Subject: Requirements Draft and IAP/4.0 - seeking canonical representation...

From: "Eric D. Williams" <[email-masked]>
Date: Tue, 20 Feb 2001 20:28:17 -0500

Hello all,

I was looking over the latest requirements draft and Ben's message in response 
to Mike on the IAP draft.  While the requirements draft states:

7.13   The IDMEF [message] MUST support reporting alert creation date and time 
in
                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
       each event. The IDMEF [message] MAY support reporting the date and time 
the
            ^^^^^
       event began in addition to the date and time the alert was
       ^^^^^^^^^^^                                      ^^^^^^^^^
       created.
       ^^^^^^^
It is not clear to me in the semantics of IDMEF-XML whether the IDMEF-Message 
element supports multiple Alert class elements (or Heartbeat types) in a single 
IDMEF-Message, as is alluded to by Ben (and as I stated I am not clear on 
whether it is supported or not - I think not).  It appears unclear as it seems 
to relate to the requirement:

7.12   The IDMEF message MUST be uniquely identifiable in that it can be
       distinguished from other IDMEF messages.

I agree an Alert may contain a unique identifier for the analyzer(s) involved 
it seems that multiple Alerts in a single IDMEF-Message element might introduce 
more collisions of identity in the intrusion detection environment than 
desirable (that might be okay or inconsequential).

I think it is more important that this may arise from confusion of the terms 
for Alert and an _event_ and whether the iap-content-request could contain 
multiple IDMEF-Messages (and thus multiple Alerts) or would the IDMEF-Message 
be capable of containing multiple Alerts arising from distinct events (and thus 
the iap-content-request could through aggregation of capabilities contain 
multiple Alerts).  Which is it?  I do think it is important to keep the concept 
of an event and Alert creation distinct.

Eric Williams, Pres.
Information Brokers, Inc.    Phone: +1 202.889.4395
http://www.infobro.com/        Fax: +1 202.889.4396
mailto:[email-masked]      Pager: +1 301.303.8998
           For More Info: [email-masked]
                    PGP Public Key
   http://new.infobro.com/KeyServ/EricDWilliams.asc
Finger Print: 1055 8AED 9783 2378 73EF  7B19 0544 A590 FF65 B789