Subject: [IDMEF][Issue 6] Classification and name

From: Herve Debar <[email-masked]>
Date: Thu, 08 Jan 2004 21:27:55 +0100

Herve> The cve, bugtraq and vendor-specific for "origin" is a bit too
Herve> reductive. I'd like to either add more identifiers, or add a 
Herve> meaning field to allow people to put free text in there
Herve> (field that would only be valid if origin=unknown).

DaveC> I'm pretty sure the list was decided on at a meeting, and
DaveC> people were loathe to specify every Source Of The Day because
DaveC> it would always be out of date. I would not object to some
DaveC> kind of free-text or alternate-source type of functionality
DaveC> in...

Zaraska> We second that. Free-form string?

I also believe that if we went to a schema (or maybe even without), we 
could define a namespace.

OK, pending the namespace issue, the proposal is to:

add another keyword, meaning, that is free text, and is only valid if 
origin=unknown (and/or vendor-specific ?).

Hervé
-- 
Hervé Debar             <mailto:[email-masked]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4

---

From: Herve Debar <[email-masked]>
Date: Tue, 13 Jan 2004 01:16:15 +0100

> origin=unknown (and/or vendor-specific ?).

*See issue 8 for continued disccussion. This one is closed.*

Hervé