From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:31:15 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04418
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:31:15 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Eowfd008972
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 06:53:06 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08EowIa008969
	for idwg-l-outgoing; Thu, 8 Jan 2004 06:50:58 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Eotfd008952
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 06:50:55 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 15:50:54 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 15:50:53 +0100
Message-ID: <3FFD6E4D.8010202@francetelecom.com>
Date: Thu, 08 Jan 2004 15:50:53 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 1] Duplicate name in classifications
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 14:50:53.0759 (UTC) FILETIME=[D0C294F0:01C3D5F6]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08Eowfd008967
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

NAME: Snort reuses the same name for all references. e.g:

<Classification origin="cve">
<name>SNMP public access udp</name>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013</url>
</Classification>
<Classification origin="cve">
<name>SNMP public access udp</name>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012</url>
</Classification>
<Classification origin="cve">
<name>SNMP public access udp</name>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0517</url>
</Classification>
<Classification origin="vendor-specific">
<name>SNMP public access udp</name>
<url>http://www.snort.org/snort-db/sid.html?sid=1411</url>
</Classification>

I tend to think we should discourage that, at least for the 2 first 
lines, because the origin+name should be a primary key for the 
classification information.

*I propose to replace:*

    The aggregate classes that make up Classification are:

    name

       Exactly one.  STRING.  The name of the alert, from one of the
       origins listed below.

    url

       Exactly one.  STRING.  A URL at which the manager (or the human
       operator of the manager) can find additional information about the
       alert.  The document pointed to by the URL may include an in-depth
       description of the attack, appropriate countermeasures, or other
       information deemed relevant by the vendor.

*by*

    The aggregate classes that make up Classification are:

    name

+      Exactly one.  STRING.  The name of the alert, from one of the
+      origins listed below. In a given message, each name MUST be
+      unique.

    url

       Exactly one.  STRING.  A URL at which the manager (or the human
       operator of the manager) can find additional information about the
       alert.  The document pointed to by the URL may include an in-depth
       description of the attack, appropriate countermeasures, or other
       information deemed relevant by the vendor.

*Please only voice objections.*

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:32:46 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04865
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:32:46 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DcHfd000569
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 05:40:09 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08DcHgj000568
	for idwg-l-outgoing; Thu, 8 Jan 2004 05:38:17 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DcEfd000548
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 05:38:14 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:38:12 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:38:11 +0100
Message-ID: <3FFD5D42.6020809@francetelecom.com>
Date: Thu, 08 Jan 2004 14:38:10 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comment section 4 (namespaces)
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 13:38:11.0085 (UTC) FILETIME=[A8675BD0:01C3D5EC]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08DcHfd000562
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Section 4.*:
 >
 > This part contains a number of enumerated string values.  It seems to
 > me that these could more usefully be assigned URIs (maybe, URNs).
 > Using XML namespaces, these could then become element names, with all
 > but the last part of the URI being the namespace URI.  I think this
 > would better support the claimed requirement (section 2.1.1) for easy
 > extensibility.

I kind of like the comment, but am not sure I understand all of its 
impact, and in particular if there is a need to register these 
URIs/URNs somewhere ?

Is there a volunteer to tackle this ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:33:17 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05095
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:33:17 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Dhkfd001130
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 05:45:41 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08DhkBs001129
	for idwg-l-outgoing; Thu, 8 Jan 2004 05:43:46 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Dhhfd001108
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 05:43:44 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:43:42 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:43:41 +0100
Message-ID: <3FFD5E8C.80305@francetelecom.com>
Date: Thu, 08 Jan 2004 14:43:40 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF]IESG Comment section 5
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 13:43:41.0594 (UTC) FILETIME=[6D6707A0:01C3D5ED]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08Dhkfd001123
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Section 5:
 >
 > I'm uneasy about the approach to extensibility, particularly DTD
 > extensions.  For an Internet standard it feels rather fragile,
 > depending on things like XML parameter-entity references within a
 > DTD-declaration.   This is a gut feel, which I cannot substantiate.

As far as I can tell, this only impacts 5.2.

I simply do not understand it. The process seems straightforward and 
well documented in the current draft. Any insights ? XML experts ? The 
only interpretation I personally have is that 5.2 is not a realization 
of 5.1. Moreover, it would only provide aggregation. Does this 
translate again into "we have to move to schemas" ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:33:50 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05382
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:33:48 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DaVfd000322
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 05:38:23 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08DaV60000321
	for idwg-l-outgoing; Thu, 8 Jan 2004 05:36:31 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DaSfd000309
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 05:36:29 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:36:27 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:36:26 +0100
Message-ID: <3FFD5CD9.8040103@francetelecom.com>
Date: Thu, 08 Jan 2004 14:36:25 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comment section 3.2.5
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 13:36:26.0457 (UTC) FILETIME=[6A0A6490:01C3D5EC]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08DaVfd000319
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 > Also, I noticed this:
 > [[
 > 3.2.5 Enumerated Types
 >
 >    Enumerated types are represented by the ENUM data type, and consist
 >    of an ordered list of acceptable values.  Each value has a rank
 >    (number) and a representing keyword.
 >
 >    Within IDMEF XML messages, the enumerated type keywords are used as
 >    attribute values, and the ranks are ignored.  However, those IDMEF-
 >    compliant applications that choose to represent these values
 >    internally in a numeric format MUST use the rank values identified
 > in
 >    this memo.
 > ]]
 >
 > What right has a spec of this type to tell an application to do
 > internally?

Suggestion: drop paragraph.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:34:26 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05465
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:34:21 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Cr6fd027231
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 04:56:25 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08Cr6Y3027230
	for idwg-l-outgoing; Thu, 8 Jan 2004 04:53:06 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Cr0fd027209
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 04:53:01 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 13:52:58 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 13:52:57 +0100
Message-ID: <3FFD52A9.50807@francetelecom.com>
Date: Thu, 08 Jan 2004 13:52:57 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] draft-ietf-idwg-idmef-xml-11.xml
Content-Type: multipart/mixed;
 boundary="------------000004020109050802030107"
X-OriginalArrivalTime: 08 Jan 2004 12:52:57.0859 (UTC) FILETIME=[5731ED30:01C3D5E6]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

This is a multi-part message in MIME format.
--------------000004020109050802030107
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable

Dear all,

please find enclosed the new version of the idmef draft.

Editing has moved from plaintext to xml, which is now the preferred=20
language for edition. Transformation to plaintext or HTML is available=20
at http://xml.resource.org/.

Mostly cosmetic changes to the text w.r.t -10. In particular, the move=20
to schemas has not been realized yet, AFAICT.

Issues and IESG comments will come in separate mails. We need to=20
discuss each of them and come to a consensus on what to change. If you=20
plan to propose changes, I would appreciate diffs with the current=20
text to facilitate the editing of the document.

Mike, if I'm correct, it is your job to send it to the ID ?

Herv=E9
--=20
Herv=E9 Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France T=E9l=E9com R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4

--------------000004020109050802030107
Content-Type: application/x-gzip-compressed;
 name="draft-ietf-idwg-idmef-xml-11.xml.gz"
Content-Disposition: inline;
 filename="draft-ietf-idwg-idmef-xml-11.xml.gz"
Content-Transfer-Encoding: base64

