Subject: [IDMEF][Issue 11] Informational messages

From: Herve Debar <[email-masked]>
Date: Fri, 09 Jan 2004 10:09:54 +0100

From Krzysztof Zaraska:
There is a need for INFORMATIONAL messages. For example, a honeypot
traffic is by definition anomalous, however it should be treated
differently whether it's malicious or not. Maybe these could be
implemented as alert messages with severity = 0?

Hervé: I'd like to wait a bit to see if issue 10 provides a solution 
that also solves this.

Hervé
-- 
Hervé Debar             <mailto:[email-masked]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4

---

From: "David A. Curry" <[email-masked]>
Date: Sun, 11 Jan 2004 21:08:36 -0500

>>>>> On Fri, 9 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> From Krzysztof Zaraska:  There is a need for INFORMATIONAL
  Herve> messages. For example, a honeypot traffic is by definition anomalous,
  Herve> however it should be treated differently whether it's malicious or
  Herve> not. Maybe these could be implemented as alert messages with severity
  Herve> = 0?

Is a honeypot considered an IDS?  Or at least, is it considered an IDS in the
context of the IDMEF requirements doc?  I think it's kind of a stretch.

Personally I think it's way too late in the game to go extending IDMEF in major
ways to handle things it was not intended to handle.

--Dave