Subject: Re: Finishing Off IDWG

From: Mayank-Bhatnagar <[email-masked]>
Date: Thu, 2 Mar 2006 19:24:57 +0530 (IST)

Dear Mike,

I am sorry, I had drafted this mail earlier but could not send it due to 
XYZ reasons....

Anyway, let me be brief and to the point. We are a security group working 
on IDS and other issues. We have primarily used IDMEF and our sensors and 
servers communicate using the protocol.

As far as the importance and usability of standardisation goes, we feel 
IDMEF has gone a long way in describing and framing the requirements. 
However efforts can be carried out on enabling this to become a standard 
(realisig the importance of a standard).

Already there have been mails regarding use of Snort-IDMEF module (which I 
have personally used as part of correlation activities) and Prelude IDS 
are some of the major open source IDS beig in use.

I feel there has been some less discussions on how interoperability part 
of the IDMEF capable IDS haven's been thoroughly investigated.

Also as part of our work, we have suggested some modifications earlier to 
IDMEF which we couldnt get any response. That mail was sent by our group 
member Srinivas G. The mail is attache with this mail.

This is our view based on our experience and requirements of a 
standardised protocol, which we feel is very much essential and very well 
look forward to let it proceed as an experimental RFC.

Regards,
Mayank Bhatnagar
[email-masked]

68 Electronics City ,
CDAC (Formerly NCST),
Bangalore-560100.
Ph: 080-2852 3300/2852 0239-1200
Fax: 080-2852 2590
__________________________________________________________________________

On Mon, 6 Feb 2006, Mike Erlinger wrote:

>
> Hi Everyone
>
> IDWG was on my list of things to do after the New Year.  Sam Hartman,
> the Security Area Director beat me to it.  Basically, the IDWG Working
> Group has been idle for over a year; IDMEF is still an Internet Draft;
> the IESG has issues with the use of both DTD and Schemas in IDMEF.
>
> Herve Debar, the primary author of IDMEF, is willing to make changes
> recommended by the IESG.  He has sent out email to the list asking
> for information about the use of IDMEF and whether a DTD or Schema
> is the better choice.  He will use the responses to drive a new
> document.  Once we have a new document, Sam will assist
> us in getting IDMEF published as an Experimental RFC.  This would
> finish the IDWG Working Group efforts and the Working Group would
> be closed.
>
> So, very soon Herve will post a new Internet Draft to the mailing
> list.  I will then post the ID to the ID database.  Once this is
> done, I would ask people to read the document and post any typo
> issues (since IDMEF passed a Working Group last call and was
> forwarded to the AD and IESG, we are past making serious
> modifications to the IDMEF, except as directed by the IESG).
>
> Once the Working Group is happy with the document, I would ask
> that it be published as an Experimental RFC.
>
> mike
>
> -- 
> Mike Erlinger, Professor and Chair Computer Science
> www:      http://www.cs.hmc.edu/~mike
> email:    [email-masked]
> smail:    Computer Science Dept., Harvey Mudd College,
>          301 E. 12th Street, Claremont, CA, 91711
>          909-621-8912,   FAX: 909-607-8364
> "As for the future, your task is not to foresee, but to enable it"
>