Subject: IDMEF Draft 15

From: Mike Erlinger <[email-masked]>
Date: Fri, 10 Feb 2006 13:13:20 -0800

IDMEF draft 15 answers all the comments received from
the IESG.  The draft was sent to the Internet Drafts
directory today and a zip version is attached to this
message.

By 25 February, we would like to get all applicable 
comments.  Again, we are not making changes to the
substance of the document, but rather just cleaning up
an typo type problems.  Once we are done with the
document, we will ask that it be published as an 
experimental rfc.

mike

-- 
Mike Erlinger, Professor and Chair Computer Science
www:      http://www.cs.hmc.edu/~mike
email:    [email-masked]
smail:    Computer Science Dept., Harvey Mudd College,
          301 E. 12th Street, Claremont, CA, 91711 
          909-621-8912,   FAX: 909-607-8364
"As for the future, your task is not to foresee, but to enable it"

---

From: "Anton Chuvakin" <[email-masked]>
Date: Wed, 15 Feb 2006 23:06:02 -0500

All,

>By 25 February, we would like to get all applicable comments.  Again, we
are not making changes to the substance of the document, but rather just
cleaning up an typo type problems.  
>Once we are done with the document, we will ask that it be published as an
experimental rfc. 

So, IDMEF is officially "dead" then? IDS might not be dead, but IDMEF
largely is... I haven't posted to this list that much, but I've been
watching IDMEF for many years. In fact, netForensics nFX SIM solutions's
early XML event tranfer protocol, defined back in 2000, was loosely inspired
by the IDMEF. However, IDMEF always was and remains largely unsuitable for
our purposes, and I suspect other vendors in the SIM/SIEM/correlation space
would agree with me. And so would the IDS (now IPS, for the most part)
vendors. The issues are too numerous to list here. Even something as basic
as alert vs hearbeart distinction raises some questions. 

One area where I can see shreds of IDMEF surviving is cross-organizational
data sharing. A little problem with this is that it largely does not
exist... I can see how a hybrid of IDMEF and IODEF with inherent and
well-defined data sanitization  might come handy. Other than that,
utilization of IDMEF in four other use cases (from the page 4 of the doc) is
totally irrelevant and is being better addressed by other means.

Best,
-- 
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA - http://www.chuvakin.org 
Chief Security Strategist 
Product Management Group 
netForensics - http://www.netForensics.com
732-393-6071

---

From: "Anton Chuvakin, Ph.D." <[email-masked]>
Date: Thu, 23 Feb 2006 11:59:47 -0500 (EST)

I am wondering if this message to the list actually got thru. If it did, 
IDMEF is truly dead since nobody even bothered to respond to the comments 
about its death...

-- 
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA - http://www.chuvakin.org
Chief Security Strategist
Product Management Group
netForensics -  http://www.netForensics.com
732-393-6071
**************************************************************************************************
The contents of this email and any attachments are confidential.
They are intended for the named recipient(s) only.
If you have received this email in error please notify the system manager or  the 
sender immediately and do not disclose the contents to anyone or make copies.

** This e-mail  has been scanned for viruses, vandals and malicious content. **
**************************************************************************************************

---

From: Herve Debar <[email-masked]>
Date: Fri, 24 Feb 2006 09:47:09 +0100

Anton Chuvakin, Ph.D. wrote:
> IDMEF is truly dead since nobody even bothered to respond to the
> comments about its death...

Well, it did go to the list, but I'm not sure there is much to respond
to. You are voicing your opinion, which is fair enough, and at the same
time not being specific enough to enable a response, IMO. And I'm really
not interested in a flamefest at this stage.

>> as alert vs hearbeart distinction raises some questions.

There are SIM environments using IDMEF, commercially.

>> totally irrelevant and is being better addressed by other means.

As far as I can tell, INCH is also nearing completion, so again you may
be late bringing in comments.

Hervé
-- 
Hervé Debar             <mailto:[email-masked]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D              (new)Fax: +33 (0)2 31 37 83 43
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4