H4sICPU8/T8AA2RyYWZ0LWlldGYtaWR3Zy1pZG1lZi14bWwtMTEueG1sAKxb+3PbRpL+Wfor
ZlFbsVzHlyTHr9DayJJsK2VZPkmubOrqKjUEhuTEIMAbAKKZv/6+7h4MAJJKYm+2tmIQmOnp
6cfXjxmN//Vlkap74wqbZ6+iw8Eo+tfJ/vgf59dnd798vFBuGqvbX27vLq5UhOejp0cvBkmZ
ROp/9vfG/7j4cHd594uy/WRgTTnt22Q16zvzf5V1ZmGyslAfP71+f3mmHj1Sj+ZluXw5HGK9
gTNFXrnYDHI3Gy6rSWrjIagPJ3aCz8dDZ6bGmQwDLvvnD5AeYOSjkxYXxN7Rs+fftGRrxZs3
ZwOis4v+8ejZ938HfaKzTd/EfbzrH41Go8PR6Ok3LfSktdLPx2eDm4uzDtEHV830whT9wxcv
XowOD5/8rWt3STcc9PuqMaEi7z9/OjrEsOffpsKjttXcXg+I2oCoyYKq3980luMX3ybjTWMB
nd3G8vRvoU90dtE/PB79LcZIdHY60+h49LfIB3R20n9y/G12tkkfdHbSPzx88bfQBx1P/39P
9rHGvwgUi9yVGFe8itamIMz078s8br2CjYfXiVmW81fRE3zxtlh/LEpn47KeRh/l6z/fGZ0Y
91IN4/vC5Xk5tMmXZf83fa/lKcnjYeL0tOw3GGmThZmS3xHPvXt1OHim4P1PhqPD4ei5Ojx8
efj05eH3am7cvfk1MRPt1MWXpfpns+7d9fn1Szzf1HJQmVmpf1+9V4md2VKnqrCzAmzrLNEu
GWAoT2aXvgE8LybGYcvKZrGgtSrnRoHbin9kFQ+Y5k4ZHc+BQanRhWEXHZNA7NK9iqZVmh6N
jp5GNPEDMORV9OBe+4eHETEwdXlWgkhpy9QoPZk4c/8qusPil+dXF2+iE37MSldRvFPnpjRx
SU9Xpij0zEAS8VxneHiTu4Uux0OmBIq6Kufg12a2tDqF2s8Hp4NIFZXLmLWzyrl1pIhpeXGu
722iTgdKvpDCYW06s79rXrFm7so4Z9NUvV9n8Tw66fxU36mzfDAeticSIZ0kMOECj3vjZQ49
pPS4N4YhGVOenOVumTtdGnVn4nmWp/lsrd66vFqOh35Ie/iL7/HRmMyoW37RU0dZot6kee66
42Nbrk9+Qq5g1uoMz+Mhv1FjZ2bE2YefxkP/KOPzxJyMnh2PjjCSnv3bCgpYn3y6pbfyTBsZ
NjsZL+d5Zk7+6xCWe6iePkNYePpshBH8mgaYhbbpSUIy/lX/GpOIf4TJx/liPJRvNKpy9sS7
/Wq1GsiA4XhI7yHGYZAjHlm/ZENbmn7X1vM5OUxbz+/Ij5S8flDJb5wmN7qDoYOD6KT7W91A
0edfreYnR+qmgluZAlZSlRXG7tDXmTaZV1SjlMMnyAd2KeXNzZ8q5fhYHanjQ4VU6MWRenq4
rRaGlgFDy49T3mkpGx1M3R+oZ3PoVyvq9eC2rao3xmZFif+01fXaZL/phc3U7UA1Ax5U3N2H
O4AG4KI0ifpgylXuPjdeZU3RA5zEX++ix09HI3Wls8LA129ynez0zNvKwomPSFVbej1Nl3Pt
TFnqTTd8e7rDDY9Ho6Nvd8OnyKuRvvW/P37y/ba+J9NakD/qeEFB9Q+0XIowM5El8Hf+V5xy
M7JUy4TwjcMKPeyOJfwp0etX0fNILRAaEH9/0lmlCarXRiPKUGiM1JAQ3hl9cmuAJQxt/HN/
TEzOCDpPdoWNrXDRDN8ffzZr/ExObJiY1BPHw/pjM6wISz/wzez6YjwHu76FhXd9vDy/3fUa
Ub71GlKZwPJ0TJY3Ljl8LitEF0g4n7L4vyKa7u8dcBh+jHSflJiYqc1YgZoUiBGFQkqh6j2p
pctjkxCwsYILGLzNZvt7NpPhtBbYwD6RpxSlpBxbwmaa+L7M4W6qWMP8FkVvf49eYwZtYqEz
8MvJif+uVnMLc1roNZIfk3jShkShVrac07QF/L7kpIkkgz1d0ghYdv+cEhVC5tjZCbjXsskF
vC8lUs4swRAt19rK/p75grhNSDNZ79xIzbuX0jLV8DvegGMKOjX7eyQpTMxm+ACeeM2BUqeZ
sotlypsMkvP+U3MGWMSb/b2LL6XJCjtBDnWl3edqqd5DHxWp9AAGwvrzGzAJccPJ4Xmd392t
lyByTtq1vBKGJ+bepPlShhPzmpiBZByrGXHcJCJOuF6wufHQZ3SwxIVNEkrF9seFFwfnZki9
8uwey+JNoT4VkB62weqoGQK8K6W8+cK2FRl3oaKrT7d3vUj+VR+u+fnm4r8/Xd5cnNPz7bvT
9+/Dg4wgSvh9/em9H0JPzeSz66uriw/nMv/q9Bf8Q9uNrj/eXV5/OH0fiYxtQXRCQkxCgFVM
jNgYREtGoItgQbyn8RcUHKrUbmZQLKA0ocokOsGDoqfxkL6fiBBlv9B5xB7XB8QuU6tprSUe
YraAiBSjSfwzpxcKdlM/0nBgfFb2iFJRwRM0+Sb+r9P178BgDBancT3sR5cwaZ2w+yIUqhWA
DMpdCA4U4J7okLWJtatiaWI7tWLqYqdmkXt/2mA+yMnz66nKsjqZk+/XjtzuEDHrO9cRG+T5
eFPDjYxZ5by33Pmagai0ZFbAlTxbng/hKsuxPEKTcQvGKl1z31b0IPIW7i14hzETnOZJxe+i
BnS7un+4KxbtDFMP4LHycOwtB7hasAFmiQAe7FGHKq8N0170VZnjBxvnFlbt79VAGkMUVWE8
7AHfFGDKEdRPkLUqc8+NQqYIEa73EmMWMLliaWObV8Vgf48E4PGD3YWByzYFaM3Vigonk+kJ
wSB7EgDH6YlNEVaVRgIwI8teGBcjYewpfAWmciegVwcJJAUw9laQSNN8RWCKLTg2s4X90sfg
PlaM54KgZpnm64Y104QZEIhjoA3DMZuodVTvEyu04sroz2qZWxYBLG9SAtLJePJlaRc6xT46
oN2JOIhbyNUw6Z4EpRAOYhZzmCIBmo2VVdvgPdlBZkB+gjwMtR8tuTt0en8/gE1HAPwid9Fj
7z513HQI7PQ5hnvkqcF3MCHx08LVYU9QdqrdgpzndcVswb0I9cRrmHPIasXvG6bJdGCEED0S
+JfN1sepxb6Lck0eU6wXkzwtIk42yxNYLISdyj4nOqhCLAyZbppgZu7XgcarFLJHmFkoDQr3
SDEMrEXSii15LMU5kR4woYX+bGiPSIgkXMISQYRFzKIrbOEtiyyfrABxzd4jLApmYXcwUbJf
uBHoRxx/IQjIUcEDqKqjmIEd6ISY+g3ZM2G2dmxstvzBi4X3nok7YZsOibBuJQ3t7cMkzTK4
4TduHZzHekm+hgmY7bdBW2TwLPIlfLQk2MTWYgcJ9dtskVTkLSbDcqa2zuhincaVjGJcgDNk
JqB1ahe2FHyqVU2rC3MdYSiEMvAAcuy8Elun7CONLBJbwPrW/6EwBHTYonipMgcJ4I0tKRQA
lXyuFabJOrWpIsjDB2sMYjRXc7sADUyfS8WDssaRJNI1iyNspte2jgLqdzr9gSh1REGwRxsg
wwzpdQ2bHVNG9WR9cy6xU24AlsxIU98W6oDRsKdgbElODyG9BieUoKZ6BaGASMxA9FgkgiAp
OwgsEEM9NanIGouc2awythkfHmwpkIfCkJz+pIt/ieWjK9ETeJI6oQEQSt1rPyN0QpbpYDvA
GQpQ1Glgn7Ql5QWoNVmIDyBuESAxRlH6KmL+ojpunzK3zcrnJOkryqprYApdyE7GzVlVPvkN
xPs5TI4y6qY8aCfqoMJGKtO5eHig3vGoXHTKCIKlLVgvBsFKNrcHU4VJL4qww4/+hTqVAr3O
qczmXoNymm36mh768RaqavLIK4sc4Zi2TXUVzQ/bZ93sikpBDnVQ2PvDsMBf+d+9U57aLiA5
Ms7ZzmGZc0Npw8xkhnIPpW7zhQkJizNCRApXYZgOT9dApZI6zi26vZA2Q60zi99I5rEj+Sh0
qCXlc1G7CBU1QziWvubY6Nf2NZJaEFECWKGwc0EKNbQshO3ubUxNKq6kSQE9Bqgdk4kLeCAM
XqkN7fn83iulkPplkwI4g/DhZ9PUfOFYSAgdM/BIH6ZGE/HKwb6QGN8XS8LkSaqzz+8h1uJV
dMgdGa+wbfcIrgNhVjAmBpRQsd5bxN7ZzJmZr6rpf7y7ahKnMDdYFfZ4OeWc589KYiac1Nv1
tT8dhzApkqexrCf4QmtVln6zHonXk+guyKJNcjgGYWOFzNtxVuuzSL8tglxKboUErAgRhZJz
L+XuNFq3MJIdtNTj42fXgL0DN/sli2/YZqNo78pboRCpZS7pNfI9SlnIRmB03H3wmIvolMXr
WrayjDjlsNzwzssdzm6ye4t8We4TUM4YDCm4Z41m9eZoqtJlqePPDIIygJjybUdVOj2d2vgH
SUALLlC4WCi5wcRilrwpzWfsS60aEJVPAlMADZu2ZUxdFp9G5N7FWB+aeGRueoLbgSVami2q
cY5OQ4j54AIFhsblDZkJpMplQiDe5uEvutWGi4tBAJ6rJZdo3rp9odfyYglEJGXPcczlvQ9K
wqovtZogA2/LOGW1lNhxx8BTwXa838lcAUMuc0MoF7QnzQcMCqYrVMDexCMrkfqALfXUR4G8
nroVFBSI+0Tpmd/dQ1Z4Whc9nOCSeVuzbXrnBuUjF3Z51rDSstYeJ2rUQaQMjbJAjTgxm6Pg
ov82tRUL2buWt+HteEJCpjxF4kGPTVIybe7tmC9dekKGTWau76mQhxdDgY4gj5qYwrRyVZbR
Hry1UyYWQk3exDvYW0otqc3ouR0sOAxw1dx4QUwdOr5iRHBVt3qrOoXIEad9Jcjp/s52gqC4
t6heMI5WN3paOakmRfE1BjHPW+HqP/STFjD7zhNKTRsjk5+bhfZuQ0LwAtDOrYmhCbaJrJ8U
JhVQrTvWKqR50RAO6Qb7H9CnmFPdM3d5NZu3owvbgk+jvAu0ItRDVn5dw90fI+ymmavPNkuk
5CP/9XgKDgJ81rZE+u0FGF75oJVPKECQLWWJ0JDauE6nGiREiUBdYOO4jCy2Ta2YU+XSklGD
UUWzidj85Vzj1s4yi7BAfVJJYyS2wfWaAt6GZCzETwKcZj8ebzax1OccSWKlVa92JE9dgfSC
kqmXChyZGFVHbrYwSU42Qnjt+ZBlazGowVl498P2cBY6Y76s83kXSqxtq3iDz1QiU98JuFLA
Xn1O60tC5ncFk5WDnpQKNYErzEzhnp3tS60XwwcQ13zkXC+xLkzZG9DXOOxmwojY7XI6HWSX
lAS2o2BJXgKIt33LVXRM4fMaKfGp9p45X3U+kNN0y9W9dst3R7E1y1H+hkqrqafgfQVsUr3l
7w8UVys5KMA4aYvU+N3q3W4VlETJVxbSb6xQi0zsrCKFTnUxDzUBETRuYUvfL/ONmbldEo26
ffggpPniOxxkDJqCbaPzfdOu+i7upZtdmyhtmYS069Cq+JpN74kCN/LiP+t+ikcW3DhAFN73
QdHEpdTvMd1A4ZtSnMkgJauyqqjALxdzB8VjQa8i1JLizkzIyw5+4UVHpeIG6HYyES+D7Xgf
c4gvWmeTe5umtyX2s5w6/nRkCRfNuhIXq9ot89jPS3geb49PV3Tms0aEIKYlzigQYv3phu/f
tTC7BVWeco9yXREQQirMIm5DugqN6zpy8vrST4FAoS5CcbIZ2HERVF/q4jNtSPx7uq6rnExz
65I0UFGWdF+lWX12QDIHYYrdTAewS8ctKDuJIcppS6bBnQBgh0fNxtR3OG1dLbf8bocMBZdW
ppVLNIWDeFYHU2HwsS1M0zWtz6UO7MAMOCHtEGEz9KcyTGgblENPmWl6eo9RjQilJOeSRBI+
sjvvjKRk1qTTiY3L3K03k1k6aRPleXdihKizNq5rZGHPu9ST3MbcWeHud3IJRGbOtRpx1RIH
SpAxUUzM6OgKuC5nWGFdpsRnEvM8TeoazQ9o9+CAGNyhJ+++nlJH2RXUkA2Ftk5Xel00xwPc
sCu4nEE2FNUXF7DpaKfoxdzupS5skk41tSZNGiDwWXloA3tW/Sg+VWFKlgSQojYrflDzfEWt
ON81WlKmRUmLM6Q5OQfsHp/59EaSLm4/3OecBBEoEqmwzb8KPTetYKJee3+WCrrBoV0tAY+h
/ngIJpYVCFAc6cvQYUzpxNBnO7tuZ3BB35wck1FQiUlt6Z7058WfGZ29NnnZAzOYsT3mDZxL
FOkcKnHuUnf4dey7QgKJkip7P5jXR1RNB08jBnPBRZfM6uSTj9WIJ8F6H2ZzKkcCS6bbhAon
AvUxa6wr39hpduSBhHqedGk0edwFrtOC2eptxgD2pybswtC5KNsM/3VsqvkygaU6Zwh5gnjm
dO1F2/3u80KPAs0Sj0Io2mV23R8de9y0xs0OPl1puex060Inf5VvNA6DK8rUlWFMprYvdych
JSpS6+tGoHJ5/vPbl4zQVShUb2s4IWJXzY2kyxYwHNxeXfrDlDqlIoS+/XD1UV1dvq4vNtQH
q17Z3as5qrmZAzIH53fnjyVJ9/T4oref0Dog4BBWmGYzmyLgXTtzb82qKY1oo+SVlmH+1ixL
ucNHfw7CzL4xE0cX8uia4wixzxAaAp+o18qJbcwgI7cDQCKM90PDzQHmu8jTigVFcyd0Jwwf
p1U6RfXp5eyl37kqsn0M4o2CovbDt6E6GXn3isauP76JTv7sYlW4ibG3x1dd2AXk/krdQPGG
dltnuW/ZbVP7O8Zs0bx9C6JcmIHWGpr6Ihfp+FYM5z4lggqyAJ630RW+vL1Wz58/e9Fc9Fcs
Y4ltM1RqRGBFTasl3f6hSk3uYQmEpTUbtGTnTIf0vs+JFB8D0qtgcPyRYcanvjVsi21rue8W
9MyusCf3IMIZq5ws1ac6BLLvYPfujva6JaN3d5ARhwnaHNkN/0UIN1t4H87wpRGIgFf00vk5
dwiDPxP4/Wwm+1xA0+2I0lYLdQD1P6YNBGs9HPXI5p8P2gdWIk2+0lTqIK5+f1N4rdxI/Lr+
WmDwPqMidQP4EFquabWa1c1FS2of5qvMq9trM5TEHOOS5tIeJcmA+HzBpuVNpFm4c0Cs6mqd
aXRVGcZs3KLimCxf/Xk4aaLngV6uj8hFERbR1H4BG3XaJ5HChv45G1fJqTPBRwg7ddIX6UQD
epKosX/vM5W0Zl5TssjyAM/ECH1gG039nzIelHpWPEY22lqbGhtyHQFW8ei7tPzhERP4boYn
uSbTNF6I2oE3UkJ0FfGV9Ef3Oq3Mo+ixvxwjl2AiIrYkOpHyWSTXBUQkWmqn+XIDXyf0Yis5
madBqhlA1xBh+QWqeXpy1AePfBoSIcWF3qqCqfybiNB1etDh9jS3jbO8lqmSjma3Nt33Ebnp
7be1PHjwcNZ7fcjyFL0g93wVfbi+u3gZsWvULXGfybcRDGEh5cvAATiYkrdSPu0L0dTXD2La
1O6sNdpVT68FiyHVyF3CN0dUsMc17dDQIUY4MfWKbvHH8+vIrgPA0jlJCKzQtqF0zDTwS3sS
/2ACaZ5/Vlw/cRbReBJ7i8zq0Wk/MgyTc67ExwHZlFqvknUVzV0szx7V7qAHm4WMfVMVhrWi
fbbu4TXlLoj24EPCq0jAcUZbMVusnPo+UijdaqDo5pLUNmTFSVOV+3C1RKiklC6xX4cvUxYq
AptRKD+iTnYSSUcGitOf5bIAT5RUNsU+C9OkREROaPj7myzATRL+xqiIvD6R9xbDsz0OdI3H
H+TWKVTngmgxeKAp2NyonwS0xop1GJrmBM1NPN4YRndAoGsWy0aIejgV6f4tLrdNqYu3K6Sp
Jp61nMdfceIzBqK1lJt7dLaykTjylXN6FcYJkMfYlk+yaiKcoQRc5Q3rHdedj18ghfqU8Z0f
aPfG/xUnTb4MoKwOPt1c1okUmPiZtCuu2DDckz8WgSZ9NtNavL7d3+abzlwXRsJUT4U7oWQJ
/I7DXnO/IazTEGOn4A98z5Mahu2WQ3NFmEiRm/gb8r2mhgzXxeXmWn0KzP73/+19aXPbyNHw
Z+lX4GEqsbRLUpdve72lleWs8vh6LTmb40m5QBKUEFMAQ4CSlfKPf/ucAxiQoCTvepNlJWuR
wFw9PT19d2dexI/HeV4OYHLmtHSSOcrwzgOcsSy+Ym3Rq9Mj2keo8QHKnk49/wiH5xNc8Pa5
6EbG1ZpRYziZj1gvGfkcBv4C+yUi6FxkJEcQVC/sNfaWof71PDUo1VW7oCERdGEYSQ73TVxi
CT0NDw9/99BfdOQxKkTrBol4AI8iunsklIEdvQkakfgLYl+wLLFKFsjN4Nrl2hmi4y/qMZG9
JQ2LuMGhDj6yLofYCytvusD3ZHFGVplqq67b5QBRHFWAQ2DU+UABCUOKMOOLagj87HxCvigJ
BxmgorDIx+UlG3cKpmWk+L+E498BzuCsQze8iSJlYhrkBdHwiX1c4Y2EisAYjXZdVBOkwy4z
6TBd4hFGV6huxacx+ULn59BqgLcddg/8SprTpaecOM36krls/6eY2GG2KfKGoS8i6jtAaClF
N8TKl0Inn/EukeNHlR2/49uF0CmywOMfR6d5DmfuLEclmRifUf3joMoTw3XSiW7ZT+oiplUh
sMr6MplM1BOsK361cj+p2U2An+dE4vAcVj3AiT5yp7NkBYc5RzqIRRSwYomadfQoeNemwIf1
qNZA74gxjV59ZCYVb1AxtjMTYu06qGmC4Y3xE52CZVrGGwtnMCF3B1RIFIal0tABQ0s3Otpv
xzHqbxIrjJ2wObOnyxPGDpjKTpZnvWBbn+U51hPGbg7j3HNQ8K5MojVITQCE8UWcTlCeY7Oq
0nkbvkDI7EQwkEiB0HsNnc3QjMcD4mv7b494+TR6PFPfri2y4k7SEdvtacORtdOxQ3RpzRx7
l7j9Cdp0owP437ffdqOTIcgJb5MZ/veqPFNT4h9fv6ceDs/jYRG9TAuUQX9y9AdDBAspyWjq
