From idwg-public-request@semper.org Mon Feb 3 06:45:28 2003 Received: from www.opencard.org (www.opencard.org [195.176.20.76]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA03650 for ; Mon, 3 Feb 2003 06:45:27 -0500 (EST) Received: by www.opencard.org (Postfix, from userid 503) id 9B8793478B; Mon, 3 Feb 2003 12:52:41 +0100 (CET) Old-Return-Path: Delivered-To: semper-idwg-public@opencard.org Message-Id: <200302031144.GAA03373@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce:;;IETF-Announce:;;;, @zurich.ibm.com;;; Cc: idwg-public@zurich.ibm.com From: Internet-Drafts@ietf.org Reply-To: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-idwg-idmef-xml-10.txt Date: Mon, 03 Feb 2003 06:44:03 -0500 Sender: nsyracus@cnri.reston.va.us Resent-Message-ID: Resent-From: idwg-public@semper.org X-Mailing-List: archive/latest/577 X-Loop: idwg-public@semper.org Precedence: list Resent-Sender: idwg-public-request@semper.org Resent-Date: Mon, 3 Feb 2003 12:52:41 +0100 (CET) --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Intrusion Detection Exchange Format Working Group of the IETF. Title : Intrusion Detection Message Exchange Format Data Model and Extensible Markup Language (XML) Document Type Definition Author(s) : D. Curry, H. Debar Filename : draft-ietf-idwg-idmef-xml-10.txt Pages : 120 Date : 2003-1-31 The purpose of the Intrusion Detection Message Exchange Format (IDMEF) is to define data formats and exchange procedures for sharing information of interest to intrusion detection and response systems, and to the management systems which may need to interact with them. This Internet-Draft describes a data model to represent information exported by intrusion detection systems, and explains the rationale for using this model. An implementation of the data model in the Extensible Markup Language (XML) is presented, an XML Document Type Definition is developed, and examples are provided. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml-10.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-idwg-idmef-xml-10.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-idwg-idmef-xml-10.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-1-31142919.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-idwg-idmef-xml-10.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-idwg-idmef-xml-10.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-1-31142919.I-D@ietf.org> --OtherAccess-- --NextPart-- From idwg-public-request@semper.org Fri Feb 21 13:35:50 2003 Received: from www.opencard.org (www.opencard.org [195.176.20.76]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA10177 for ; Fri, 21 Feb 2003 13:35:50 -0500 (EST) Received: by www.opencard.org (Postfix, from userid 503) id 9EA173478B; Fri, 21 Feb 2003 19:43:34 +0100 (CET) Old-Return-Path: Delivered-To: semper-idwg-public@opencard.org Message-Id: <200302211838.h1LIc8K22292@intrepid.cynicus.net> X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4 To: idwg-public@zurich.ibm.com Cc: anewton@ecotroph.net, smb@research.att.com Subject: XML Schema -vs- XML DTD Date: Fri, 21 Feb 2003 13:38:08 -0500 From: "David A. Curry" X-Originalarrivaltime: 21 Feb 2003 18:38:16.0520 (UTC) FILETIME=[65E0F480:01C2D9D8] Resent-Message-ID: Resent-From: idwg-public@semper.org X-Mailing-List: archive/latest/578 X-Loop: idwg-public@semper.org Precedence: list Resent-Sender: idwg-public-request@semper.org Resent-Date: Fri, 21 Feb 2003 19:43:34 +0100 (CET) As those of you who've been in the group for a long time know, we've always sort of had this vague "sometime later" goal to move away from the XML DTD representation of IDMEF and toward an XML Schema representation. There are some good reasons for using an XML Schema over an XML DTD such as better support for data types (which we kind of allude to in the drafts), proper support for name spaces, and other things. (See the list archives for more.) Anyway, we have received an offer from Andy Newton to create an XML Schema for the IDMEF, which we could then integrate into the draft as a replacement for existing the XML DTD. This would mean another version of the draft, and that version would be delayed until sometime in April because of Andy's schedule. Or, we can move forward with the draft we have. If you have an opinion on this, please voice it to the list no later than Wednesday, Feb. 26th. --Dave From idwg-public-request@semper.org Fri Feb 21 17:48:11 2003 Received: from www.opencard.org (www.opencard.org [195.176.20.76]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA17614 for ; Fri, 21 Feb 2003 17:48:10 -0500 (EST) Received: by www.opencard.org (Postfix, from userid 503) id 255A5348D5; Fri, 21 Feb 2003 23:55:52 +0100 (CET) Old-Return-Path: Delivered-To: semper-idwg-public@opencard.org Message-Id: <3E56AD5E.3040304@cisco.com> Date: Fri, 21 Feb 2003 16:51:10 -0600 From: Klee Michaelis Organization: Cisco Systems, Inc User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en Mime-Version: 1.0 To: "David A. Curry" Cc: idwg-public@zurich.ibm.com, anewton@ecotroph.net, smb@research.att.com Subject: Re: XML Schema -vs- XML DTD References: <200302211838.h1LIc8K22292@intrepid.cynicus.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Originalarrivaltime: 21 Feb 2003 22:51:19.0835 (UTC) FILETIME=[BFD6F6B0:01C2D9FB] Resent-Message-ID: Resent-From: idwg-public@semper.org X-Mailing-List: archive/latest/579 X-Loop: idwg-public@semper.org Precedence: list Resent-Sender: idwg-public-request@semper.org Resent-Date: Fri, 21 Feb 2003 23:55:52 +0100 (CET) Content-Transfer-Encoding: 7bit I would much rather use the schema. Working through the problem during our own development, we found that the enhanced support for data types was very important. David A. Curry wrote: > As those of you who've been in the group for a long time know, we've always > sort of had this vague "sometime later" goal to move away from the XML DTD > representation of IDMEF and toward an XML Schema representation. > > There are some good reasons for using an XML Schema over an XML DTD such as > better support for data types (which we kind of allude to in the drafts), > proper support for name spaces, and other things. (See the list archives > for more.) > > Anyway, we have received an offer from Andy Newton to create an XML Schema > for the IDMEF, which we could then integrate into the draft as a replacement > for existing the XML DTD. This would mean another version of the draft, and > that version would be delayed until sometime in April because of Andy's > schedule. > > Or, we can move forward with the draft we have. > > If you have an opinion on this, please voice it to the list no later than > Wednesday, Feb. 26th. > > --Dave > > >