Subject: Re: [IDWG] Closing on IDMEF

From: Yoann Vandoorselaere <[email-masked]>
Date: Wed, 01 Feb 2006 16:39:57 +0100

On Tue, 2006-01-31 at 15:23 +0100, Herve Debar wrote: 
> as you have seen from Sam Hartman's message, we have one last chance to
> make IDMEF an experimental RFC, hence finalizing the document. I am
> enclosing for your perusal version -14, which has been reviewed by Sam
> Hartman, and the tentative -15 version, which I would like to be the
> final RFC. The -15 version contains minor corrections from -14.
> 
> The key issue there is to show the IESG and Sam Hartman that there is
> support from the community to have a schema instead of a DTD. Hence, I
> would like to have an opinion from all of you who care about this issue.
> Please let me know by feb. 7th midnight if you support:
> 
> - the DTD as normative (in which case -14 is the final version with DTD
> and schema swaped)
> 
> or
> 
> - the schema as normative (in which case -15 is the final version)
> 
> and additionally, whether you are using IDMEF as
> - an academic
> - an industrial vendor (including references / number of deployments if
> you can publicly state them.
> [In both cases a web site will be appreciated].
> 
> Depending on the number of answers I receive, I will make one last
> attempt to push for the schema being normative, or I will swap DTD and
> schema in the final document and move it to the RFC editor.

Hello Herve & all,

I'm writing this mail on behalf of the Prelude project
<http://www.prelude-ids.org>, the PreludeIDS Technologies company
<http://www.prelude-ids.com>, as well as the general Prelude users base.

The Prelude-IDS system is based on the IDMEF standard, and has been
getting a very large users base, including telecoms, military,
government, bank, and other critical security infrastructure world
wide. 

We have been using IDMEF in Prelude since about five years, and have
been very happy about it. 

Although the making of IDMEF has been a difficult task due to the range
of available IDS products, experience has shown that IDMEF permitted the
move to a new era of intrusion detection software, covering a much wider
range of available, heterogeneous products than was previously
possible. 

This is the reason I would like to push for the ratification of IDMEF as
an RFC. I have no formal opinion, however, on whether the DTD version
should be preferred rather than the schema.

Regards,

-- 
Yoann Vandoorselaere <[email-masked]>

---

From: Christophe BRIGUET <[email-masked]>
Date: Thu, 02 Feb 2006 12:05:19 +0000

Hi Herve & all IDWG mailing list readers,

I’m writing this mail to insist about the need that IDMEF becomes an RFC 
and to show you the hidden wide usage of IDMEF.

Over the last four years, ExaProtect Technology has developed and sold a 
Core Security Event Management solution to manage our customers’ 
information security status. Over a hundred companies in Europe, 
including Adecco, Noos and the French Ministry of Employment, now use 
this application.

At the beginning, we chose IDMEF for its flexibility and it was a 
gamble, but it has paid off: we now have successfully implemented this 
proposed standard and included interoperability with other related 
standards (e.g. IODEF). By using these proposed standards, we have 
created a gateway from over a hundred systems and applications 
(including OS, Network & Security devices and applications) to the IDMEF 
world.

Moreover, we are actively involved in several European research projects 
(DESEREC and others), based upon or dependent on IDMEF. ExaProtect have 
actively promoted this IDMEF usage and adoption.

For us it’s very important that IDMEF is quickly ratified as an RFC 
(either DTD or schema).

Regards.

-- 
Christophe BRIGUET - CTO
Mobile: +44(0)7789 001519 | Ddl: +44(0)1223 815549
Office: +44(0)8450 549900 | Fax: +44(0)1223 815627
Skype : cbriguet

ExaProtect Technology - 7200 Beach Drive
Cambridge Research Park
CB5 1TP - Cambridge - United Kingdom

---

From: "Sandro Poppi" <[email-masked]>
Date: Tue, 7 Feb 2006 08:27:32 +0100 (MET)

Hi all,

Regarding applications using IDMEF I'm the maintainner of snort-idmef
(sf.net/projects/snort-idmef), an output plugin for the Open Source IDS
Snort as well as the co-author of libidmef (sf.net/projects/libidmef) which
is already conforming to draft 14 (using DTD).

From the feedback I got regarding those projects they are used in
educational as well as commercial environments.

snort-idmef is pending inclusion in the stock snort distribution btw.

Regarding DTD vs schema I don't have a special preference.

And one last note: I didn't receive much feedback for my asset proposal, an
addition to IDMEF for defining assets. As I understand that there is no
chance to be included in the current IDMEF how is the way for further
discussion on that issue.

Thank you,
Sandro

-- 
Telefonieren Sie schon oder sparen Sie noch?
NEU: GMX Phone_Flat http://www.gmx.net/de/go/telefonie