Subject: Bringing IDWG to closure

From: Sam Hartman <[email-masked]>
Date: Thu, 13 Jan 2005 17:26:21 -0500

[My postings to the list do not seem to be accepted.  I'd appreciate
it if the chairs could forward this to the list and add me to the
accepted senders.]

Hi.  I sent a probe out about the status of the IDMF document at the
end of November and received some indications that the authors would
try to work on the document during December.  I have not heard
anything since then.

In the interest of not having this process draw out for ever, I'm
establishing a concrete deadline.  One of two things must happen by
February 7, 2005, the first scheduling deadline for IETF 62.

First, an IDMF document can be presented along with changes since the
last version.  This document needs to be accompanied by a statement of
what review it has received and an assertion by the chairs that they
believe this review is adequate for publication.

If it looks like getting the document in final shape by this deadline
is problematic, there is another option.  The chairs can work with me
to set up a series of milestones providing for completion of the
document and for adequate review.  These milestones would need to be
established by February 7.

If neither of these things happen by February 7, I will conclude that
there is not sufficient interest to finish this work and close down
the working group.  If there is some reason that February 7 is not a
reasonable deadline--for example a critical stakeholder is on vacation
until then--propose an alternate deadline as soon as possible.

Thanks,

Sam Hartman
Security Area Director

---

From: Herve Debar <[email-masked]>
Date: Mon, 17 Jan 2005 09:40:39 +0100

Sam,

[sorry for the delay, I was unavailable last week.]

>it if the chairs could forward this to the list and add me to the
I think your post made it to the list.

>try to work on the document during December.  I have not heard
This did happen. I believe that we have an almost final document for 
IDMEF. Mike Erlinger currently has the document. I will forward it to 
you via a separate mail.

>believe this review is adequate for publication.
I am sending you the document. It has been reviewed and implemented by 2 
open source projects, libidmef / snort IDMEF output plugin and prelude 
(http://www.prelude-ids.org). It is also used in many research 
prototypes (CRIM, DIAMS, ...) and as such referenced in numerous 
research papers (you can find these references in citeseer for example). 
There are also at least 2 research papers proposing extensions to the 
document.

The final document is (IMO) the one I'm sending you minus the sections:
- DTD (superseded by the schema)
- XML tutorial
- Change tracking.

>until then--propose an alternate deadline as soon as possible.
I'll do my best, but I had emergency surgery last week and I will be 
unable to travel for quite a while. I'll be reading mail and working on 
the document tough.

Hervé

-- 
Hervé Debar             <mailto:[email-masked]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4