Subject: Any more details about how Tivoli Risk Manger using IDMEF ?

From: "Darjoan" <[email-masked]>
Date: Wed, 21 Nov 2001 15:51:51 +0800

Hello,

 I am pondering of How to using IDMEF in our researching project about
security management.
I find that IBM's Tivoli Risk Manager said that it is using IDEF to describe
event from firewall,IDS and other application.

 I just know that Herv Debar had been working in IBM's Zurich
Laboratory.(Mr.Debar, are you here now ? :-)  )
Does anyone know more about how the IDMEF is been using in Risk Manager ?
Does IDMEF been extended or modified in Tivoli Risk Manager ?
The whitepapers of Tivoli Risk Manager does not say more details about this.

As You known, there are lots of events coming from other security checkpoint
besides IDS.

 Best regards

Darjoan Huang

Beijing Institute of Software/System Engineering
P.O.B.9702-19,Beijing,PRC.

---

From: Andreas Wespi <[email-masked]>
Date: Fri, 23 Nov 2001 09:05:26 +0100

Darjoan,

The message format used in Tivoli Risk Manager (TRM) corresponds to an
early draft of IDMEF. Some more information about TRM's event structure
can be found in our paper "Aggregation and Correlation of
Intrusion-Detection Alerts", presented at RAID 2001 (see
http://www.raid-symposium.org/raid2001/program.html for abstract and
slides). As you have pointed out, Herve Debar was not only a key person
in defining IDMEF but also in developing TRM.

Initially, TRM supported only intrusion detection systems as input
sources, later the support for firewalls and anti-virus systems was
added which implied some minor changes in our message format.

Regards,
Andreas

----------------------------------------------------------------
Andreas Wespi                          phone: +41 1 724 82 64
IBM Zurich Research Laboratory         fax:   +41 1 724 89 53
Saeumerstrasse 4                       mail:  [email-masked]
CH-8803 Rueschlikon