Subject: [IDWG] Optional Classification url and description

From: Paul Sangree <[email-masked]>
Date: Fri, 05 Jan 2001 15:57:09 -0600

I would like to propose that the Classification's <url> element be made
optional and that an optional <description> element also be added to
<Classification>.

Some sensors, such as routers and firewalls do not currently have the
capability of reporting url's.  For example, a firewall or router may
report information from a syslog entry.  There is typically no associated
url in this case, but a text description is available from the syslog message.

In cases where no url is available, it would be possible to include a
'default' URL which points to a generic web page that specifies that no
information is available, but this seems like overkill and adds unnecessary
bulk to the xml.  If <url> were made optional, the DTD spec should state
that the url SHOULD be populated whenever the information to do so is
available.  If no url is available, the Description string SHOULD be
populated if possible.

Paul Sangree

---------------------------------------------------------------
Paul Sangree <mailto:[email-masked]>
Active Audit Engineering
Cisco Systems, Inc.
12515 Research Blvd, AST03/B2-6
Austin, TX, USA 78759
voice: 512-378-1518
fax:    512-378-1250