Subject: Re: <Event> Element in IDMEF

From: "Azim, Ozakil" <[email-masked]>
Date: Thu, 15 Feb 2001 10:04:58 -0500

My earlier mail appears to have bounced. Ignore this one if it
is repeated in your mailbox....

-Azim
> 
> Hi,
> 
> At the risk of bringing up something already discussed, I would like
> to clarify some questions.
> 
> IDS Sensors send Events to IDS Analyzers based on which the Analyzer
> may generate Alerts and forward them to the IDS Manager.
> Based on the assumption that in many existing IDSs the sensor and the
> analyzer are part of the same component, in IDMEF the focus seems to
> be on communications between the IDS Analyzer and the IDS Manager -
> which primarily consist of Alerts (though an IDMEF-Message can contain
> Heartbeats).
> 
> There could be scenarios in the future where sensors from different
> vendor components could interact with a given Analyzer. Sensors could
> also be built into the network security infrastructure - in Firewalls,
> Routers, VPN, CDN, Web Servers and other applications - providing
> Security Event information to Analyzers.
> 
> Though an Event can possibly be encapsulated as an <Alert>, it might
> be confusing and contrived.
> For example, an Alert must contain an indication of the possible impact
> of the event. This information may not be inferable at the Sensor level.
> 
> And, an Alert must have an Analyzer element. One could use the Analyzer
> element to describe a Sensor, but that can only lead to confusion.
> 
> An Event's attributes appear different enough from that of an Alert to
> warrant another IDMEF element.
> Has anyone given any thought to defining an <Event> element for the
> IDMEF-Message that can be used for communications between Sensors and
> Analyzers?
> 
> Thanks,
> 
> Azim
> --
> Azim, Ozakil - [email-masked]
> Product Engineering
> Tel: +1 732-393-6030 Fax: +1 732-393-6025
> http://www.netforensics.com

---

From: "Michael J. Slifcak" <[email-masked]>
Date: Fri, 16 Feb 2001 10:48:04 -0500

Hi, Azim.

As there is an IDMEF to describe messages between Analyzer and Manager,
there is value in a message exchange format between Sensor and Analyzer.

However, this is not within the scope of either the
requirements draft nor the data model/XML draft.

Such a format as you describe should be part of the
future work of IDWG after the IDMEF requirements are completed.

Regards,
-Mike Slifcak, Internet Security Systems, Inc.

>From: "Azim, Ozakil" <[email-masked]>
> 
> Hi,
> 

The future is already here.