xAySX3I8wngI1xVWUXpwpU7VBhlBLmMnZh71DH7C+F8gMWMgN8nM3x+2+OLSUaFUyPF7Z5VD
0b3+Dr/UOggH2CqxhjP3L+E36viijgE4K36NqHomF5aJQc5Q/zs0P7AqmwzcpOqydk4a2ukX
ttVw7yTGvD950XvI/k/w1859uAKG+YgkZfXkODp+s3V0eBDtbN+/ex+YKMNmvZpPyhTISe/N
sEzEkeYgR53cgTpoRMeonum8PziW2BBojZHGAoRz5qzR5EEo5l6vG8KdA2SRusUKkQVha8B8
4+/wN6KocliFWoe4vXEesUtt60HAdK/IrfzpAtYKiWhOw1CMZNYTAYGcgIquhbshl64EqeKE
1VwjY4whcyUGATC0HCggNhPFIx0G/tF5zY6vVot1zDPsqJqQPSe4Ezkfjn+CS+GbsX53/XpI
H8R5UsQYOKYTdOuRVVacTFkvdacQNws+C7TLfzl+2TWXAdxZDtmXe8oEHNL1pHaSAWo1u8ji
IHOkIahAcmZk7Rn5BOFNdpob0uxEnQEYyZDdVb4d5CqOZZ0UCSltutZJV+0iVU8Ue010nQAl
BgtPi/gSvWaAQkTjJKbcDuw/ZG52NlmS1sZyDSncDiN0pp+wkehUA4RhFO0HlZrEV9RQAZ1i
ZgktA52c8whOHMw26Tp/QzeJcFLw4yy/iidoHw+KuI3Gl0UBkK/zUuhg5Ab2kqmAcIk5+KKY
J4UJkHRv9Dn7rcJC0DLNFOMxUiSS7sitBnt4aTmZdWtL8W1cXeWnvOfC/s4l1FjkE3OLM3Bc
FYMf8V06qXDYVaNIJhdJ4YT27U9JxfYp2ndiyHkXzZJw6GKO7geIWhG7aAoHOqO8QUU0z8bA
ZwMBndmYdY7H9D3GjfAJ3ENeItk21mHVBxXqwzO1YhH7Ip/Dws4QqS+SJ6wewhCfdTh4F8lM
rfYcTWzMZHYVcyeOxA0YQQHWbCkTkTCAiFKbWHi1LVaaiuMe4oyACO8TIqoeB+ayNEq5hGdS
/SZNktTdACZRJFtXRQ7qPMPoZ7pjLKvXdV4qEkGTdctN1eKMNCDYGCOfG62XiSjCIFh53SKK
bRGCAvmzwUa/yguK69KAVfZzw23tkOEkZW05ahrZT3gigp7TF4yx7uj7n8BkksjZm7FGUjN2
LrSyGRPl2xmKmh3jG6fdf5jyA9fmJhFsOcVyBNbNTTj/gBNJLywkK9hI6cfzKZq902gDrILW
8U/wQtQL0RU4MeXi17CIoaG+KAvBIEF7PztvikLNDsqUhd4TLsTYPeXaV1kBThUGR6hM5mpb
lB2K+DWEjZO2wL8UFs05erX/V5Y7SRjM1UOwMud1h72d8InDoBDypaQj0iXXLwrC49hAUscS
nRUWgpBcFPzIBYlLkxNOpf4PMSkuBjNgBZLZptqYjG8L/P36zQn14ywZiCH7o5bqUOL5W+Ne
oGPAJC+IfKHujG0NPD1gVNQ0S8yABa/1NW/pDyORgyfP+aabRG9J4xtZ5abvnjfmt1gv7NjE
oo0Xb482K6GQlewc8HESdFROh+juAGCPPXzw9AXJ+bS8kgnhw05vCwSIkxdbW7gCzErxF/jI
6Bc7/e2trcPXHet3XNGFG4IGc4/kLJg71r2kiPi6KKbeWXxgqC/zrqby85UrOEHP2G3zQhTo
VX6Zue4mNTKx+n5W/S8sHTFkjnLZfYCJ4/IqbpiNK5dMEx7NqyzZkZWblq1WF7HnJE7WjJTd
CB3fWQsNNEqugB/8xxraNU16WSYwmp6CkzXKeyqlbWnDdviFFlMZcjGmofRQlJY3MV6ujcBO
C2O6jYXLbzh5HvzYJyHhHA0eBmFqEPjcDvA4S28j8LbQK3kLhOazrTLfgjltcfJEoWKU1PfL
wi5mRb/6g9mkF2gSmhpbW5OrUuVmysQ0y3pIUmJFG8h++PIqPUgBlACKTREeK+eFJFMxpoh0
2bgOuFJ+tJxxWrhRsYUNHmFVI7x1hmoturMW3f9d1u0JrgzgGrlMR/iDeHXDfTk/t4Kb+sB4
iZYxCQVl0VC3GTGgI/cp9ugNE36PLrrxTKys3jaVIIuMnYB87004d3ydWyKTVNWdxs6CMSDI
IrADV9fqeLrYKcekGd9cUcxT1DrvwSnKb3Dv9vJxb0BysZwkhxOv7JK5zVAIoV405kgs8bnN
O2AUBRtkgVNVGrlMF4ZIklDPmzmjZ8SYeWpiEaEyywA1Ig9rYJGhrpiH2QYvCQiQpGfJaV6m
cWmSeBE4zllTxPOZl5jMgO2HcHySqKrZFlmOBTiK/UPTUOJFGpXxx4R8UN0B0Z2A/VB1ULLT
iOhLe0SeJrSF7H61JhlFDFTFQSFznRac4D2yPxrfRKDmGvmPZ880EF8fC+6lDp4B0cLqKCmq
5q1VvavobgQKtLpS3IAYbTSuaSHrHtkMYMitsK+dlf8VIM5bA+HB6XZwpUKjqDTmKfa5rypv
YWcPNK7aJqPzdMIgx45ByMaOLENaOPeSMA7eLLsyUkpJGQCJRjdx4EGU3j8+ODry5V6+CawD
v9VO60SVSrtqYQl+U/sww28FL4u3oonwYVQV3ey2qJrcymRkjVNQ/3AFB+sN3T/oTuiwz8BW
+Yr0/SxLPkWHapEXxbgVkn9gCtT52+G7N9FPR89PfgQk6f3w7nD/f6Pjt/sHhx0LP4LM7z69
OHzxYrNZUrUYfwhcCeCxSePsetWXFcGP6cRCTFe3nIS6pZ7MNcAObXQB7/f3+rv9nU3dXTP9
IrrzhzvdqMt+cl34dsr/du7YPb9z5w50Qw4PvX/NgYBt2vgCVJELV1t4/Ur8edeQI4xMIELG
IQl8nmE+52lhMuytJJr9hCodEKiRqbI0xMJzHy4aUdardxnL6aLxpj3+dD55THxZx3oOXYem
vTSG9xoNa0OqXN1BzUCxzmx+OlPbBOuE5Gg8wffUu4quGxGZR3g7AvL7LnRm1TiMs2gjmpb5
tEdxGgo2NnolrF4SYxCTQgNXVU911OeqziEiIMaktDbLW078DgHnMF6Vkz3yDRmig3aryf0n
vM2VBQc8VhYHIzhJhJAPLmpyIjz5QFpIVQb+5ArB1bWh6Y0Ul8oRJZ+mksMHbvYOOoF3og3y
OcinJlShg0kVZlcdYHMA24dJZPyVyWvcUQQab78o+knScZH5A2ZY0YXYrA7Wd04JhUQ6GwWd
ow+2+mjSH10kVzbjYzwS6k4MF/oZkIqWutAkLlMKQTRZgisbwxA8xCdGvavsuIwfF9bzwtWm
ejw43hKhDXiiOlb3bTxWBae5UOafmDtfRAxoFdAsBlTPQQn9xVAB/sGFcTh9RnT0+uTwj4fv
7LIpVwe1xr7oZ1XGONfjD2i22tlGJwn+8753RPSxTMwqxcQ2k3AhAbgQtu9EmtDgziP2nebQ
JLb3c6mBLNq48+0dHOxO786mRJ8b/7jOzu5eB/7p3b13vxOYxv3rTeNOfIdJmPw8vkM5EJk2
wnGn9CCYoge29AI9rUoVBzg57jCxCQKwI+e66mx/6tRWsf1pJ94ddFr6tqGL02sqo+DgATo+
fcjkV8UFenVjPMmJu++R2L3ZAjOAA3lJaEFQYMygvpbghLcD1MDlQIlky3l/++b46C/QYnuv
vxN1inJW5qNONEkHMwyYGM8zWvJj5qijZoTwHGXjCP1ySH1CdTXQTZ2jEuDworaUt7xr+gNx
WIR/FkfQ3/qTw3OxdFdBSkzUTIoPFEfZ09X7SRMfFWKauJPwbA+Z0/EmXFla11sOKd+MEcVd
Qd1RFA9C/+69ZHuXjsO9+w+6Dx8lve09/1QsVuq7txlpJXCn7vTlTHTvMHx8hG6Hswf2AGBf
x7Q5DvZif8WH7APw5w76HjMr6BjYlmLuwY/77/YPToSqOehLnizhrmCbPmao94WDfIrGl1rX
ys8cn7w7ev1Hh2C6sD3w7ICCf/SqRlOoxbDhDulWZD8ylkr+8XwIBEdxdu5ywI46hnhwmo2n
B8NXPzDj/gHL1qA+jOYYeA1PtHlp0zde1wyeLTcfJSZnrwf0Vff4B2IzxL+1CG3pD389OWRX
Ifzr7//YbIC/21OARKUk5GGcb3kl+gcLQ3xr3ZVpipBCMQChdhA4zNAvj/Icnhi+jdgO+4Cj
qBrQ+vD1+1d22V3JtUFkhpCGCA0pRTFuOOWAOFbMkC8fhRlRiiHkc+gbsTVI8rKP66QgpLtD
w1m8kD0pCeBBW1hOa3dVUbwrcqK3MO2CFzhn3pOIuxELeIo2YgMnJokjTjMggSNf/4qmR6Zm
RI/CFI1zvRo7peeHUeiQ2N4xUpLbI83ecHuMTioC48SkaeSEDqQSEOWlM1+GGMDkJ70TzP9Y
I4mj8kMhvym20NuULVKeNKHL8/2Tw5OjV4cea3coxstRpRe7iEKSC4uOlTKXcQglvv6E4+NN
birUKMttUZGSwvMUqpeQr6dNi+0qhI6O32AXWL7tMYUEVxzQtLQbPiOfM7XZUWqDS7oWjwXC
zlFOKQEdLBJ3veAnOLRa/k0ANwa9mrFN5GujIsxjt6yl5jnlYVES5Cxbw3qKx2JpabT6YGd/
hU/v1ave8+fGIqPqLXFW5GhBfM/ap+azHjMJVOOkG716pc/Ky7zHT6gaCnexgWX3doV5ff7c
fVe6GcVXEb61t4Pc94aC9x7qefo74u/YOaCw/NLBRpb4ej0OoR4lmqm939kU61I1CRWeg1uA
29nZ4/Pzx0WxGGpnZ3W4nAH0YK3bvd27AJHz8wDk0gxolYJuu3fvkYCuKOovc4gWdXh/2wUe
t7/X3yMIRisCT9a0xJHV6v/P01EmQZ0FJV7xRwGSu739mP5HK9m9y1/E45hiYystzB6Z40+6
T5+35OYuOe46kjwAyoxaWbVoqkTla/askmZkFTCwNYud2dJCiTpSoXkmmoFJEk9lw/CafJsX
Kabx4U7ch5LKSBLHqIPP7t7je4/gf3/zQMjfTCo/l1DDVnCb+9t/Q2sN+b8Cl1gbCoh2mlwY
LlQiU8/TQhMCmKFRel/G3nMXyuN7i158KPf/6p9JLvCHkV1Y30aEk/FMU52MtdvuqqdX/lrT
U9yHk4WffFaza5t3ukWhHTSc+f1CLVIk88OcsgT1uJRLgpKXaA4jsxgWNWOCUiHYjBKZEAK0
pDW02qTMiT5IrK89EhkxehIxse6U9jL16CxSiT2ls+9q2cGrwC/a04j20mBpIz9JMJRBBZ1g
zcAvo6CokuLmSufTZPGQ4pC4Kt4oTWakiEXytUmZjP7Qcipgc5EfPdXsSRhjGQ+vkIRyBHgH
KNrONn469KW7QzwEFejBRx3ph+MQHM3OkoNRu62ck7ERb3J2uZHJx6ArRe6I++HiHAc5cUTE
MNvwC+IMN96fHHBM0sag2p8iFeuzNEGaIUtkITaqb+LIcMHOYNzcH9HsXXOEmHdUGRJkODsI
AGTAUfOcNoDsDkmJMtedv93RHkSd6zKlNbKxkHB487GE4W91muFRloXPgar8zXa/Zfv3SQsw
Au5Z3aP7fPFmuhe7duIzR96AztKOxhZQqIw/46Rf+hg1Qv/CzIMAUBgInSLvfGugTBQNW9Fu
mIxEDi5ifnGE/hM0IbsDDRI4XGau2nXvTlTts6/vvDCuYoSEpNyyR9xMeBzV6KE+80RQF8FL
AzP0NECkcyYQuHCugznf0h+L0KO39I1+m276bXrqtumpqz21QtoTn2IYUBrWznVjI5pvNkq7
kP3qUn4xxRi91Kx/GGzONqpJo44dr+MgQOdbYpaolJYlu4LC1avwbn8XDthLjIwzxEPJWoUI
ksV+wVHk7Dn4MUz2i8ZDqODzfvUkvrrAyxk5iQD+M7cZFDjlpYLRa2WcDJREntxx3FJJxn0c
Is6NXJSVIU8W0MTAW2HiGHix2/bFJgQOvNp0IMLzXKHjBYctvLQV+q4evyZW1EHnu9eQ/kzX
67bnStaGYn5+HmMsvqk4U0FOOuNcPI90y5kpPwJISldBCRg1ITWGp+GK3mpuoeheF1mti5b5
GF6fvKVDV5Tx+dRRcmXl9ENpf1dFF75uf27ScsFbxyf7r95WFaMicHl+7RIiFaqkuLO3fa9B
JY6JR7b3SNVEF9t+FnlTY4P4/bu9QYoFPCQNM2WrYmObXHfUGCmuWiOJj7Vl2cbpDA7z3m40
SEtHBeqzvfZ1csCVt60PSUUna/WxFWhWdeOiFdjbxVVgT2fJp1ilCtXKFgmmlVJ2TtI0EM9f
tcliD2jQ3N27e+/+g4f97U8PH9y/d3dvd8c3RR0nIpj7IEeMuAQMox0xMURe0dfKJrS0QrxF
OeYl2uUs+qFs82FCvykM6TX6qQnt3r55d/LyCGAY1sdrgm2KSI57FnCqlhetYbSBfPxFOppT
Oni24rP6nfWs2MvG694ryQnMSahfG1v1K4lXw9i7TTJDojHTq4UhI9F0TLeePx0puyXFDM4v
tJf3erv3unsPund3u3f3uvf2uvcf9XZ2HnVhh3v3du52TNHRZTsA9++/5okT0eLsxByefUhH
boCXVAlE3DT54OfchZuGzYaJWD+foY2ZJ/1Vo22latDzc4KckJXAHYyUP04ULppQHEOilNVI
JskFytMSkaLeS5KDBDUHZBGUxYgpwWFbV1U4k7ulqVuCnjR3og3/WKkDLpv1zFeAuF0AOo6K
RK/MX5ephVQRYbuRFuOT6cdUyI+E5kotHqFWoXQfTtWJVXL7h+dN1aDyUm2pWr70dJIP2FxK
E+2qCsf84mZ2XjJJxD3jIsfitkmjLUkcic5T/hL0AcGs+bYsJOe7tj7QWufArfyzuPiRdZwv
NWsU7Qb3g0O4sFmpwEkyjjFjMW9uih4qna5W8GRNQ2JTw9llD+NMc7SvafrgwPlsVJ8gzmLS
l270YwLX2wB45W50LAVZTwhtu1LNB+v22Jo+3N4U9nmRov+D1KWzdX6ORupTVj8LOOwHeupk
6/DfOdM5Oe9VbipOvdL8nP9dMk6G1uTGLrBcW/NTifBYMoLUgWvuZgwARCLT/IZU8KsNVGeY
cMLpyL4IpIZw4TapjDI20knCNbX4EJsLVdF0JepSnapMxQQk8lSMI6E1lXIflduXXRokmxkH
V0hKCKpuYPvhH0Vz8kYqJpgoi3MuVys5/XWOPLNK/UQEwrn046eRy8yRdHMInmHmXIAdJleT
SqA0pFYKWKNRulKJINgJbZP2I3jidKV4wl4t0h07+i3rjHQONDMjK9f7j7genjcA8jBcDeqc
Io4qaiOnKEB8ZaoVWEos17G6qt6kxlodobAoJ4VZ2fwycZ1oShIFmi1XU5tM2L3Y3f3C1pPz
crAq5lNGWe6Fwqo1GYrVMnjXKWOU8dCVJ11NJLPoVLa5QLX6oChFkGHFBCUSG8ZXuOsNRTPh
K1xGwwx3X+3F1pDds6hG4XOglyRuQ1CYvJoeMyheiaweZhal8NymYTktwsCun4nl5KxezJYO
LuVCOHku2VeOlO/m1t0qGa5n/6hWwV0nk4vk8HBldcCQ9xiqmaLC4dy0lxQhs8QW4sLAD3IC
ORNjnDMq8/yTWCwzTG/LM80Ppqz6+lrVF0TWKSOpyIBOI+5IWhFnfY2SDfI4cBQotUhTVg8H
om8u8HZOLt06wW6ZJc+SM52BwJdOg2D1SoClNpC9dtefUjohCiGg1z/kOgVWb2049YzklOSz
arpkLt/OZTc2XTf6Ey+ug9gAjrgwcRMmKi4t/CDmJ5pdQT35nRQQsSmGZnC8MgrHUbLIuI4x
CLRjGO7qio9mcAnyfKI1Oynxt7J8dLRFl0IIY0IpnJJsio4ySZ6ccW6jWCQTCHGmSVAIOawm
AysDOoHiGo7twJOlCVvSqKSKO47F1C1PqGZRjfFBJCXfZa70YYu3SP2jlFOaWg1f1S89JqUD
EBfqRfQGfqperjMklDMunKInVLktiikLFdrLOZEc7i/hYmHZCr67bVkiclYxaWAxcWZh2mtF
uHWx/tgy6sSNuz6CeUYlRW3HZxTdi5mgpYpe4mCb1NGhSGou7AgINKoVPsF6RnRvMAWgePYq
eI3p0+4knzuPAHB/9vSpJmTREeWrBtAU6y4+e/o/fz94vn+y/3fJJRD+fNvzP98ufPtzJbPA
51vsWz5bH/6vzWt26Ooo/pDVoT+37ts0DY3xbW3o8GvrNCRXFv/89FmPhjfKGDOfz5a8NLx2
yzOywGjoyIVT+DWvI5nzAbFvZD+zS3M6Cr72ZWZ020t7TnzrkqXtm1J1dIjbLu02di0wZ0Ug
nnSLyTS+UZlUYDBWzRhoUdnTRWMu7NGF7efWL8rQVMY5MPQ1elxtaNFA/RJDa13ZGwB8hb1m
9dtve/1F9jpqv9fy8/Jz3Dgn+fY5OhCeT0TR9quSR6vMgVaBelk0t+HvLXtoxCd8/G2PEGIf
ue+CNATVvYFhF3y+xReXU9WFn29v3EOv13CJuFf/sk9gDsAX/uMfz55uKW9IUj+zksvCzVFm
U3bvgKUbVxx1pXmRfahmQCWnYj1T2uLCaj6bSeMa499+XVoUr2sQgoaJr0swfdDsntgCnGVA
Fm1QQnSr6ZVM3YnnJ89d0TJi2dgXLDesWEiJL7xpkQ8as4eekOkYGs024RfMhn4+mCTPtEAQ
zAA1Oq6HsFf/neLU1KfEl/YlWQLC7AMM/sFJtMw5sTQ+ec15M6x/8EGtDgpmXdSJ5XAdOfna
ioi1tTMq45dQCUxMbzXS3Jj01NaUdCfs1ALm7EsWQW0evFgT4qu51QCd96BJwHr6P4evT45O
/hr9HsVQspdTRobq+ew48o3mh3Q/1GngXP/uxdFfDp/jX3d2+tt3TC+dZ3YCLw9fwSQq+1H9
bDgT2BDZxKLe5jfm8abtef+EvRq8np1+fu8t+Yl5wjCrEh+H+jjq0MCBlTBEqzVgFVOzDXxB
9iGBtUEgGbVSPdGfhK+h3fD0p+xtJSF9Muec9DeoIEAVtusw7xRWjK023XZhrQC1LK78dgc2
