]> (Randy Presuhn's message of "Tue, 20 Feb 2001 09:10:19 -0800 (PST)")
|Message-ID: <[email-masked]>
|Lines: 34
|User-Agent: Gnus/5.090001 (Oort Gnus v0.01) XEmacs/21.2 (Terspichore)
|
|
|[Here's a response to the list that bounced:]
|>>>>> On Tue, 20 Feb 2001 09:10:19 -0800 (PST), Randy Presuhn <[email-masked]> said:
|
|Randy> A draft just appeared in the intrusion detection working group,
|Randy> <draft-ietf-idwg-iap-04.txt>, entitled "IAP: Intrusion Alert
|Randy> Protocol".
|
|A quick summary, since I've been following the idwg working group:
|
|1) iap is sort of a modified http like protocol, for all practical
|   purposes (with bi-directional and security features added, and
|   other http features removed).  It's designed by that group to
|   transfer they're particular information because it meets their
|   needs, but is extensible through mime-types just like http is.
|
|2) The intrusion alerts being designed by the idwg working group are
|   XML and a data model is being defined to specify the format of the
|   intrusion detection related alerts.
|
|Does it conflict somewhat with the alarm mib?
|  probably.
|
|Is it generic and can handle any type of alarms?
|  probably not.  The data model that can be transfered is designed for
|  their particular needs.
|
|On a side note, their first major decision was whether to use xml or
|smiv2 as the documentation language for their alerts.  Either way,
|actually, they were going to send the resulting data over their IAP
|protocol even if it was an SNMP pdu.
|
|--
|Wes Hardaker
|NAI Labs
|Network Associates
|

---

From: Randy Presuhn <[email-masked]>
Date: Thu, 22 Feb 2001 15:22:40 -0800 (PST)

Hi -

Forwarding a message from Mike Slifcak.

|From [email-masked] Thu Feb 22 15:21:11 PST 2001
|Message-ID: <[email-masked]>
|Date: Thu, 22 Feb 2001 18:00:23 -0500
|From: "Michael J. Slifcak" <[email-masked]>
|X-Accept-Language: en
|To: [email-masked]
|Subject: Re: do we care about IAP?
|
|Randy Presuhn wrote:
|>
|> Hi -
|>
|> FYI -
|>
|> A draft just appeared in the intrusion detection working group,
|> <draft-ietf-idwg-iap-04.txt>, entitled "IAP: Intrusion Alert
|> Protocol".
|>
|
|IDWG is considering two protocols to bear the IDMEF message
|traffic :  IAP and BEEP-idxp.
|
|http://www.ietf.org/internet-drafts/draft-ietf-idwg-iap-04.txt
|http://www.ietf.org/internet-drafts/draft-ietf-idwg-beep-idxp-00.txt
|
|IAP is a constrained HTTP requiring TLS.
|   As indicated in the IETF 49 IDWG minutes, there is a preliminary
|   implementing of this protocol via proxies.
|
|BEEP is adopted by secure syslog WG.
|The BEEP-IDXP draft presents three BEEP profiles which are proposed
|to address IDMEF messages.
|   I'm not sure if this is being tested, or not.
|
|
|Regards,
|-Mike Slifcak, Internet Security Systems, Inc.
|