Subject: [Fwd: Re: [prelude-devel] [IDMEF][Issue 10] Severity scale too narrow (fwd)]

From: Yoann Vandoorselaere <[email-masked]>
Date: Sat, 17 Jan 2004 00:57:59 +0000

-- 
Yoann Vandoorselaere, http://www.prelude-ids.org

"Programming is a race between programmers, who try and make more and 
 more idiot-proof software, and universe, which produces more and more 
 remarkable idiots. Until now, universe leads the race"  -- R. Cook

Subject: Re: [prelude-devel] [IDMEF][Issue 10] Severity scale too narrow (fwd)
From: Yoann Vandoorselaere <[email-masked]>
To: Krzysztof Zaraska <[email-masked]>
Cc: [email-masked], Herve Debar <[email-masked]>, intrusion detection wg <[email-masked]>, [email-masked]
Date: Fri, 09 Jan 2004 13:06:09 +0000

On Fri, 2004-01-09 at 10:52, Krzysztof Zaraska wrote:

> ---------- Forwarded message ----------
> Date: Fri, 09 Jan 2004 10:07:31 +0100
> From: Herve Debar <[email-masked]>
> To: intrusion detection wg <[email-masked]>
> Subject: [IDMEF][Issue 10] Severity scale too narrow
> 
>  From Krzysztof Zaraska:
> severity scale (3 grades only) is too narrow; for example, there is an
> idea floating around of expressing the danger associated with the 
> attack as exp(severity*vulnerabity_level), but you can't go far this 
> way with 3 level severity scale only.
> 
> 
> Hervé: we use 5 internally. It seems to be standard practice within 
> the telco industry:
> 1) = critical
> 2) = warning
> 3) = minor
> 4) = normal
> 5) = unclassified/unclassifiable
> This wouldn't solve your graduation issue, but it actually is enough 
> for an operator. We also use another scale which has 3 levels,(solved 
> within 1/2 hour), (solved within 1/2 day), (solved within 1 day), but 
> that's maybe too operations-oriented.
> 
> IIRC, it is about the same with the Tivoli framework. I think there is 
> a 0) = FATAL (i.e. system stops) in addition.
> 
> 
> 
> 
> Possibilities:
> - keep 3.
> - move to five (and get appropriate definitions)
> - something else
> 
> Please voice your opinion.

IMO 3 is for sure too short. The addition of "normal" and
"unclassified/unclassifiable" would help by allowing us to send
informational events. 

Thought it still feel kinda limitative to me...

-- 
Yoann Vandoorselaere <[email-masked]>