vdMPaZSXeVYYY6oQUqNMcE2dSl2laCTWREioyq04UFpFiVPd3JR/Jt2Insh1snZlvMOkFaVy
ZbBcqkWHmhNqzXNS2KFnPFm2KI8Y1kUnClstd+6YHqo9oApqmAMFLqY5l6cn64TWSKJpY6J1
nDR5zBu1kf+MClSx5o/UneQhU1wB0LAgzbzgMFAeRlLcirJdmns5YaqzTMX7lUoG2Sq8lmAJ
bbSunaLlD5PIirlaq7ZVeyPjH2cTr13Q6zWrMEBRTMJJ2HgNOOE9VyeiimXYcGPuy7W7bSme
hta6hBgHOSFPAcU6FhqOvy9sGS14WO9ZHIdIS1lh+5gXdHU7/siuUqH2ffnIt9m4Nm1Pb/Mz
THu739+5hWl7qptfzbR97c3PM+1vbgHakeqC+PmvZ9qi1viZpr1zG9OuiO2/Gtz25fRfC5JU
BPNbnHYbS0mDYSRogqH+vE6/Xdp/YNr+miojhewu30Y1DVHTmNz3SZ5P7B382f7/APk4FtxE
QrnV0RuXv+i1lfvFyaANfwyCpK7yGiO0l6BCbB/VGP6YRPOpCuSLSv0tkJ/2HSdhFaAOP8VD
VHfkGaWH8322grn9lPEx2b7zWXoqIVj0As7RSxztTMEyIM2TONHARNMblcy1nkVvJHiR6gBR
nIBIYXGp3u/GeUTLbYgvainKA4qyz3hI9XqiTtTJuGkBlhVxF/C3ZJZHnEe6ugCSKEAYwjhz
TlA31cBMszbqRkUYytLHfi4xh2T7LoIi/ZTuIBRgQr2wQHcppnDbH6aIj4bpDCRf0bJpIVcA
GOqeuAAS9WHdj1GCsVvWBBOX0VkMFVGv8cQr8mAoIxOJKSi4OcmY6uMzuxIaGSEnQ7MDwUZh
ctc2bwzrnxahMXMaS0bkRdzSiD6j4I78xqaRk4Gp9nxHR40Z83EfyBHDOdQyrBPIq0nAqS6W
uFJEl6IeSItGDDDcQPP+HznEhKP4yZnsfApn34NQN5JMB3yqKY+5eABbp3xffE9LG1Wl79zh
9qTHGIm/E2cJQ9SuFLGvLMfjExZss7smyQowqs2VU9mK9w5rJtOSvch87xNVbgoNQ5VNmZ+n
w2iaJkOT/RS3kjcumiCGRfE55jkxLsnWb04iiVDNo3nWlfQYBfha4NRxGlqbm93LhBZyhVxJ
l31NHfZSFbZVwuMCDV9Cmo0qM8LY4t/s7ZXaFY3N+iJddtSgx15mHuA5VTLmpbb8A+u5o+vo
uEXF7GhOAh9XxbxvNHb2Lug6Qvn3XU/W/V7jPL7pOp0wyfymWxF5vu06ogS03LAMpcto+Vv1
ucZdbn7frXD3C5Xg1MbpXvQ83qdJi3/H0dyvohznqVulOLnW3UgfLt7izlUgyUYpHL/udm5Y
OHMu1uoHUiP1jJ4vdOQD+mm7bweueo/Xbh/y+tkzsqDyYJIf1eU1HY/ekjPTMKM5VrdDriGM
dBjWcpFTQgGge+xJzAUuiuhklv8TDuBZPis08eBQjEsaH1kl1eRIn3IhA4ztqtSrL6TSM8WB
sWGNS5lquo1ToLhTL7GrVgeaXPXInZ8LYcO7AOwzTnotPNdV1BE3cH7lMpFcNRxzWKCvO6qb
gZHDAaTuCfvK5pN+p1bHpwr0it6a2eclWutmtTUO6mitndHrOuEqbtT0wk5nGlS/SC+8RBoX
qdclcJ/bt9ZPC3G9zTwqAvKS1u5Iy6TVqsIiCmvFIo6yqc8+1P6m48u/TUqm68yf4qzh7P6c
82/S7a0+fzrM9nr5meYvX8SKYcOAbnX8IPavBS/Eyo3YUtthj46n8VhyRfp3JItCW+ZRRdfA
EBK5iYsCcWQSEnIVipggcw+WcI9dV3p8jY4ZBd454VpEm+3U/ckJanvz84Umb356EvDpNJlV
U47BSEaZsBYXH/lKghfxYq3MN45+gHv0zQz5MLikYKWNk7QY7M3TFzu9eZoExczDOvH1NFkn
YaJzzeOVSwJwFKk4UW9PcSk2wluWaqPU5Oq0gXPqd2A4WFL8CJvEzRuCzjFzkbt06/+vlYqU
MxDEqIl8ftgeX8SIIhjYwAW/VfL35yDh7irHdR1dkS3fZOLFASk0Slzr+RYcVenOheusmhRt
5mQZFi9QDdAVTBzJRP1vrieYtJFM/Cuz+nElEzxyXT0X33cdavttiP3XASpEmbv93VuazmZU
Fxfs+87YDlU1n0bPn6NXb18eHT6vCA4LCeVa1SskyHbX1OwB7rv2zopM+Lri99B25JxvJ3hW
8yM08cTUU1u+OKrzxJK+cd2hHgHGt2G9Vf4XczaEuF/mxxerABxIVP03FnLCDdtVY4gb+v+P
Yo4XWoj+g5nj35jLFuNfj7lsz1vWkO+rZzE9dsKlxBxz/hv/9l/Ev1Wx90uzcf3rsHG1I+Z9
6mzcfx/z5mu1A5yb/0J7relgjulOWGkqXWhkdZBHSzJSd7pOwig6MgYb9o+D3E2URaVnyXzS
r7FjlUWsqItsw43pTFZixULAr/FhoZ7bMGHNd1jlnSXsWOt+9LMo+vpaHX9u4QHTnllrWr/3
k8/niF6/Pmp7FqPVqPJvRXV5jQkX6b/rfqpf84SZWtzuhL+4ctBHyutzb4JebRk4xUajdqtQ
QWFpSsywK8R4Ns+iDUzr8di4HyF/UFZ7s7o76slNvVKdNKLYAq2hVP5Uzxd4uUtpvq8onXeV
fG9QBQXLBdkqDdSA2Ree0oxYs+Z5MSYtmBmXeEOgoj+SZI6pTogzq9Ftwt1sjCiIhBI1ZpSa
4xxtfB7LhsWKh/G0BDza/Cq1WlUq6n9cdkiwoks7931Xzuf3LlO0IgPSJsDIhvdV7sJqrkQT
xmkyrSGzb5uboE4qlcGJuBCQWHda/L+KMi7nhaiWxOcIORObo0ciQi2LgjnrOZMmla87Ja6c
8xQT7qKySOKdksykqUcBin7E7PZGBhsm6ZQlHDsizUQifDj1TOa6G5l8YrnvJ1VNL0auKgUS
KMo/Nc8yqrcwQQbJH9DEE22orXiSfkwwbGsidESsvc6BxBzEyXBOpYTqAN8M5D3DfswyMBtQ
ibVxCGWwt0zwAB0SxpTBqFYPW7enXjHGAWR9Mk9MNah1oStSYIYVegZJqEyqIhJA7s3bk6M3
r/dfUpGdi2SClg6trqNQL/JxeYkIIrWkKB0rz8k8YpRxotjQ7Qw7gZd7BiKDuCADOk5uC6ly
GJV9oAT2cJWYsPXlDG0gPenKcWHsNFUtcVmJCwskRa+Ghi2M9mokGk0raXRPWgtwDT5X8dmh
D1GVW6m2XMqL+D178V4rhXtVmaSVwgZut/Eq4V5fZNqtYkuWTntR3NSXmvby2JJl014YW3Kz
addORfDy9+5+x+9sCR9tj5ThoZdy0L9AVMFZPbHCDSMLTI9edMFX6uL+m0fyKh7JYZfam7H4
LTh893aqf5Z71FacaFfwZ7VcrB3ji/m0wjsOebGL/hpcW89srvnVXVvbSEkHyKhrGh1b395l
qzyvX3xiCG+v5+x8NRe+7xfd1bQrlXsFuiDulmQQLnzMWWKDmU5bsptVrnAhyxeGQLCrNiH+
9eR5jQ8DV2PkJV6sNvrsnjV6u8XInwMPwyM7fxMz8G3tnfoAn+l/YY5jaYjjZ3dpoSxTSxqH
phUaOTDt+tqNNtjpvdW6gkDxtswNQA+MbP5mqF9zy5w/Wk072NifthOAvmja1T9Wx7Q2QOWG
YWeDNsG0dmmh3HItP+FUZm2Y11AKHD3J1Sw4yoH6CmS/ZI69LQqfGSJlD6eNt4ZaYWjOaoK+
YUtRXfVGI0htcmNmlLT2liYIojTT2rN7SXG4EvSvRSi8qSFvqhNjBqvWhZ0Q5dyflGfEYRmO
qppBmrph87Tm/jGamTO4SePZEEbkklW1hP/FVVEm59zHBtdZF4s9oj3aH69g0RjViIz2LEk2
KV+QyVytGbOxVPNlzIZ3VJAncGswm8+bVF6pTrhDnXYcFVE8ycUIPo3LM9o9Y6BUWHA1DmvI
rGnsMG0QMMkJbB8psS4YKSyM61bMKja1dCYzsWTcVzieTLpua7lsOgcN/bW0V4Y8cppIkacO
WXit1qnSYntVyK+oLmy7GUsDbWGv52MQ/AAas5YWK9uWjoq/3LZz9pLBVeasCUeb5sxoVRm3
5ZzzgtKcy6+NLznTa7djt2qwMzhzfVsdbvsis1cwwpgKzuSY9YyyrsIzn6Za9TicHSrZsqEK
8lirTukP7KiSlMN+sw1MNnrleUq5J+TSndvIMSuQYSH5RPp/9ddfC4i/v6CNq0IXKh9XAsat
/N4U/fJsW9qpCdZUGNjWq7jvuLJt5JOGJS1rjj+RTx1Wb75Stsh6c49GrN7cIxPXaV6f/m36
TC24bVGpUFAZaluk5Jo0xPXUc90hRb8QbUDnpDugcsyby0JpVZznjlroHMyIJ37SSKz4g+xk
h5wOMX9jxzg6Gm/DCj1A0lo4drV6RSoqWsl5HwxR9h271gI1N3l1OfbL5crIh5EiY7m2MNZ1
Ncwcd3MRT+A0hp0xVY3o1n/CPJxcbEP1k+50sBiU+3rRuELM6ZlccWkWx6mUYOkUgMSKS7D/
tfgsd8KbFa9OmzBTGVi+yxbCW62eUVrqJl0xwHK1UTYAqelCcUlWEGdF8+yRttzHF2sXBYlj
S6SStbN4NsIfm4dGcrdwTKKHeC1uWSv1LQxcTfUaGFqJ0a2O6yV1CI1q8kw3DRQtHYPJcNMg
bziyD/Nsk7RFwCVZM3r75vjoL9HO9vYecKMofUzSWMveiWjmZzjiHD6zBFBCam/Ny4L6g9cp
8ME/efDLxqaOC0LghNLGkGQ1L6dzk6alQ69GPYCUxF4tWOySraytV96/9SVjLTBMqHSzJc8q
Sw4zYHyJ+Se3G8lxgj8UJqwAUKyzVOQOdUM0S6ucweU3ymc9zWeMXkGlV+tZwwZqru229qEp
lGXF6Q2cAGzBWTwtmLxp3h9Je0wMqpGwzZTQafgTzIUccqQ6oz/DCO6SyagwGdOpD+Oq4ijg
HS+lRtVPRQUVCnLz3+Bzaqow0haatEhox/KzIlFPrmHy2lmRmidzq/Fn3gCto89CUKyr8EN9
t3Z6Xq7OxE8bpWK9n8DTYN8q8ZI6qCaJ00EOjFfzdg1J4cHxbqudP8/5bBLwyb3+eA262NuS
7ysb+vPEU2nMvdHcdlmfS+GmDivHqFBQaBMynMjbN95ZAPg24+9H79+99HS0hlBsqDlyfi4Z
Z9Y4Yj83jIq8ukmOq+MU6y+GwzqMhkCYUgmywtVrIvtomqdav1Js/Tg1vB3EB4AK8ma9UTIt
pcY5+4lNbW1edfIFEjQFujmdpbTVaMkHigdXJxKHCsX0SOYoSTCwSWtu6kz4Wvi61BVOmQdg
GIq+Ugrv45Z52ADh4mOGJBnd5U/LWfwvDHiMhhdASmo336ZpGSjtUE3563/qYVGAjYu0I353
rrgeWNPv/QU/0d/vyOqqXgCtaUPwwlvgCrASQeDJekeS/1h7p9k63RyPVYtOjUa4RhzpiFz7
yYsUscyrEe1J6ciJ8dXMJITGlT7qBYkFqh14beMYA5xQDKx4tgAZ+IBuvcCmcEYPvsc3pVOt
hKxrh8UDTMrY4jn+VA7zCfSenmbfdWZYX7Pz7F2cfQRw45OGFyfJGN773+QKNnfU5tXnlmTU
Xh8+2366NXwG/8qi5dsbxkIBP22FxD+Yt5w+dqSVOWLuc3wB9+k4Gc5naXn1AqgfMLCdH/jl
zmZ0MZ9g7YtBOoHHphlawAbI+Tv6m42zspw+3tq6vLzsF9LfGPvrA4u2dTEabFZmtiszgwMf
mtMByASA9392JkCRekDWDz8By4e0M9o4+PPhJsPAHR+67APigcSYz063qgPvycAVGlOdxH6N
CPE4OIMzzH7ZxSth84lpQ4iNd48TEasqHa6aXtq+HDLvDAxIUMHFIJFfq/rVBDl8MflXeFI+
0b7vMFMceV9SWXA97SJ8ccL1CMRpMPGTwBqZxqRlJXZGS4KPjJSAV71WSsErlcJ2TU5e6gap
nBCfjaR/2u9ymMIIYMCEYwS3Y5bGE3YO5/pvfN1u1qUHb2kVqWEMz65vafTAuVRcCG9JsK8v
ERPZWIWgqR95tDwgzq/uEbW1L2LTw9fvX0XFNM/HycidbHVWC0ZFfmqMNP32Ivi8OorLmrae
cGPTm0+4wRr69U5Yizb+qmIk5QT9sgZXzqUwnSbxTCO+MP8mpohQ/QpXXbqh3RWPwMpznRcm
24OZIdyIrH6rznCj+HJW39uYg+DoynNQKOvFlGYX+eTCVJZaqw9eveK/FjnuKimyvHocm+Q4
eBn+C+8vFNfcW6j+CZi0EQ8dy3ZXScdCGzePcgve25F3Oenn9x6AntiWNbkvcu6n5SPf1Mzr
cTpnVJyTEkHc1MgbSHfTxn8cs6yIV/YKllw3LpthHxJV3QlkGqgpypfLM9HcWxk2ZZ5ujKln
rG+aY5NE1t0oozE70CgZ5lcapd4kymoviwXaaKkoq/389wm0+1hQMB5ecS5m3iuHqjovB+Ra
OH7y17FuM8I9TS5MkLNsZIP4meXL2neAek46y6W00KnRk990cl455iZKzyQ3Rw/F65GTRhtz
32ttRlUUSt9+WDhraSzJcc4ghWUVmFNfCzVUb521VoKlOGVXpBhG15BgKe+vJli6tT5uW7Dk
vh3BkgxxUhsmjrjKwmWSTAOipLeYWxUlPQAuzwAe3IRgX19ClGysDNfUjzyqBrReR5ZcJkzS
cfenW5vXDaTJa4mTtyBP3kQ+u4lE+WuaswqVv6Y5v0gnyUtkw251zl8+lzhTgF9WFK7Fc6yZ
K6KV7MvXPcqDo3TGxb1uXxr2DJpmfso6thz+puJwcBLCSbSGwZeShwMCcWB0PSgrDT+GRgRu
O2RA9q8yQv/B4rd7c9c/q4jfXUO6FkriPOCtSOLuza6fr1US9xjFr0ISLyUu+nqSOMH+JnK4
cN2/yeG/Ajlc9+oacviJbvM15fDG9v8BcriA9ZbkcKdidMB903lqhNWqWdr1775DmZS1iQjd
sUrTvR4lOuPikqaeZMS1JJ3akVIVzJSIDIR9BuZ1i1W07BpaB39WwVgP/6z2eesStV/8+0YS
9TXl0yMuG3ozyWll2embW5j5/lDcvn7Wmd8c5ge2juotz/yLy34Oul5f/mOMW8DMnyygThzb
Xi91y11JliijQ2xkahh3gnNwyv8ytSO9Y4vauRWJpnFsu//e+PuRuIa6K3Vq7nojI19ZK8Ir
MHCg8nUJORra6tO8yscVRBhTMIETbQSWPDXwuEkS18aL1U8EU02OYZ6iH1xI4V1p33j9uuwV
nS9gfTV/2CDxQC8o5yUSqw7juZ5RJyaikHOMUesN5Ekw/SgIAsArZ6eF0YVkpAQvIk5EgQF/
1EtxjjmFOQUZB7uE/aqzxEss+wRjOYakmi+Mk4KCgDKPjSprMrWGEbuwXJFNjcomgFmcFedp
UYh0QeFLySdZl1YpnWJe5RITegCfXmxS2tOSMrEK5wDLngv/wvVASqcQRMNsYqqwJFnXgmr8
UEa1OuMROGc1fEkmGtDJLwPbPIlnX07JEI/qUcwVJcMgzydJTL7aVyVqxodnMcgKJWWDAJAl
PcrO9zkS5KrcaFk5Lcr4fAov4IbSDfEZS7dM4B/GQvjj0/lkseqimhHSfvZf/zVQqMJ/35lR
YL1Wj8DgsJ7cPD8v5B1AgVN2P18sbjtES0idgNFON1Um1OImRbSquIETvDT5oEmCqJo0QVeJ
ZPuyDuC8Gf9d/t9y+FQ+roCcjKmxOaEEqm5EGejZ/YGJfNQBqofBerOoMwawJZ0mT3E44A1D
SZS5KSL0sDdIS6YIgRSTlOue8ko2eX4rDWk5nKU5gdHwYfEh+wB0ZhYcVd2+DbVaNqola0Kh
AqOOyg8C39CQd2UIIYpLBswM8Qzl65RLOzTMPVWhCJVdOs7rk7eUTZVpcmA06OmDeSE45n0Z
RMn5MmBqBSx8vwgNiQ8+4FvB4R5I/3hlLBuKrhWJYQ8MhI8/8OPgUA+lf97XpajZiBpLEfKR
9A3X3uJR4L7vlSCRoc87czoBPBxVk7leS1EmN1uzelnWKznRTTivXIgqcwRvhBNKUy8XwWUK
LOVAY9m2UmTksI0Gvkl1iifSPdZj416IY8tAPuKxSSiVdPrzDBm+Utk2JXym9lk1808+LwvV
ghXDfCoxTegvI2EaXIOzhYquKlYE3WaQlNTSfHrJ4blbvvgdRtQJukbdmIrkCAojIxA4Ukxs
sG5grS9SLgWV6E3iD6nz4qY31Ra65CYByUmD7mkeF/C4ThOVh/g1UzzOKWxBtJf571SLubnB
ZuFU02JP9YVzU53LkaZUcXsDbhoYuXocopccXljnBXXU7PtuiKKyym14y3eH/+/90buVC6kp
ikG3hydHrw4jluEUMf4wKZ/Yuf3htOQYpwBlMqUR6nH1/s0YCOiv4sNtxTYqAD0aVuFnvQuQ
X/IP0pnUDFQ8FBTE2bLRqpnGYefHJ/uv3npQTW0lIl7dncJytV6FiYBuu34dL06VIamNvEMU
0CYEd1WpZx1EnPUCbh+u+9jJMCtPByA/BWK92bXJQlRBX+vG5OTEM++kRHbpaBPJeU45M1ci
OU6T65Mc46/BIXycCFMIkakvxQk963nhySPB2jjVxdB4JBLC0whd+5bJpz9O4TYT+wuSOR1F
cG3DJJLPOU0qxoBKwlNEXh9n7Xl74ub+1Mqj2FayQxFosDamV0M1PT9PRiln+JxP3SSmmzKf
Gpmt6CvkAITJLNCuBkpbI7POtrYis/b9n5vMrrUktnaGt0hs6xOoHoffKO5/I8VtS3C9ojFt
Sa7XqKb39uitlvUI0N1KkQ9i4QqVHGzZ4THIEHwaAEMm1E1hHMg9Hk9zTXsKZPGM66KvDGYH
