Subject: Alert "Subclasses"

From: Spencer Allain <[email-masked]>
Date: Fri, 27 Apr 2001 09:40:00 -0400

ToolAlert, CorrelationAlert, and OverflowAlert are described in the
0.3 draft of the IDMEF Data Model and DTD as being subclasses of
Alert.

This seems reasonable, except that the below element description for
Alert allows for the Alert to be a ToolAlert, OverflowAlert, and a
CorrelationAlert at the same time (or any combination of such).

   <!ELEMENT Alert                         (
       Analyzer, CreateTime, DetectTime?, AnalyzerTime?, Source*,
       Target*, Classification+, ToolAlert?, OverflowAlert?,
       CorrelationAlert?, AdditionalData*
     )>

Was it intended to be more like the below description?

   <!ELEMENT Alert                         (
       Analyzer, CreateTime, DetectTime?, AnalyzerTime?, Source*,
       Target*, Classification+, (ToolAlert | OverflowAlert |
       CorrelationAlert)?, AdditionalData*
     )>

I'm not partial to it being either way, it's just the model description
of page 30 of the 0.3 draft clearly intends for inheritence to be
simulated, and that isn't really what the existing element description
does.

-Spencer

Spencer Allain
Teknowledge Corporation
3900 Jermantown Road, Suite 100
Fairfax VA,  22030
(703) 352-9300 x207
[email-masked]

---

From: "David A. Curry" <[email-masked]>
Date: Fri, 27 Apr 2001 09:53:31 -0400

>simulated, and that isn't really what the existing element description

I think you're correct, it should be as you have it above.  I'll fix this
in the next draft.

--Dave