jFwSN0gAl6ST6SQeWkmHe+rIHC8Bx/udAI+5CvFrS/kqdXyWUj73/Z+b9rUkfe4UvyTxCyDm
b+Tvv5H8uUgheSdDeEhmumSGEKUWs/koJf0ElkMkneAVCPCzPEv/zSqLQVJeJgkbhhz+ChZn
9BOUoLMYzosihMZe2aLmZG7L9QxVfxZX21D1ZGmtczCJ7pwuig425Thbp7QjmvzIUYAdcNWF
iE9CQZu1RDFR8RByJIXAcsVxpe0NJa9X7yah9G39otYa3A+kPpW8Y9wPmu8HfnOJDqINc1w1
6lHBRMz77358ox5Whv0c4Z03P4c/ztLTswb7W7VzNrxWsi35nXPtSzTvzYfDJEF7Ubu+GaoV
C53fdzw6T9EWOcrR4Rk9vMmaOMSsd+xy/1kyKC40JxqXJ+ez6Drl993A4ACMf1/dADEkhpJP
B6D4+zqInzQ0X2jEtFCk5ncIHNdORuUdmlv0ZVYYhUyQGMhXcFEJPWJYuoIqtRrAe04u0jBo
eKxaGe27M8mf5LsG/1cZGAEg8tdLIAkK3Ab7INML+fKKiUdDEzX0IWWRP39EIhN4vb2Jwh6M
Bqxp9kC3RWrZs9hU4sbS4pEplOgofgynVLDTLtKyohjPJ6hzyfKywStdugmathvwTZr89yAd
XxCO5Uv3AQGN6igL7AZMNDdLoBPv2WIcwz8CeNbkGuH6Q+hoNVYX60qwWo98A5lsoVg5y2Nh
utdQEj7NZykVPmpFtLwQBunFukYQiUdZ9L8Hh4gR0PAF/BvTg/EVMZ2lF4BgWBD7ksoq8Vah
j/ksygfoNuEhh4tYwFdop4EsY4ifXm9CkWrdKflDBkX7y8SZlIpnM+vSuj/1YCBOx0yQvmVx
WhQxuocCCztYoU91UUCuSf6kSOXrgE/9EAgRzYKvsGLAKZ3oNHPSyKJ4cIFh93oKWt4GIfkT
q6pXWRI6Pbmfa9541pVFMhmb2mKwsCuuNyGadPGrgR3Cecxh/wPJXTUWIg0UkkDfAMpi4FR1
sE6TI/JHLJqFvLBcN6xn6l6kihv6mbJVCac3GtUM8+M43ETuDc7NDrsFQs0SD+GbKb1qboo0
16FfDLbipjjJhx976OEZT1j6ALQzhvweeQJ85sX28vF4glnHfU/FFmKDiTdoKTbw+y7fzygf
FhvMKlluuAbjvmY1XzLVBk2X82Jrjl3nvvRmFPRFUPfb3W5OL3W/v//Cy62CzBViu8/Izklz
UB+Vs0EystivWg3UazA3S+WmMUcmZ/SdYRVFJM6pWvkoi3UppQqEaPI4Q9W6c34UfZ0edjXG
PpKv6E9Oia1HaQEQhiH0/VhC4oeUBrvfcAHXTm1t8e4btpRkBRbags59Pi/hzPcGqJLbuEix
Zs0pVpVJeudAjLv6LqfEi6LnWqFG830bylj3Q2ePVqlyGGQBPJJTWwwXy+jSJQ2nc0agIzjh
hlJbfV+6oGi4S6wgRKYUaYcnpTibm80Z4eGCrgTo8HSSkxsZ9FKd6V718nZn2P4S77fjtw3D
/WzZtRy1uZLXBTY8JSI9tXs5Wu1OXujs1XRFOyFdrf2ibJPaVW1u1qpCEuRR2eSqioSKRolm
JKXq1dCoSItfQgUpVWj8z3IV5Gd03kxmS7O+W8C1uobt+84MQlP8vT9/Gwgg01r1MvbsULXt
br6bV7+cecJNV7ODP7JsF0dKqlGr6FOVSF1hc4lc6lzaAjC9tlUr8t9weVuVmgt62u0JQHTi
hfRJBJ8Cv43irdZrfAGQO12h24ByrtYpncfWPeoVItve1KkJo0JOAi6+WZrPSGyVNPOKQKLG
Y/ak3Sza5093DiXqauQCsr4FRIK55J3esp6Bi73BGKXF+xm1gk44HBY24XpaJrbPVMDCfuNo
hoWlqYezZD6D2QHJkxmgZbIDOEQ1rmjfO3QTdnBHOmoSlmPsKBDJ24zS0GMofsBs7Cwx56Pt
m0V1ysN4Spcluuwbxze4DQq4LPF3d7/0DlLfDOqLViCYEJww2UZNMRVD8+0+rxuK0xRpxDUQ
tSW/KusD6jLBWlpcSzGMZ1jn0PvBmDKZRybSPCQ/FV7TaXohuECGUkrhoIGZlZLexqzN1lRN
LKHXLb8EfOaRxBGMJznDhgrPaPiCGJWj7f42dbjT32ZGleBWwHRYtrIV+0bpKZ4Nu8uTFLaZ
2QkqQEnNDRNAe0kJLyTGBn4fpsTXVmYkcUVs0L7SbMouNxEv9NKohl34aNc+adibk8PHnWdH
LiIDV5pI0feFldnOpUD6mvDLLk2Rmw2mbbu4jK8KW08+Rat2pj3ElJKi3gHJVbYLO7hMl300
7TQornODw1BjVNHV+FYuR2q75GCIwrC8vBi6zivhAHZ2RDtIHza2PXEPAqcZvw1MC1+/KAId
yD0vYGYdEZJDbmliNmypQSF1mnOsDh4N0hXm9YJP84w05Pms2CT4AKqS/wDDJy1QQYXzL4r5
+VT0VcZWwyHTFHPM0cLWC5fnBOwOJq4BgfjUr2CVZBfpLM9Y8tAS0VR+LkJOrrEi9NpaY+QH
OWiESnFIIPNBwOdCg5zVJ0JzLBDxiP+JNCue2XKtQ/QdtjlR0EuXdokQSekFvHjed3U8oUlR
Fs1KbHsGv4Ui2unduj+fFEWkrHx8VFh/pvneOEsfbDtcdSWHnF+m5fAsKeq554MjrZQYprm4
n7OspelgQmAJ9POsReG+ah6Oegk5Tuoh+UyjUHG6Wh/y+9LEk7VMqpX0I5O8sVCg5FE1esrW
SSdreUtap8mst6ymeaHqOyEINY15o9l+c7PZ7os+7DZn24QJEUV8+VJoswC6JLMLoeL1c7oo
Ui3I6uJVGzRIqI4c/5qn03MvY0nF2bJaynBB526ZMtsxV86WK8zJXqGugjbLwxit9LqT7qtA
mIgVbJqktFmWVkappFPi2ChSa9Pmjt5nE0rmqbWoUPtGSUx11l1M9IlleUvWKkh35/OC70gO
bEwW1tr95dNeIp2tGHqa017GI/QCi8f432E+itExjL6MMvwv302fo4/JDHjPvHomM2qdpfLf
KbDV+BfaiS7Hl4tVUJZuhz5uBhvF8++70QZXS1XE2uzqX98sSqKJQ91KCs2FxieBu6q8rlXE
MBJ6VL/Pby1rxTVTYKKkMLp2JYpFlq9KSfPOKD+Psb5iqG6iS0isjUJN6sT+a8HPZTkvLSRV
tXa9nJc2Q89aNanNf5xizs95+Zw2yhATduoy8G9QxAHBkb9+SrMRELtod3t7G47xBXpgjKLn
lEYZz5hkyi0aVG9As4ybBJCAS8qnK1qjaOMErUzxbNiUyAJpnfx5gGTvuVMbz+moweFjZMZu
aBdtHP3wqinVBJBWH4KvEbWDA2qmCKLDxs0Qlc1MmdU7xmmi2R6UZMvX/1UKjrqE6jCatiEz
m/Ma7sbJZPluaB4GoP7aUi5mN5u0NoYDM8+qYNnZtn3gDdKmn7d40wQ7M1bQsoJmcOUwZam2
UISCG6vSBEnFTzCHU5DApi1cbPiPKkcQzpFGnEU9ORr+XMmTaVIZUZMFdi5hibqGIeraYJh4
Op2YWtjcVVL45Do8TKsa8ctESH9h1YsikFU0DJ9wdy2Eyfa1OXRk/mmFTKKV59cozRE3iT1V
iTJqFHyaR72YxFlPmCf+LC9CePT65PCPh++kLdoYK5Xrk/I8Lj7+EkUIK572bTNvCoR9EW0Z
9+RzMnFVPFlbXBI+rotA8sQEnEk/xJRwkjAQkYD+zjKrjjObb7gWR36qSHm8Lf4MF0l6Qmhp
L5XZM3UfgKNyCrC7QlvFJrTmnWYz9G1JQCsm5RvN2otAJVrP2ZMlQtVOOS96qBZHWeY8HmIY
ToaC0cV5BdXT6cXdHo6Fufv0795Z8km/A2idP3uB0wLP7jtd3K90cd92cd92sSzPn6VgtY8r
V7m1PbDfhYUIpNsvL0bJ3jWLUZFDzJaPHIj9MfTsOs0VHetSXECMC9+qZ4TnWO0qJMutRo4q
0twK4pzZ/dYS3TKRzpHpqkKd8WwUQDhEYHEUyFrbpIc1QU07uI2y93VRLSSrtRfWVpHWVhXX
FtQoEODTZgQqEnhiWqnOEvsarJsDy01iFcYVv0LNRKVIULUvZayZtMqXQ7QsY+jvMCKCqxix
8e7FQfRwd3ez2otKbA5dNoIQ/BK9Jkot5LthJiq3ATV3Yq/iaJ+CZNCvCKY0iTZe7R9sNvWh
0hvcBfIXiHjRMduOVFjZnw3PUjRmI0O7cfx6v7E7lewuzp3e/vwq2ui8fffmxXFnc8mSVMwz
94528/biLhd6spwHCD54snqjZJieY36/XFLFbcT9QX/YH9WA/rDaO15Ji0aAx3G1+2qnj9xO
AXfc/iqotGDSQLCAip7BP3AeyI0VM9Sh3V5Xs5VltQUZIdO7jG84A49zagHmrcv+p/5V/9/1
2e3Y2d2v7OZ9D9a1lrvVlv5O3b/WTu3sub16W3W/CqjG/ah1erfSaWULmnt24exJ7zUxfK3x
ujI8Q+NlWbV6/Dmdkavsy/3XKGdbTaTx14bbJzstmq9IZTQWD2ncT1YfVJbsM+J+QEwr11uK
WqoI2+j1HLJm07vNgTHYzDrMgtRwHs9STHtVsJcL+xR1xCMZU1JwX8qWYPdHo6ok10bJ4Ex4
qZ06tOBAP23s1C0M1SL9ShXLKGSHbTRQ7njm1GDfCy3VAs/AiO0M1YER6wtGKC+Sz8Piubql
syD4nr3sr2nV4GX6Zg10tDc2wyPhgK3JlB37CbM0txKJ23iVEIskmjPDdwZSx2IP6chi3Vde
EQ+n214udlSGn6O86EnZyIXSp8Xx0MeVPnnHvl0kc+IrX17gFKDcyG7XQCB/eaMdo/gXN9qp
fEehMq2Fu5vKdrch2v3ajXCEbU0SnSvQ2dPshFM7R1yDmAOmNnP2bct8mog/srjs2rKylY5u
aiuRCyzAnRjC61tKpAGfQJOJSbNSB0qn80WAhexM1jqTX1Q7c8rDYBk7oc/OUXcy9Jl7A4Ow
6AnFvFGwFFu1sWc6KvAszsjtj7xMbXQV96GB542TvgNSDztmoyB7Z9MJPQ8YdzzI3JZtp3oF
LjHthLcz2Fkr7qvGjgQYFmHAZOgoyH/V+5GffTtJQ+8eC1b1Z2NNZXBM4cE0G1FrFqxmYwlb
dVq1rBh1WBxpmG3z18Vj1vaofqNez6Sj4sINLDp1obDBWLLPZxYekEGY9rVZ+GNALupY7Guh
nqltg4z3FdlZ0uXFjyRTaU8zi8HtmQLfoN+Zmug3/KeHJKxqBdVeGDyfGUz6JvtNy7el3ClT
gNDH5U43uM45b8T3mzDIBv/dpW3/fnMZ33o0uhXOdXGeskqxJQ+4Nf51scmi+aJYyMT+XNYK
jsEeXdta4SckamGp4AGda7fG1WoH167TVElG5GYjcjfyv9Fw4VINT4+4JkGRmgBZ8ALAirxo
NVKMPkpahUkCaL7JovdZ+knjbrpOxlf8XJqgnTMtnGzxD0jpaZIBsCf9moJT2WV394Kzj4ek
5GM8t5n4ZKb2dY0F4tUBBnKIDrkQvMmcmDT6eGFEG/FmNMo5pYPgtH0znmPoPmXjH0Ubg00T
RwOogVWi6FEFggBk4l0JKNRBhIeuzD8mWdfN/2Yw2Q8IdaasgLcNOP4sl9RlWrgwlSAdLqlY
31QKCOakDGkm6XU0HYT3dgfewsBXmG9lUk02K+deCu6ggsTZNhO55eKSSAGUphiLOwLLnYgX
fcR4hjLYVde2yH3kjLzwNo2nrQDClTUodrSYdzuAurTsbscBRJlMsqSEhxhB1GRqs9dwbe37
LK0sXP9Z7O0s5rmQEFGaXdfNqoE64SIf9myDlPRwVCtccnwRgaV8Ifbs1rCeD3Hkn91kPEaB
8iLp1JGZ0mFUp07BsZ9KZzs0FBVoN2b2MlMpuAOcoH1ZmqMoKWXO9SqV6NvCO4Zc1hwP57lT
Qh0LSJCweiWlvxzcGPsCXtjK6TFLC6kns1MAjA1280FlAFwMm7ZBja5WQUZbYt+v09UoQE7t
+zqDhYRVTa8O19eImGZJOBp/sZO1Lc4kqDqImtqHgwWIpEsxcwUwMGa6aA9IaidPuNU8e0VT
EyjNr1ax0zag2VrshEP0w/HzHvAMMOyo6UCdr4bDl174P+lDJD59Mol8gqDrLCTlc9ThXxDb
+53q9qup3GHza9v/Oi95XHOsuzxKdzEAKZuANsSZeJCyDU70kQtjwApgbXixZPdyeIizXO8z
4B+HZ1GSlppJtXbN13cvt5NZleYBKzYZOSfM6bbfxngqf93YpvhWSGpF0yNbEbIsaotm46I0
TpQjSj4lwzlzRNRRkc9nQ1Rb8fWtMb4aDF4PmK0N6arExpgKc7FOjPsK6sX8hXpVAFxzUAuQ
hXtspx1roRwjNY4OHdZTNajG3GfhnhfpxdgbuWlCDV8Xjhb86mrE2jTzJzkFYvz1TzKGK+ln
meQ3158kHI+fCZI3mGSSXdzqJIN6z9Ut5VWtp57W68ca10KBF7iwu04xQINOZ/F5hf6aeiqs
eoyRPoIEhw2fMHZyroXTuSSMcKwZTm147iWZFAlJfNVqNP4KpuloQSyz1a2enCVWMrOKJbse
4mKbbKA4+bYh0+M5MDq02hCwZHEKsaYBAUiLQp8dZTRcVecA1h4lYjWwFTFYhpaNMdKIvlao
xGFimimhzxUXFcFcIXzznsUXWlZKcvkon0QFd/LZiHmaK28fN5lJNvwj3OM25QpMoXHxcPza
LT6L3AQkUle3yqQbOVk2+YkKGBOjcZEYjM6f998d7f/w8vA70lx0HAFOtq02WgCC9UXjMND0
63IKEV24vfFDH1cXzqpwOG/fdwm94R/YxG+6uLSFcdcyxC0owld0wfDZutuqVXVtJwxTLK2F
8jrAfftVi8I5ciS9eoVzlKzrIWZbWzCIbKUG9bUsNNQSs3IxW83SJnPWkjGNM7OZVDam0eBK
sQbuAebCAQhlPswRVj+hFksmsG6IS0HugVnNSwzO0DFNoCsJhqRUdZ5Lcik955pjPuXtduLH
UaV5oYk94SzBkaKeRFPLmSo1VlL7jJz+OpTV7CwhhSeXyqJo+Le6s7hCclfCHrz7DZX2nqMb
LwbA8DL9mFymhar1dEcYGNRRI0BOaBcWAMSZPEM4S6w/aRM4+FIfUcxvMnpi03cFINwaIlEV
GtSTBxFeTV0683G0Kp1RBM11pTP/ZCz1F204X+HerpHdKJwkR0eNWuQ2unZqo2vnCrp2qqBr
5zWqTZXsBL+GqeJE6Zr5FUxV6PRtTrWNiw5+tj78X9OjsEdKvffGvtv05s/zW1rity2mDkfq
9au3elw/w2sIyZ+SgTnBLcer/3ZLEqNO5BYlxpbJo4Q2yrWPxauEKZdas12b3cXYF4/2X++T
MpiKUCWTSY+dkvEYFdHxj2/ev5T6GPXylBX5DVq0FxNJaNXsoWr4WNg3TnJB/2/fvCNWmBhE
XZAzTOGM8wTZQ+nHu7Pw/Q/YmC4q4ir5RiWz4mw+qTr7uXOU09x258zpr64/LL2Uz/YNamkO
MCsQwVUsam+0RsfCEqK9ORbGcGO4KWYKQgDSEsgjmN/GSN8kw0Blhsi/Cf9NWv/JhDkLzi4K
fD5mIGOjEPANA6nLwAm4jc+Gz3T8kAxjtJ+CeFVUzdHFfEAnC8ESiARIszMsy4ZJbD7AMj7o
eZR8bpvWIu28KdWtYFZn6dQkoDRnVYw7Lm1RJtWhLTqxZKmrZo3pIdFogGOCnDmJh8a8JaVY
DU1x51nnlGrS67HlE7+cAOtwR4GP58y1sWGlEXbmYhxjVy78QZEM9kkR7Puu04WzByD+Wugv
jJlXEcd28zPJvz7j/IvLv4J315J/+YeAyOucALdchILAeSzBRvEMa2y4ZSt8965JLKmeL5MB
d1XO4vE4HQY8qWu9ryiccGeNBxVm0CCgrDUIKDVo1GSUWp+riynLpJRlQkoTb7aA7Vu9y2V8
V4jnWmG1zreqNBJF89mkYdafm7+tOKr8W2Xzrzfh4Wn665nwWVlOe5zB+2ea8Dc3hzCZvaJb
hnBIRrgNb3rn5NzEox6OQev8SO/fvVS+YJbA/VGUzU68gK2tsxod/PEoYlfTSvddYnFyU+jJ
mESax3UQr/X4P56cvJV089HG2/cn3eiPhyebrquJdLN01Z5FaJFVhDbYGHhEK2fh8PWFEwgj
59Lr+sdl5ACxukizgAVz9kTsES4nttbALlWKC9VrR4a16w4DHuI13OerMhvYdhm3Ue+/fXZ3
7miZYJCdTxdpRIMq0RpQ6mrRWrdLeY6FlG8ht9GC1WjiM1bpqaLqWdhSfg3cfA2Lc77Vb5Io
ylONXfm8sG3zlJaPe6tzRhM1cPjl1a9nznD851he/XUoaO8rnbO4K74OKu6/yjnLjA+RiUiO
nv8q5owf8bngx7c35y/Fz3maoxswdHnanvHJB//E2lGOGqA1e6fUYsWx7hQOoWHvDC0EJL3I
1co+GapSu9jBXumv3aE1TzdOz6UMq89QW4sSVOoUycSkK396ey3m5Jz86wCNGn+RGenJvv6s
EurBwSOcou6nnWh0nSnSIW49NT30heNfhYORXguV28DZa8TI8SHq+p3yPDV+m0/8L891u7Sh
/nG57pw8f8wRk78BIt/fmOVu4dqCWdVfIqGqMZmTBKEacm4xbareLdjIrbWE33uT9KPiX6Ge
5OrmsiCRVdScxOqFRgVdI41VZV1LXROa4RPs71bdxs3YYQNng4vCzo1cdCnL/tfnouv7+BjA
XDuhFfawKJ1VPSFIRglILtIRhpbirvuprcReyvmtnNw+eBg644IDpG2Md8jGhZ1+tbmuhKw5
KBn4uGQN3/y2RsGWm1gaaFSIPgXz09DLq2SnobgjvJqQZHFXVbrFbJ+x5g0BbCXWQxklmD5m
xIXA8xGbZXNH/cRbK7lvIpP2hucYTnpTIa6lFD/RsuD1FZx7XUtME8e/m2BwHMzvxwmYIgAU
Cdm7iRRzqhx8xFUQc/ue6Dv0ZfGGK1OnmhU2YUpsLNVzMutS/JQ5GdxTJd96005WFTJJzW0v
5JvW4Jzmn7Mlepgw7tU6Wr1KQkOFBBqPvi5r3/ysoWv7tSZ5mWzfy4oNrKJHv8WmtQlTHMDP
NOE2ppXFE2aC0aNj8quYMBGzq1/RhGNKNf0rmjCVougV6b9DVtSvc8Jp8fFnnfBS8+ByTlYy
kP86Jowu69nH+DRo6/8qUQIZZakzeJsT/mLpzOhyvd1kZi0D+4jH8jNOT5KZMZJibgjkYNAj
juP6lWGii064MeLtGvUufizdkrnZYDqn764/tnREedjEORAb0LJsnpeKrBFTCb/0IpkVmNhH
kyScxxkm+ICnjmNqHo3jISaIwA2TKB4qFj62EPLr8Dx7gTXDpH6YE6YvU7OzCvCe0sl7nRzW
hcNHB3mGLCtlkn//+mCT1Ayz5DwvGSoSbMH96HpGmNohAu6/FEesCZWNYwXIRtI/7XejzsHj
/xvkedlPs7SDRctx8k6mATN/nDtFAml0EHPkkqFGFoWOk6WPVQrbfE7Qh22g2BfYBmgZjxSO
PDV6C6Cfwn95gtKcRCnWtT3emhezLXp/a5BmW+M8p4nj3rvtRXTxA0vXLJf/h0n5RGjZH07L
J5raYoHO0DJIi/SGwFcfnhy9OsQp4U1vTtYlIJZIZf2Iala4KZNKEYu/geP1DWcWxQQiHdTa
8JDUiZOKWgquF3ggpRPOXIFjsHR6nihkqp3ZflJHbyHdiJTXIcIpiq1muDh82LXhMsGCuyqd
LvCDsBzUzYbijhYNZVifdukbEcbEdwg+Y3NKaDO4KhPUIZ5cTdMhxp1KX5dI8wH25wkWS6Do
L5ADk9lM8kTx8YIenWRl718cu9mG/BQgnHBrmM/giE1zLMuLWYSAbPVh121Hthbii+Oui3tu
+15kevjz85cLgKTsVnsgTc+uCgRExEnpAE2xE0RBjjj2UrcpwTdQrEIiWgIDXWAe3dvZjb4x
8BgA/fhYBCCytJ/DNy+a4WHZuYXuOsLxNWV7aexeyNXCvl9YqBiFtnOnp6wAR8ybQG/myG+w
MpxQMMmGiVVk4+ubzXMSGrFg+4n7clVCJjkizWRDq8XiNHFzm6wmv6C9pJr0FCe+JIm+5tey
+U4X5yU1OpXgJxCLDfdx1xXav++6EjE6RFli6fmxG8oG75gDDH9b5P2mq1w+/EX7t9DHnUwd
tv8vlKNfYK6pTn/37vD/vT9651V1YxV2u5Hr7VfPkeoo/ziZGLlg/XI5UuVIfaF6bu+Sf83T
mUnor0ZapRPuCefIIWW9luRKDSZGnSXM2fh5/002rv/SZKjBTH5Mzx3oIxpgGF08Lll7bpuY
/KFD3PVkWfrS1cYbJOO8mqRzwYCrlG5S41QLvNTsvQ57YBlAuBnI2CIVWG2aTssPc9lVONH5
pZUlXYOxYyCLZ2apFEQPd0pzxYvFiK79+Pj+35f2d27qqv+QzD4Ca3AVvX999JfoBbLtDWXZ
XdRNTHu4wuafMM1i0XGRoSndazaulh1fMJqmSV1Ugb4pN2dWmkZOYfIFDTX35TgudzQR4s79
3iAtDe/6Yn9hD/dtD3u63r3dVXrQWoPToZl85+1BJ9p4ddx7/uZ40ztuQBMOnvfevXnVVFPw
n/kkNRXl/kRfpMWinTLFA4v80f37ijBHx28i/Lqkg5VyHZpsUw2GXi0a6Zp2XaZAnjNrYBhS
STcaZP7ZxKv328mZo7MyRBZJTDZin3E2yo7nqBIYznJMCaLlWHzpsHLbh6e4WiEQqyVotl3y
KsMWzCYTpgfVoCHT6/V2zJkLNfCtzZkrK6VNGYLr66Tb6tB3akr/FWdrUfU2ZxtWoC/WoK+g
Qpc9rSjSl/LhPttRLSkX0FjjdCib64aW7tj0dOiFly/WsBuY8Vtas7JB9EadihNOdD6HycJp
79iM3B2Tm7rjpEPukIdHx8mQ2yEfNadyexS9IQ7GFikwHfGwFL//+s2J8fkgATo1HpneKa5o
9s0iK+AyFNz3XjKa/pfJRTKhYnyyYyig15ko0801pAaHi7L3yWrcVICdCvJTKzBUK3FUK7NU
Lk+V5XwalL/JDaxLysycGqhbQTKY9l6ZrFkSj+TPE32ZRGB8oJ07RptaR8qEXM7SMgn2RE/a
dKWsmKRVDHZG965N8y2vNveprFqRxLPhmf94bVnv3CjyC0qwan5DjGj4Wkdm0XHpa+4kEF/j
LFw5RZFhdUxggzdrU1XmkN282qye37TqglqX932I7herwVQVe5S5zJYKqA2jLCVLhm8tkWwz
HDdawFA1L0+Z0BJuizeY0h8zWrQZExtwEQDK1UEUOzRIgNVccy2EDZ7gerl1agARD01vwh2T
hNIwikabj/U1gJgNE6wHkRoNt9WfszmS6xm4xt94chlfKdYiBIJzGXJ2N3Siw5ABk2JFNsJS
E9XiE02JS62x13mBhl2puN5xJlhV3w7UWJJk83MtNlie+RnYQYYR+1Uhd0bHIK4CSbqpcOKF
VPfoYQkKcu6Xggn4wziJsYI7nzwAWYiBtbt7a1rotv6tyrLWP/UCq10HXnVv16DCs+KxX3XS
D0tG6hkSFIv0YU0mcgVH2MiM+y1MKhzfq3NNHfkNWNGOixBxjbiOtkZtIG5ufx5Nha0XbnUV
CYEJdsppja/OByCwDsl8gvwM5TkGdLPGtMROLGBgVlu5IG3VXm69eXXFNBDZtPHeQBPPfEZL
c3VwFWu3uN3a/qzMtmhqkvmHIReCAQHIZSkD0qW/0+3DlCt+sQ2OsRPuvb1k6WNlTaz0+7sl
F1nrI3UtmXJF+SycRf86sRC30aZNXvqvY27hMJLrjPMFZVlFpZsJshWfsFWdwjx7MrxkPU7W
6p5gi4RE3/3rOv5f/ly64Wms6g5mxGDXKyy6hj+Yke+tW1gQEH5oTwAQ++EryC0SBTOnhG26
U9gAF4oNzDzgHsTfEQpuRwXR8XBmCnt1qKdAacTmQaIlfUb9Bpb2l2WRqpZ6JO9LLPVn8Ywy
6H+MPrMDWY8dyD7jDONZkZjvetVXiAbwmDBDfC68Afe20Nzv3BCBT6AMKe4gZqnzjO0BY7x0
3NaqLvBptqq35BIXsQCLks+tSsgCJmpPyeRaAN24KPIxxF0xgaCL69JjUqBrKZhWNdP9qhVL
5uiEVCQ+RTIkzGH9hdN0GnIOWNeZQSslOhTKeV/oIYWXJXGBwbn5ANlqBB6qAdCpq6qFcYpk
ZiwlVArpuaouhyLUF7mPOUfT2DpLqcrmynHuNVIsfviSRFv+ncKHTyOprs9t16jhHPoUmJ0o
m6jAGVxcImVDz5+IhLvqKU+sYWu340xbdFmh7TSg46Ehi3jiKCm9zEha1WeuyjqlpGG8EVO9
qwiA61im77ze0W76HbwxDXkGdBkBRQEqMk+LM0d3DAhAjhEVKW4gOV/9O3wNNXBj8YeTGyqd
sSrcggSvZKfFgHpJz9HrgdK7CusCvAQQxFkdIkbVSJdIEMX2J2Uyy5DfeB6XcXTM183G/vPj
TSst4cdscIwI+RHx/1U8fHOMjBVuTFx6ojTvO3FTUoS2FKdUJVgoSLoDAFlKMlZUjmVZABeX
U6kvUBWU3uV4PXpRUQXgxwtXcCTl/nU1cvJDC3UHOzYGlR38qFbEziyFNYtB9ks68kLJY3Z6
ddnftIdDhMTvytiu8F1AJzcQvVPsub3g7cKnJna7fd1WXKqJ87lJXOrqYmQkymgO7LtJkNE1
xd4bzDzSXOf09Fc08/P4n/msN0oaUrx+zTMH1P9VznzY84D+65q5C/Rbnvlqyp+oau5Zov9h
onYz7Y9DnypyU3PcTCVjAkXNpHy1UG/d6DS9SAxzIJWhNcDI3N7QvAOszXxYUuxFZ4FOhCnR
wgn6oSQ8HW62oF8Xa1fonZpFgjJCJTW4h390eMWqc+mC2TiYuMpssNntz8Y/09eFjqsqTMsi
mYzJTpBaJSFaTgBvZvEQXZJJbgC2h5svnt4tgOs2pldnFPnw2/NoAvqYjaUtQka2S99dMPOv
Ku+5KyTGVz1+3PNV5sCJnWECNK0IgU393fOkSB9yS/v9iqyblosLfVzNmEPWvu9GGwzyrsca
dL3rdtOLg9nwwdetXBObgdRmK5pK61+9b+4X529X+KjKHYcogBk199HzV4cvLG+djs6T8Qcj
o5FUguVZyHN0Nie5bZSU0qNqQZKLfHIhJXioQwoQwliiZELoBLu6vnaZTiZUCpR8PahJFE9y
mIjW2TzHo5ez6T/KkktrQSd31fU1kHc4bVqpxUJH6PqVTzE50SDnXqqD40+IVmzfXGcJVPqp
mIJTyrCIa0P9eSHOdxYcWIUd5tNdX6MJYI9kq2Wddj4DkT1mhEYl/xzfjdAYwB4lohpQlQfJ
akIa1mviob9NJLW/wiXR/cz3/owudXK1PU8Qk9PinPVISX2PHaigxcMtH0P1cmyhGcMlVDkE
Fr9FUoWHR04foyTLKZwBK90kM+JDtrSmjFGnugVgsBMq0Mu3vr4qEyMHEJZxTaxEVx2UoYOu
1rBxu1QYO3NQ3V9oBlLVkGsrwnCIElEnLXpxh/wgP6bZqJePO37dmig6tqVyRHNDWO0I4058
B94uZtZM3Mlz06jU5NJVADB5xgQJovZx1mIoLB5Ju2HsVYDiP/lASv1aepA5qo3Ls3wixXQm
msoNxkBYT4EeLQMVq6Y5wJh1EeidhZ10sHkIUEfq+hkXQh0qnCq2Vs8b2nBUfGH6xMvMi5HJ
6LCex5kpuWuf0hZWavaaNUXkUMjBPeyg4+hUI6lGnHH9UMlxl88Kva+DdzVG0kmSU+/gdSP3
TFGyR4FV12gH0zKiW292QfPGTpJPrGZ0qRZzu0g8aOUId9OMHTIMRkEvG5y/vtg0hbQ1FFix
VE+Fdtt3TrjlOfAVKgMWICF6NVM6PzJmbKKvUzRJzwHW61gZlI23aE0sIj7XDt0UXHbWqGr3
WFVQvsZsMTmU6dh7a1SOKrdWnUaiXxq7GWJXDmWU3hrpnhRZM3QPucN9c9iJNDPtCiQ7tEQB
1+6kPeRbrkA9L8s5OVdrxRPJ5lGY+CAtZ/HsCsuk5ufpsMMATOnS3cBYjlOYV1fd+LqcMZZx
GTM57qMJGSnQjwkchkGCMmFSFPGpMYmQH04MBIKr4alhWGgz1dkzlmtSAVfXN0V97NWHizSf
mCplhLX+axQHT1TnA9m1K9q/RUANwKmyi7J/NGnyPrKEGHEWs0sgWncYzfXKN+BFiw+qOCcJ
ZSwhELM1Atfh3S8iGswSVFqPVH6yXAO1N2li6YnVd/MxXUZbTgIIiqvglRFX5Cyq22G5hNhl
PB3AkE0Rj7SMHj9JRishN48qqMIe/QYno1E+lBrxeE+MEtglpkWE/tSLb74klhJaafilCc6X
EYnHxWGbe6YpjJIx1ahHyh4DMAH8YnPQgSsj89MPTkdy9AgPzL1Duomc2TGT3dHsGgCbPUSE
lcxsggPuh0d5TO+su7LPIpX00/95/ubg5K9vDxnWvVcC6+O/Hp8cvoo6W2jC2yrzLYJeT08t
kLlO5Gu2HYeFTz077VpH5hF18szr4/dOyyfuk3/w5ixyQtI73rg/Ivg6Toed+n6hcY02c+SU
y3YhC1cmXpiG+wWEV/OoXSKHsFG4gNhHlRiQAXHWd7ZEDOSDSZx9fAkDF991dkgXYJDPdViq
TVhna8zK0/kMTSJarZIRROgwfD9NsyxVwQaA0XmC/cpdZJydsWD2LBVfVc0YrVORbBpkYGZ3
7FStMFSlUqfGocXAzMDCN/uL8+a+mk/KFDbJl2iuIsclB3ui1eL0z837OFaq1l4mi7xVskXn
kvZJsGCFnLtf3WHw+lBH1loP8mCVw4RPpFnokC3MGbxmjY0u1Tx0yVShZBLJXaLsNFucjc8W
MZQe70y8AlxgYtzF80M4hQcGdjU0BIZ3mWEyPntmhNwLb9c8ULR1JFap24sZpFiCtZ5zNXUG
HZcd92ZFTxbEYpnU6HrpnyNXh4RjPMb/ePoi+NCDuMv/DuTfofvO5jO3Q/WqMh363X06n2Ti
hK95Rn539OrtyyMvLYm+yDNa9CKQtKbVxNHG795S2wUzjEOrhf1cMr8Fww4ahvVeGrovtT4O
wbMgSErytUvZABWZsSEOlE7CmfLF1IMQliKaE28Xs1uCz5T6vu5El6vxltSXx11weGYHdrBT
oZPr7TkGnzaKVgmusf62T4CeMtdPmV2+6/T7/Qp9iuAn/4enFb4b1/MdzbbSEl61x8LiI5e2
e7y1dXl52U+TctzPZ6db+KR/VkIv1U6cD3WyrH1tFjqP2KKnrBT+83SLf2xsNXDeGjS+NXTe
GtbhsGUAUXn2dMuHpr83W7Q57jHY8vZ1Ib9lL4GK8MBsfV04A+h+cPgwqfqtd5rgIF4SIX2h
Ch3QOdwJdRl9kY75WMwfB77XIiuTTxyBCZ2shnOuOp071d6lve/1KFbNOZBQdJLCWLaMVa3x
cEieZliXwJUTpTtakEqb1bnihffneJKOkJtCovATVoqHQ3qejLLEdTy5kLdUvcA1PZJPMFkq
w4ez490kcTLFhGQUrTmU+ZMGHFV7GbrqcCI/Fax8wLONyfUYo7Ip0hGp1ij3pdYD582aTJgj
Vi5ab99mwUpeoIHXDQUMViavi3GoCR2eqXpZxih0HtDdJUJyTJAkyBIAWe0+Vsckf5Sf9g76
7w4PeoC5vd3t7e2d7e37nqoAtW+EvQ2jOgo+lvZzJ9msWjgNPKazfJKfaiJT+EUDZWO5K3rs
VEV6l0FcJLpo6KRpAu6iuXx8yQt31/DHJAOsBgzouu9nFPt4LvG9pCq2e3dG1WJQJiLvNb2D
fFkWFTZXWGPhFC4puJs0RSteZD/k+Ue8vjqbagLk2G1RRApRUDYuQxoPGJfALSplGxJUFPFr
UvxUuD9MdzQBTKei9jxiTHGf0xKt8aM8oQyjaL6fmUKq5+loRNRnHSUK7ta02XSBZU7nWKPW
XBBhx3TXp4WP7A5gUYLHvUhL1qYKb2i9T1nvueG5zJHkqZ2dANbjOSPRCI/OpgQ5sH7d8tfA
EncmyWnMUanuhLqYD2pdg2t9QAuE/T3gbYLpom5FwArtA4AlibMGWNwEInKU3HbfTAT6GMYZ
t5MzOc8mhHulm74xRlLkbgTJ1hyvgtQV12qU6yyNk880/MkuvKivd3bBOXldGReuI5iH+tGL
UA0zp6fGuAEdki8Ln95qxAydctmmDcyJegcIDAYLqFmRtaacyiyFp9gHzm+0SQ7fFFD8kyC0
HbjrHj6UkjXaUreHiDdMPyvggsW8FCM0HZt97aSUbzkBIVU8W+I5jDEzynZ/Kc5FQfua3SmZ
D4VDk40MKgAknfAovIQqZEgVfw7c8bqovGXVvbTgdUfdS2ZU1fnSsFN0asCEq20U9e+zWTLM
T7P034AUiDAn8alRyL/J0OYSFwzebNFtSSCHrhJMQB37lwmlKaHY8eAN060oMGXjOIi7hOmI
k3JpD5CFtDou4WuiG+EaMq3Nou/s+jH8HYgBEAy4RODW3IgF73UngBQPJFLKWTupkXVqH7P8
kpmi5BxgBMQK8/06+cMF47ToXQYCSj5zxaPXOR5rOymi+iE9NCkXFKeamBhCMBwpzeZ81hmJ
faCzecteTQBhXEhGgO3aIGN6p0A2wkhf50mi56N6Nwq1Ubcwn3cw7BnyC1pxbT61NlansJWL
aJTPYojFgjBfn7MgTMeTngKvlmzKRScA5lyFCHtdlZ76jWKzfkgC1v19kA6u/p3Meq/YqZ+T
TB9fAac5y2GbxJainCf6p3wo4KkepMqbhArwTi8f90ZIqig3sYl/j2U0CcrgIYl+AYs8L5HF
Zgwb5tPE2DQURwGWP+aXSBu6vrGBAHJu9UrF/BT2j7EE74acIh/amx5+qlqcuqTECs9eYzHZ
oQSZZLKe1YFQGFCJ1TojcWeG5iFJJE/4F2MOPSqiTfU8T95Gf9/Z60Y7d//Rjf749njrj28O
j7d++unP0i/RIJZZRJkLZ4VuP5gCGfSRmsSzkWflwiXa4cnNsahsJWdjd+NFHQZ9zdT6Ugcu
xSREID/M3sSWmHBPxO1khueJPCfmoxTfRANjcCaOsddbxELyIDcLx8TxGcFcKBz/mVBQ1RYI
fQyqpjVIxXvB6urE2OKP/nZ5RrKxnIGp41BTjSdFjwnH6XEIWBOXhbhiiHVa4neCMyLNP+9s
ZTat0TvYL4r4eFDJNRYZtvEkRt1mdpHCEKJlIsuBngLaOkqJKsRNhYJoommw9IwgX4MIF0cl
pkwo8ymKO1fMc6+dpadnPW6jDbqUIBDJLTpTkO3zSthQewolGoWsYmQtmeWwmZi7FVAC6TdG
0olBtV9T09GEvFH0mubRog1zwrVY3WVaIAWWRKnAVqHrGIq+lzmQLMCpWZozxdFDo3q1xmva
mDrtTEj0w9MCW30J55aMHrOKMZSPvYnXktPkek/hc7V2E5uD97vRmqcZxZOOcKmSPKTiJNNA
EpJs1CvzHtqFnawmao/hrTHebrizgFH+5gYqzwUW706wG434hi/KfIY7pMneHAO75WDr/j6h
pSAkuJNBosSIeRKSLs/yqbomIJdT8K/OPK9E/4OfUSKRSY7yRPYJcHb0T3RWJS8ynAiH5hrn
V/FeRbYoE+dykp0EFyUPcSFasbSMLGUxtKWqhv5J07a4pxdXkn5CdCVxhG6MxvtYaossviBY
EjhHQ2LJN6Q5MWJNre4rAkJRNUiFKkM4iY3Twjgvod8nEHU2bJ6Rz6/Ib3TaQQiy3mjDcq6F
KrIkIbuiYu0lSYdoTYxm8TQdkZaeKQcqL5RyOA5+xPMVxAhPktEpB2bT8OzjJXywkjf/rhrj
hc8af3LXRDkyNtGQVJKGzjSqjgDNWfRXwyd2oq4BUoAHMWZGnGt6nhgRQaM88eRMBWlsgUxO
QIHqygbvj3UbyjHILxJJfl7EKMu02TB2N8sHcKsizIEHI11UWaoFGfUrhMgZe9E5GFqw063R
m0aSdU7dACtDVXhAJgCjOUe1Cwe4Is9HO6Q0jMgr88R4+gojJtqjnWoCJIIt5a8gbzcpl2CS
YaIXYI0hZO0etlzEPSkREiaTHAUjqvxSJm42D4l3dElHOQO6pcn4hDx20RyDByKaialS05xr
Mzlrnem8VO+9S8D6fqdGYGIDH5GOF4KIjpMkKiSx0oYj64lUh8s6qPQ+ITKUGnReBDgT1ev7
mTnD2q1T12nlTYVk64jGeIzjHVCVCjOa0AZ88pzc0avzAD4CWXjqp4zPp2YrSf+HmioaLBlt
VslFaUOtiZRl/vUjJdxHRf3SER8OYsnoCp75NzBfPnDF9QZXPfgndIoZnxKA1rB0txHYC1IZ
lwu4ZkZ8zGzIMrdipncggjsdVAYsVPMgcE8UuNFPQMl7+7N8no2s0JqV0w+X8EBl1hcoNPsi
+7sXB7vbe9sosT/WKVQIRnI+FYuL563aRaYXsQkvQsXPnUf3H6LUAusfRbvdnbsPuncf7nXv
3324yduaM+tQgFRPHvhoMgIYb+B/thV1xa+SLpdNWw0Z3V1Vba6QvX+XEqCP02QyYgMAqsLH
GL7gTQwWeV8nhm3vdncf3e0+uv8A/r1PNgXeZYSqSp9kuiaZRDroUp+EHsofMI+klocsQVpD
4lwe/Qsu4HQskh1zoxx5sfNoe3tdvHhqD3miNvWdXoR0ye7As6sknhWbxLqydy0NTk7MgPW7
29u9aTrMZQvo4AD2daMzPPqkuxSNCosPZK6w/XINqzBgYX3bKtOyu9fQFrSTzOZSPIHThsIv
Rsc8z+KLOJ0Y+ZywtllSXK7/Ql4eqQCsGU5g3qMjNhIFghlB1eolBovgXkXk3cul1I0Skiav
U4XmzmSRpx4vVZQi0eTJZDVLXqVy9QzvbaPJcXsROnMZp1yPZZewxG4mekUAW2GpMy3QxvTE
qAnvITAkoY0reZPN5RaOP4fkRB5lj8REZw6qnBp1GKSw050HjGGEdWTlOOeYA7nJJUGr7Igi
nPR0d1vQk5aQkRFnzaCqgodxVc9/wQFEvL3KmkGHTuJDvStmwzM8fZXrSlgEpkxYdA7pj9A4
tgPJAUhJRxBfVZyiObV/BDSANr7SO9vKsBPLydnz9Ni9Epu2Q65LniBZ9EvGqvcnB0L4zA0+
o0y7OPUeURgkMPAadaOvAjfzMScnS4Ty9lm0Df8tqDdAz53oT3E2R9qG9MuRZSuzIDOjziQ4
C5xAb3dn+26LWdw/i3Yfnkc79808HkQvksGMJoIdCQ2JalTED60gZBnGk+F8YjPQ2tpwSBy7
eOLMEuJoksQUIoWYp7UeiXehDvGpwTx2KkUpbO6EU7LshKtB4XyJ1/lCiifHgA1oBL7t3d72
g5Pt+493Hz7euf83lerjEcdzsTqNRRmLVa0U48/T07SEm+0YrgmO/XOCPPjZB7i+jUXpWLSs
ZGqSF6JCG7vZ9djES+zbFbBHn0ShZP0Fas4IQJ72th/cE3sCDmBnpRYM5hZmQD26DiuPlj5c
9FAtidloC9XF0BzVNN7TCON6Ui2XR6ZKNN2SvQFlsK4RtkkSlRAnJ2SWqRY7OEhWYrN+ulDQ
E4CUiC5NRmHTX+5R7zl5X/XS0eVpzzG1ALCZz3V/M+aBp1vYyzOMO4Nh8QQhThuayhUC9Doy
0GKdog8IwRvf1wUBXebDnKIWKSzOkbWY9LsGCoBLkZZzdbghfKwZpmIKTuLYXybZzO50I7qu
ASUFd2hg1g+kGam1pM915v9qCFeYEGkh6+wzjmIjpTDvCocJm1WwJhv2OtCLbHFVsFO/INY6
rFOwSTojTsHZ2mM3wNQmFhP1dvNoFd5BjDgr2YfSMRlToJPxPBuyjlA8/lkP1I1sliz/SEVq
MOGwzHeHB29evTp8/fzw+Wq+Z4fs1ma9zRL1dLM5irygnWiUnJMSEJmyMzG2MthF1b2O9zQQ
aUqjQaokPKZsKS6c7hFeCG1gH+bUH97r4tUAa0IvFZYBxStJGXaMQPITO5FDy4ZaucnpGW0E
nfU1vel5NiVXB0F9Gt4tM55esVmfm/B37PUBCyLnOWArTuewuxMMicDrDZfPXTi5TikOyymr
GyLbwIfEZHs4ZmoW7ZdlPPzohuI5SiNvQ2hQEpfw5NN+aGdCGtG3Fjsjg2M4AWvNzS+Yb+sP
/5rn5ZMSrtQRcGH8TWZqRUwu3dVDd6+RE+xuqqtI647MylEVXRquChqnQ+VMc6uDNDrk9aVu
v0+//3Q+8f18edcBgN913p+86D3sfM9u100BFG/f//Dy6CDq9La2jg5PXmxtoZsg3GrRX+Aj
KH4BHW9tHb4WL91OPcZCxljuf+x7HseD4c7u3t179x88fGRdeJ/uW2MF/5GOvuuc/as3Ov93
T3/a3nF9fp++ppQxkrUT2ADyJHW9alVF++zHJB6B4DsrURn+/NXfItnMp1vmFa8hxiA8s6P2
BS/7gIhPt+ih66mL87AL2dKV2J+skirKyimx2t91tj8Nhg929wZ37/W3PyXju3cf7ew+cheA
fF9ve6+3/ehkZ/vx9s7j3Xv9R3t3QQTevvcYpDAzoO3eDnkspdAF5juD3eHe6G4dfJUXetsA
44UwpdUP4tHp/MqAJcOCaxWwsPv4jLzHamPsumOk04u7Peiidx4XH6tO3U9j7uTZzqPd/nZ/
t39v++mW/lZ5FfrALp7t3rvXd/4PU5MHFZfrWi+1rWQo2h9OiCXSBY12hruDvbgZqvrCcqgq
qCpQwYX2zpJPjVDZ/jRKHjy6P37QAJVWq+RVOegqdF1DH6li53edwfwU7q5/pV5gE+PDzu7d
+rmYzybPHAd+4p7gzh8De1DgSdoapKMtaolvOujsDa80xPGQD/nGN7rG+/kWm4n/VDynRgkm
Sb3WDeB14VwDIu+xLl8K69qwUhNMx/y2NUVG9XelE3FPYcffaZ6PUbfF++xorX+7ReQWGQx7
6IqZr3x/EEZz0y93BeyM745XvgL+thr1j4HgCqJ817lKigX3QLzb22kgTu47dQqOCLiUesOC
bkCoFpPjAdyltYUtXAm26O1cbyVN99C1KK6/kOG94f3GHcKH/pyztJiCXBHC3Qlw1uk0ny7H
2MUzGj0YPWy+5eBhDWcMX3UQD0CIKKMfdrYXclsHKUiR/RmIlcmsP8CXV51yw7U1vEjqF9bB
nw97O48ePert7D5cenNBD/3ztJwlFH82PE17sKQt+JVqQcD37/GP7/w+f6Y7bbE17i16gx2j
Uz9eTTcQvcitrNCOVha72IG4MrkDU5GJkntFz9NCSwWKsGhu3h/zogxdu6imxzwjkckzEm3A
5FAbjcIw52tnzxdbhOIiRXc6WAfFk9jrOXzfyrVM1y7PirIaoweyJBwTTGMFrtTrHHC4SDfi
8IzyDBD7lHKcwwW5c3dnb/M3ie9XeFfv3ru7M4K7els+TXf1w8d3H8Bd/e327sqC2u7egst5
F7pfejvjS7/A9Qw/YE04nce/Hj18AOBw55EXmm3T71sKFnsN73Yk3JiPHxXTq03fkUVD8ucW
d+xNGX9yf1C1lAe9vcoEkfo929u5hwXO6W+3R+mhNZvybzgIjVuMD3vb1es9hOrnV2dAFFuI
3dzlNRHiBlxOHbg8kypwaQFMjkOrIXg/eNQK8C05Ari4R/msp0F+de6gYTZVvoD7IVFWW/xy
kuwxOepF3o1vTWQFPf2AMPyg13gbuTa2N7+vz7RvYQENdp4hZ3Ml5k8ijBIQpXv0sH/P2BsK
TGPDLATH/JYcJ60dOV7ScM3BjiXuJe044+PU0GxJTk7ojqxKenzASdPIyIq2Hlq0U1nqt1t3
gZ71/u5t6Fl/SgbEyOG5aKFmvb/7Be/twe7gbot7+97jvZ3H+PXhqvf2YBhiWNyny29ufusr
lKxHyXjB6uhpr5XeGKnmok2uA0U6/xquL5lKiDkg54l7vd173b0H3bu73bt73Xt73fsgCu48
6iJLcW/nLt9gHCDgDPrlbjGigkD2VrnHbJuvQn59CWRjchO5dUIdIKekQms0FDfj6wmtVmE8
yeMRJ1sMa4ubZFZSFdvGmK9qOslT41rO81y3EU0gZM7S4Ud1D/LaTmf56Sw+52wns7mI57b2
mTx/Il6xXlv2zTJlqjuzPC8lb6QmjHW6wN4LiVXBzMPUDsZPL9JJcko170J3NPLbVc/st+x8
o9e2iN1XNihQRHhdsQBIvKRhkxOK1V8b5RyD89ul3iRKjwuRpncCUuVSao1VDSi58EoSNfwg
GxySWvIsLfMwo5+Onj18dO8+0Ml05D8Cgmhb4hf6pTfiL7VXe+fOWwB6iXPz1hBuOHEabl3E
M+BbToutdAT/VJs83aquckWWZHdnuA0syd0hfxpYEuBEdnYf7+32965j9Y19Rs6Vz0mL71/a
7eRzbrir8rkovyYLJPR/5klgw/EpBf0829nbvbsHb/C3lUV42Qd/fkEp01K/IALG5dmzrXkx
28qnSQaXy9YghYuQfl6870sE/r1/N5uI8WE73ul6p/E2rLt7e6sbd78kA+GSefb1daqI4BV+
zJc8+8X6fvVWo8tXjSQHosuvQz/ZrL5GnpT7KKGoKSAnoyf8M1FmTjJJMUuTPP8YTdKP9Tyn
v91Gv91Gv91Gv91G7kT+C2+jyq7zcLur7zo33GttI0DqvnDTt29tw3lqd0MwK86aKM3uvZ29
uwFSw0iA1mZs22Lvf5nLnjy5sOEt3Pn1/L7X8uY6G1/Th+tsHPDccpzTVYj9KRmI6sYLc+Y0
URQBQvlOYIQ4nRSSFJBzxBuvbAq35LF+c9v6lZmCd5JHD7eXq5T1xgSqurpKeaExmB6TZ+ky
rTK/98uYhKv2VZ1N0MS6u3Nv7+4tmFg/Xf3bw68K6PhxS1fn1VXWpvtrQnznViAeAO/D7Yfb
NejCQ0vKqlNz6bl+nIvAgYtxiwIC+v1WUg63Tmf5fFrpb6ve4VNo+Mxt/RS/VF/CQXuc/evZ
Hw9Pnm65P/gwCq7mBnr2BXfl/d1H17wsoeWWpLiGsbZ+ScPxC6xd+gpuEB2uhdfVDHOrYJBp
ypmH5L5ccF3iKC8dW60Nk7SOWXpHcj1VzXQ8M4lA1p3MWiKWxzZHxdeq/b355bnsnkxHRc8Q
j04Eu0Zc8cs0m3+ySfbzwoywiy/e7y2UwtFmEiSISTkfBSWWBTEMy2neDWyXX8etbdyrs3yJ
E7KxhWOKsRylv7B1/JeCZ8PdilnVrlZZHtnevq7FqfzZWt5spVVgwfEuKovaCZHV/iVD1QIB
djxLRgsF2BuMTgZANOQVt7C0unyslN9vSbeO3QaBQCcaC/Eqz6fjwHwQAJ8+4fHd3Xt492Fd
VqXXWGyGLrb8dysCtJnI/rCmIFwFTHZq8QQwSeakwHvw4EEQeI27w0vAlHrEHDzDSmYwd/vD
opcvgddIWr89ArF1hdc5Mv6t+aFY0PLpViNk28OceMhlQMeNqcD87u6vF+S3AjhyAFgGOGCQ
JmGq0hJMWc6TueZqgEH5SHnYDRngXKzpsDeBR/WJi18L8MaXjfPms48CiL4XOvVbMnaFnOFc
PWJWI163557z/M2rCh8dliWQFwZZgpndHvLLW9iMSiB9JW46x1TvPXrLsRh/tjVf1f20Vg1W
K+VUi0RO8tM00woSXAWRcwCO4itKxXMGzImWWyX727pmPcZgSBsGoskoJD6ERAnK1ijJxGI2
/6FFhTI/QjeTtCwnms4Gw+22p+cNXi2B2l9Wpln3w02sVCNz4SSePNXEqf7y9Ykuv5ziDySa
a2n9Rmk8uY6RfCVbWfIgGS+XIXZ3H+88fLz9YHVLWbHA2RKeNcZnrsRL7z4AXnr7Zrx0RbmH
c9utzI20TXf3du/dglqvXACXkuCyHEEwvdsYq7jewGxV0jpXNlphM2OyWs7yT/J5Wizk+e9t
71yfLa/sHU4uaLQiitwYmLG797MGZgAlxfykdAlgMun0Ii3roT+uCu78Cjd4GmdX4t8KJDhN
ilYXZ9RQAXEEG9/D26ijJVcA97GEFf/YoFJ4AFSAfMt9ctBQFXCVkfPpooF3Hj3eaz3wEl6h
iVVYyB0cmBrvXHjeydxWL/++yMdXQk/cKA+K6xBHHMzMt16t9R0MfMGKh+HIVcyFG51h5WjM
GGlCUyS5rxR4iddDQSqYY4xq77GKtBIO47oU/3bR24se4Xi9q153IP+yCXru7u4NWkeOPFgx
L8OCUM/lWRi+xhwMcSByyDxqdUGvbm+7fjaKWw0PgWn8FhriXJ0HlkLWitsyK6aJb1h6SynX
MBASvMvqEyMaT6B+pvQFeVf76+J3d1d4d2+Fd++u8O69Fd69v/xdj5TaDF+PHj64fw847hbQ
WdJDGGaw4+Gd/RK8g7k29rEWcCFZR9eXmCeLOembMM/xPOPqilzhbvgv4KlTfRG9wjDrJ72s
ORo44oSK3QzmWJzApG6u2TfXpeSBmVo746YC/Q6WZY0nc61dRekAMaN/PHTTnlYchL5C7uHn
tnBe8yr/zfb3m+3v12j7uz3n1erYyy1/N/eLDbB4RF2bXGH3du/e22l0hUV/aPQTki5qqn3y
lf+/T4+2/+/TQ/j/3vj/Po3H/X7//z5tPzR+tMtd52+Lz3rv3j5S75DDJx2jVYX7Cuj757tF
e3U/HjBzI7mdH51P4WYBORbocFqii0d6etaRulolEWa6ODEds6qp4tF5mnW23G72+XZyEpTk
NmkSemyWPjJNMfW5A+39YYUi1HscYO2ZHorT8WSSjPz+pEikwHMDLeObK/ZPSY57+XiM+Y39
3if5Kd7Trfs+wFKTlKg/mlEGKAHrlrNNte34EpzSjwm0GMAVZVUo1rAimpM4OtO3bFkqtIyY
6qGdozvnUTyh2soUsItzIJWJy8sIZ6KhLDUbiTJGdSuJLWFOkcQd0WKRy/UsHcxLLMXncFBS
2cYpLOjM42vmiW7GFJnN/C1pcjBYKRkkLXQydx9vP3h87+ESnUxQ0QrvTRwd6+/Pk3N0QnRH
ur/bv+fMfxU1brV3IGkfq90/fNDfWdL90y2DJ7dKSjD9/iFWjCk8Iy6cog+J+fnZuh+E6cdg
LtTdevVo+PDgeSKKAGNTEakjqZiphmH88me6bg/ySDT6VNqHS3SPqDxPjPUnqGAc5Ro4TTBz
wfQsHYaoFx8EvEG50OEoJ4tx1wxDuYgIYZByPpeqBtEJ1j98nozTjAVJIqAj/J4Y3XQ6456p
YtA6FzXlCXANRC84NEy1iBodvjx8dfj6xEzpMU76j7Ksq2jDOX/mFRTM0UWz6/yUZ6fV34AS
XxA8vjedbD4zA++fnLw8Om4a2BkWkCIrIv9Di4jqn9+9OPrL4XOf0YzuEJ38llmpYX6n2vdj
s+u32rdZWAYL67E2pLHvd4f/7/3RO6d7puRRcIsU/vR843dvqdfN6NmCFro9rVuYzau2CMRP
eXHTYlppwCeLs1oqkE6Kc46oDA2l1CzPsHS0FjiWk5QU3baIyOxFfUV8GKGvfJhqVUP39GqR
Dp1riVk1Y7fUBe4oE4xOYJcdVkNKcCGjMXqyTvW/qEqLu3ZKVsaFEiXbZ6fWjSnoOqNVACYR
bdGSoW5xnRyYpo+OfzzMAElfll9aKAnx5NG4OhFB3DdsAUNhqXFBJi2qICKEiCACc0dfFkyv
Ul5hnSlkmzufenogOk7JIBigSuIAxDNbqIhD3GEKXK+zEM8d6ltrPBOvhqwtwx+WhkourbyJ
Xj1Sjwi492yUcD44/26jukRaqR5vhDjq4K3pAXwc4W3UoUysXLuFytH/2hjC6O/mhv8fON9H
J3+Nfh/Z7YmO/3p8cvgq6ugPwkVKm9/bN5/wb//4rSQHv/xbSY7fSnKEofpbSY5bK8nRJN0g
ZXYHbWA2AndzBel9sNX4imd7D/sPHz3dqj9oaKfMx7Pegwf97V23pXnk7kl44i5Z+TIuNIuq
mJ1YkalBILECG104H/jOWHIlrnInwmXV60Xf3OzDsLphJ15HwIGUM6qeFz035kC9Aw+lql/0
gktvbRAMN6nSHF7dXkeVz58ZKBHApBttPzQFR+EyuFt9d2FHK328jk5EtYZsmGH6NGcBo4Ou
JKakA8UQWCXOauh1pCxKN+qsAi463V5Hr+BITGg+oinAEsqv4tnH+TR6CU3n2M0GTGqzgqjV
pVnE7Xai5/3oYD6bXXWjH/vwZBDPutEP/ehFQq5VKQoHTTC6NTy6ySfq9dwz8t3NPjylG3bi
dRQdHx6cHL15DbiMiTGEnaZCviPL7hf92x/5Jh8fqtzlZzv/wj8IKnaRSHKaZMkMC41zVPEn
OBIkzGEb7YhrJVoFtAjAfACSeHjG9YLjKEsulULqkHDitBsqEjxJ0B9B4IfT5lkb5h5GQWj3
iTRXj7yN1dVR3M9izQf+dQcolOo4OkshFmN9dhHNTFlIpB4k5MLJdZXyXN1e+uHq7JrxROpB
YrFvLFg/xZAWgN1oAjdHN5oILWAREvkR7aXAN5dD6nSSD+JJI6RYR+SDcwUd0Z35LHucgljx
GDp6rD3d8buvdHO73T8mODhtNkCEj+eTEkBEjqmzi2ST+pLf/dYIX3fE169O3vzv4ev65I5e
vX15ZKbX+XWQqV2XTLEWxqNTUXSYwd0yI+diOdhYWNh05HzOUWMsx1Zw11huHd0CIt2vgwD+
2ayX1Sh0hfdVXLFLWnjGAGhFnx2OoKULL3vGNqKKQRYGrxl9kZC6ZlX4TkGI0eYCilRdgtSw
u9YaoG1lBf4a5tnHDDVFn6HJOVIxEG7TCfwxyct50YMFwUw+A5oMkThlMfz3At5zzrOR/5Da
u7Kgfsc6V/ZPEp6rHdx3Orhf6eC+7eC+7WA1+DnySB/FsdVAWAqH1oQGeQ4XHIJwcFXiDsMl
OQPkSXBBJjYBV4DlvOlXVa54cFBvV3iOpjCEN0wSCNlnpGmrrJh9GvrWh2GV9TqtwusdA4IQ
thu/iFXmhrGj10Jl9ABZiMriM4RHTLyTVoLZaGXMSJdhhuvF5ExLvzsJ+uCbdTvysEL7oKBv
eM0J/lZiIt9WR5CVF0zNKot2F0yOMYj1OU4Od4yQeZhnssDr0D8JSr4W0mDE9EKkgaM6orhq
JHL5HAA9zdOMz+A0nhWJ+U5u2MN5yecyiX0q6MVor7I61KJca2moIGpL2ke4HfEY/zvMR0jE
R/RllOF/KakN/PsxmQ2SWe7jX0Zts1T+izUViYDBfy7Hl6us1FeX9fk0rLJiadFmxUYFiCu+
QCyseKWtNHHjzdRnb6ZVJi0tmic9yS8R95JROscLGP2kEMDIwK02TTnU6sm2yiRNm1UmucLU
0AvyWkiONKMtkk+nE9UEA5VRL9a207xKiq0sd4U7uN7O0JTGuvW+KSmcjbQ566P75Ae8fC0w
QpZXEKFhLVfEdMHbocl/xZLJXj86yae9CaCTEaOrsonR1ar+NyiXaGOt+oyXDgnoYiks0LUF
oxzFdPoVyybqp+DbH6sf67WywVbIz5HxY9oUPZz6olhPlAAg4fN7X03wpP6AJG79vTZTnkDT
x85UDYjdyFr2uqI4xb+/75pX5CufpW+6pgs+Qt90K7fDt10ntgXabZwAky1wMW3fSAiKwqsa
gbOJ43vMfyMc6X3TMTu++J8m/cad7TvL4F6Dr3VkvA58KyBtuUIz5hdf5VdNoe72o+P5QNxy
VPHBCGSSFTu+v5SuOEigyOcHLw7DURgSxUHbvwKKVD0wTXiICspuZKPevm1CsmqHK58M/0hX
P3ZGUn6pGxXpv/EQcFDa903z8rpdeVKW9oQ+VTBJMYzvWwHMdP2fcbruyf1esYBb4wO73+vd
zg5dcRY8YJK/AEth8RUfhf3d+bxiEoO8DHc0SNhoC8xbMimSy7OEXK7o6NMxPkez3a/gvFbA
6nz2X/81qt1pvgeZvhrQWRDSOcquJ/r7HdZAWdov3tle40bNv69c/5Wj9v1+dKgue5q4wynT
Rk7d6PWXwh3QM75hRRAjN8iHMkFfP72DisRwtptA1YhNKqINtcdVOpCqfZvigkg8FL1tnvwa
sFkd6YIfS1ZRQwLUVOLRGmm8dmfaWf+85bjq8jdAvedjkKTnMzu31jhOpKTyUuvGKxk4q43Z
9feaI3N25Gs3rk/81oiCYov4CTZ8atiCGgcHabqRpI1oRB/u/8bMsWoJ3M/vPQ3AE9tOBH7b
Gi0Es7Fv+bx1SIpvYMOnPSS7keaBbAQqD3VjoJKCpfL8KwHqV31nPUBhZ0oZoYy7OWWNR7mF
JRy8t7gaC/lFjfPwfUNpGtz7jW2SGNmAXC/8k5TDX8OdI+6r4Y/FfVkfrI49cptvHX7xxihu
lKPOx+HKyIqrSF5H8YtJnPVwI1qMWr91qPH8vM2Ur010rDYn0KsDeFZio1qDrO+oGDLa9+ZN
MJ2vPK+KC3HjvFi2m88mjaKv15G9GwM2i9/7Bg3Lbdf2te0qKG9446e6CswPAHIqqZTINg3g
PsdSF1f6jZO/yDdLhkGM6InAjcGZ+rfNZQzbJdY6+OsILVSNe4aNvuypEYOxgrcerzZehemp
tV5lbxg6gW6dveHkEbA7Jml0o9bAdnmt2eCVHZqLOxt8b+H42MnKoxNKhIf2Rmc3Q8XGDU62
AUga/zOfiV0HvqWZ+bbpoOnGsOe/CN+9V5uWRbNbeU2ar3vZmjbs4duMPrv4X5uIdNkOzcXE
3YzmbRfyetHeOAvRSCTamZg8W+QW3OzqX41q6NcuiL/IsRe7ePNl2RYeWsJwGTxkX1NU+eHu
Iv2cnQIBTLKLRjhI5zcGRWvxSdLyLVvMxobiKXCN3yOibuBfzOZ9v4k/qJ8S7DbwkGU+zCfO
6Tt+/eqtlRBs2almwYuf/3yQsBNcCImcNnQD1bnzDG3jAAoNDXotml6QLD6V9MXiJv94SNlP
j55vohFKVcKNILBTWnk5lL2p8VO9XhpJOj7+sudSTPk3P5eSrGnpigWR+fJgVNaLhJF5ESyO
RjeGxkJFa1pRtHq+YavDxJ6zxTABBhbQ8TQFpHRqxQnFaoKH7fw/Qyx+CGIxJUC2UjHFVBfz
Qc/8AhJy7EcGBCVjsv7FE8Ao1Bf+GiTgYV3QqWZXcCSroSfNLJZS1V/6iaA0OvqtjsquebvF
BJ237Y2s7rXO5/YZeyfJVQtI2rfNQCHXMANNfmgJhDiErQ5PJ6a7zTTN2z8zNK3XSJtp2re/
1DQbRRjOF+d9mufJb5tRQn52Zsf1oex5XcEfcMw2je3DJ8HGiy8j49dLja97cp0Uui1AY982
A61isfnP0tQ+ariSsty/lShcLNdbJ3gj2VvrV3AbOYqmNihj314dOQOa3wUjVdS6rUeZVV19
F44yO115BEm/3HIEfnvlQXwNyrJB/LevM5ijnmkxmPP26oOdpitsELy9+ghWd9VmBPv26iOx
WNl2Lfz2tUZhAbjtKPT26uNYfXSbcezbK49k9NitVmTeXn0c1ZG3G0ffXnmcJLuIqp/mceDt
lUdwZMUWIzhvrzySKhfbrUXfXnmYOnlbNMyNyFuduC0c6ibEzTHitACe8/bKI1VsjUtGsgHu
qwzBlte2Q/Dbq49CGqHWC6G3Vx4kT+vqquZB4O2VR0C9c/sR8O3VhzB2qVZDmLdXH2glaE2v
A6287su7YIT8Gj7DJpi39RCT6xjUxA+67Ur47euMQmr+1qPQ2ysPU7kqlwxzratyPqs65y0a
wpr7F4zQlLtqUb6qY7EjoFaoABlYoqMoI5XkKD9CryUMd38+i8elSV6EOSzJZ9kUaOPrEj16
Es5PlGan62tqqeipr6rrMT1Iykus5JaaZEe2VExBVWvX10gaPdf+MXBrfwI3utSCmXFSFBRF
dSnDPBvCjAtgZGbQ1+RqfU1C8jAJkqQX5jmYLJ+4kq71w07LIpmM4bq90myjzkIKzKdUYg52
dymXZ3lBxYLH7IkbT+DdLofaY7MuzCIbbaE29yJOJ/EgxRdoiCxhF95BQihLNe00V6buQjE/
PU0wOpaczMltl+AjflQlZl2eTKAprGIWZ8V5WpJVDOVUHjoqypzSx8hyNTOMO2oUn8aYRsKv
ywMjSBdmcBdKbftZl1I+4pqPHtwc8RgPz1LgM7JTqQnMvVC2AJhwPi8RMzl9aTHMpzY360hS
VznAOpaW9/AlPyXrUe95P03KcS8dXZ4COv5rDvjBJYswPatFbErsyo9HUvMHpQl0kx4ZNFtf
M9kV4DCmQxPDI+DnC8oQLIIcZS4aJLpl62ujBHP5zyQ1EkfyUAlD9drGjZU8/jYLkDt1OB8S
lKAVA2ooqA8sKsJxyQAA0/ko5QSyvLvxBdz4MaqRYSmjOUexWndwGP+HHK0TJbwczxg0sMAp
ID5sri4VqxrgfeNFL7Fj+Tgh40Th7NdPfIQrgBrlsA1ZjmUQktLdDzGJjCN3n9fXVtro1J6Z
RBOp8QboSrsY04knc0DJ2tKZUg5oB5uWnqZlPAG6f8rGFtqlISoRx1eSEFkgXfepf0KYC7uG
5KkYzouC08BVsgfzEB9gCJ5zGOMXUfaj/df7VapuUw8CSn0Yhki+Pw9OUVjJY2wPiqSLx9R3
9fwm4gduw2YAyWaDFI7H7CrqxGV+ng47SkiQkGEMfubvBGUQvkzg1MQ02vpaZQzZJLufJZ9S
Sf6lJGpwRTE7QGGyBDrRqDtCequltFj5Ag8hSS94XVCwYwNGnOdUi8NJ+0cHOMWTidkw8ADl
M5IPJwQoOD3lvIg2YEGU4svAFrqHg3KRxlxWbAAdr6+dJ4igaXGOpHATB+zo8etoV3RiLBEu
2NEWgICrxvz21Ru0crXIsoA4o+o+Lc6Q6hV+lkJCPsEwqZUaqAbHIJZYdpjrIRIC/MmmNtPy
J8doYwCQCNF0o905jNEZV5GekphxBiiuYqK8Pe6FpJfSG+rKvbwlaTlGefFogkTcC+WNM3Pm
40qDMENAB4lzzpGqJyKWJwcWAO2PmM5qbS32s2AVJpk3Y7NNksWw6XecpOMvTC0GU4QeXZvh
2sM8TQHi8O7Fwe7dvbt4FrsMIGc+SFvWOscSCsqsyTu5yzqIEdAawOH3aKb/YZac1i9DzL2O
OSBhuy7cdAreyJU86gZWCF3Tfze6yufRq/fInM8HiGt4djDrZZnbbeYh0QpkEpfjO10bfwcb
OzXZwmDOsFszicFLAIdx5HE+pxT2NfDB6x/0rTBtjaK3UgvQ9Aa9wMxnhAzQqU9X9WB0MdEM
5tXTmD5gO+F6nFGifMDoyQjv0L8KBKAbhXKEuc8oOgC4m5myhlzVWJhaQPM5ZZrneVQ5H7lK
MyVzFbhLcjbhfe2mORhenBGtWEPn4VOefgbEKQJu5qMqJ2B0sf7i9QdYRTZnza1BY9gJVYmD
mcs7Z7+cO8lHQi69AfcRya5FeYV9iFDBD+EpJjI8PYFZficHjXyfI/SDetx55jtCS4HnYDM7
N2nKTjDhJjz9BHlDPs2PZT7wGrxQxlo4hH4pkacBRuw0A8xLT8/KzrN3AFHoGp+E35skY3jt
f5MrEORGLd58Tmg0lVV6bw+xRNzwGfwrXk7y7Q17g8sJIiVayhyXect2sSONTC4b5zE+R25e
BckXmKs62uj8wO92NqOL+SQzSK2t8NrH2qAatphiPa+Fqa8vRoNNf1q7Mq3hRRKY0AFw7IB9
f3ZGT+XKP/wE+E9828bBnw83efnu6NBjHwSoWdLPZ6dblWH3ZNhKHp/KFPZreX54FBz/DI9N
N3r/7uXmE23CRTPizOVmlHmGf0fzoZMO0ZE77bCw9T76Kfo+3aLSxXowb3iqODxtpdMkoWj/
wcdpfwjoGg/pSiqkjoCjG3Berp+qq6SQv7QCQYHlMkAiNlqBmAPPwuif5cuac0Grnx1TOOZu
JUyRZf5X4EkplRFWxxOtqXBNPGls/gvhiS/SrYQvyCP+R6GLpPDUnbK5cFWUQbWr5vkkhgu4
4n7SZ0aOkyQUUaeczYG3Bb6sM44nRdJpuM+vyqRhJPw3xbEK6BCkq4c9kNw5rehGkSQVlhp/
J91A0w2tmrKWo9m8pYHB8GHxIfsA0u8sNKjezybh6bJBbWZUSXMaGHRUfhDgBka8KyNIWtUl
42Um/WpgHHkUGuWenmNxL1w6zOuTt6S7YGfEwGDQ0wfzQmjI+zKGWoWWQZJoAJA2fL8IjYgP
PpBsHRjtgXSPVGjZSJSXVqSSwDj4+AM/Do30ULrnLV2KlI1YsQwVH0nXn86XLOgvr172yvj0
FKgVKcSCGFgtKLb5s1NqdiJdjfcTX9L/KCo9yS/lr5f5ZWSXGCKynKpSvrzivJXhFkotMael
/Pkjpresv/31brf1/v2P2nDONO2c4bhE1RDWNGWpmTJQF8V4PgljgclQHejDe/a1b/B/HMdF
maKVPce/RTd1gXJ3egH7jjk+L8lKxRsGCwTOKh8gO+Zumrvfo1yZ9X3gybOUNd2FREYh1nid
ybGp9qYUAQPItbss4vAWLGsZc2brtt0pZ0R5sM306FsWp0VBpr/pLB+071JZHwwWkz8pDvAa
oFP+hnz+zWqvsADmKZ0x1FdlibEYoIFE44BSlo1+XrFluLJaUaOW/qMOUKX4hL+p+1ybgvUi
yGGjwxMily1WUeby+nQGFx1l2pXkYWxKm2GNH1Kqo02NPqMEzUqmHi1gA48yVBtYzL5S/DY9
6xq/e/mKaWK6iI2jtADIkq8KfWLOD4/msDkp2EPnu1Zfo7ps9wVjga9CQRpQfY58XvbycW+A
CsINtAJO0ejflToYXXkVZ70Ja36uBnI1ibDNBD+e/4HaNijGpR+mLl5dkOo62MuEIoengMkz
AhkBCHeRmsrr0gGbbNEUgadUmyGTW5zNdUtGmF0aPT+4K3g4yYn7hU76YaJlyIIzu/bUof+z
kwcbZrcSieBou/8oAmG5ZeJ6NNkeVoefpGU5sS4rpDbFc46qjXTUjqeudRqjZfm0fa8BvrvW
J+WZb9uhoqzYypr61NrWRK1wX1NOhjVQAyAb7dJsRHSEKWCrSfxMKI4pNH67/3wN7/P8HGuT
awb9fEbESSuPh9E5Himz+BNsNmaixULG0f7oAjmyUfSc/BjRui/R70UYgeOxYTozuOsuORvT
MVHwaOME74V4NmxQl2E5DvnzACtzPEc+mHZv5PYTZv9GZuSGZtHG0Q+vGhRao6zwgYfYEhxO
9VFUJ8RI4GiM5sohyifXdUpaUUS+/q8WGEFFUWUQVQ5lZldew10ymSzdBtX2gAShDblmdnTk
6Pi1bbRxPM8qENnZtl1gfZM23bzFOiihvgyrUlaQCwOCCNCVBopGl+PLSgu08P8EM6CSP78A
p82c22+kpmJMEoaWIqoXmo7iUi/L/eIqG57N8iwHrCGKgDGcWC0WA1cIy2KFdojEMDcqXw7R
3xj6SocR1WpTDnsDHXoe7u42UBqnoJs5w+jH9ppKvEndt+AslNycx3qpokItjiSrGbBcMJ1J
tPFq/2Az3IPSnCJTYgd0KTo+ixEV9Jztz0DgQBfkOUiuG8ev9xs6U3J0ce709edX0Ubn7bs3
L447mwsXo6TJlKrTTt5e3CV6ZuAJJHGUgwA96o2SYXqOmu9cvO034v6gP+yPGhTcXhm8Rf3D
47jaeZi6afk8t7cK6iyYcDcq4GSfdcl5lgQkEH0GyMXoSrayRqroVe674fjahCK7WgB467L/
qX/V/3cTlTX1Au287ntQbiC2Xp3Bprbtdmhnz+3T26L7VRA17kOly7uVLiugb+7Xhe/PfmG8
J23Ub7eFe1uQWq7FVWGLVzkaR6eilWr66neDqXRlG5I7I4kurEcgfQsHoPr9/IyIcdTgiPTf
hBpuPUhnM9V3TgtYsnIGNWq4heSWNrhyVE1r9AJLrRLZ8yaL3mfpJ41O6kq4A38uVT9HNazJ
20THQOdeLQfeoHPzMpMFZo2Z8rEiB3kUmtiLSOaoL8tUZU3oCku+8qRJfINKq7wwy9MQK3Iq
34g34ZZgBR6dI3Iep088Rw8WdLtF5d1gU33w0bsfHRnokQczACopNwkQ1Bx+6kRl/jHJulzN
W15nJYB178ddcKaqgNbXJXxGjFI8C9wCLtDAFUeqG0iaGNa/pZn4CKvez3m3A++gygEjD/zp
NOkVTVXRwG4pGJwtUjSKLMaI3YC849FHaQjQ1+otjE1Im65UPbqW++gn0Ygx2i66RivpLV5G
KDSQpVPMux1ATlpst2MWXyYTuNPgEapgw4ytLZxaWe9+xrVGF635LHb2EBWYrAPiWXVdZSlG
ZxT5sKevpxRWSVl6xCBkY57tiazgtEQO+CcyGY/Rafsi6VSRFWNzalOWDJMG+FoiDy4XNAGZ
SXBoD01NX5WmML1X80mZYr4hyaZo896NLTxSkXIq4T7sEHslnicGB8aO+amyVXcrBJAk2gUU
kIvdAgA20nFko0g39fUaZawCiTZA365TxihAEvVtHXsBaVRxxqnF24B6ZiE4Dn+xk9T3kRA0
Ip/2YHYbkXAp7rVeOuOeRWpAQjtpwp+mWSsamhKN/GIV//R1mqXFPzgePxw/B84FgAdLCR6V
81Vw9NIljV7VqMkkco+4rq6IcjaWdPgXCu6uuOypqOmUWa5sNEjPPKI5ql0eobsIZHk2uTLN
KC7ahY6+fqIPXJhyoAgvEYezt/xZrjfQeVwOz6IkJRQMXMb1ncrtNFajXcAeTUbm7Dhd/vym
nxekhvyNxyQSGiCuhEqu3zNsJoc9j0vGE21g2DMO013MF64y0iAZ5z4n1DjU14o0XDTgPwpl
5saM8EMy+whU9ip6//roL9GLGKDaaIRQPEhM65dpNv+EV0rRYRQoAs2MX/y4qmdvHEkZvUWG
ljC/kZWmiaOGb2ym9/o4LneU9O/cJx9sbf5if0H7+7b9nq5zb7d9e9VNTodm2p23B51o49Vx
7/mb400XqkiyD5733r15FdZB/jOfpEYX9Sf6Iu83741RNhb5o/v3FT2Ojt9E+HVh85/xuLLa
eaVDa++l/6iDm+UKCzGYSYZMkK6I7SEPlEl+KRWf6PquK5L0IAMXbP0k5U0SUvGB9qx5XGom
P2PGmqVOeIPbDT1Z2o8e9uRTMpw39FRhluXVhg6VFhRJPBue1W6rBf1yC0+VQri/QRIJx613
ZPCOmx8rN/z3SIyXKQcRI1ltMscm6OfXZrn8Ju9mfbn3ffjtF6tBUPpEb6LYEZ/DdIrv7LeW
6WszlqT+oF8ZF2qMaHBhStjQ+ekNirrFWTptMyA2YOEYWxjfLH+En4l+SWWX39jUs3g26mHp
mgD7+IdJ+QTDdv9wWj4xYRsm35VBTG1FEb6GvokIQxjhsKD6sqgysKx3lMRFCnIY+8VSZpEc
w3deHHun3dFGwsnGgavaDeMfhZ6LvWme1thvVOZP0rgwQfsj49Rg824MTJg2ZaSIkY2/U/jQ
QFkbf8AMfi54qlPaNTQd+imS8KSEipEwCudEWJQnmJ4HJWdD9Iqr8wHmx4hwvziWm5YaUa8F
avjS4ZlRUABk6zXRZSLSpEGTV5yBLACEqEmkMDggWVZ0ykZbqB30O1GEuRX4W8RZf1CdOac8
K2Z/SfqJvPWhtjNGjSTrsS0hx0TK6v8FD9KZRhIpAFBNZhVU2D49R+GG/LvlvpOkUg3qsaKE
q/a8jjv7E8wFh+ksKPvOMb0Wbew/B5YwNaht9o/q0n9EZH4VD98cw2k4RuhzOoxJRc0eidqe
NNgpaRcpxwbl4NJXbZod0e6TwxAiIjJkiIgNGjIF7XWPul7p5mTkAmt8QNtVQ6hWlBy/2SRO
a7W0GW6yjOjEpC3RpBleMhPOGrh2w6sBU6LAR159RofcZvHiNAYCfMnwRGXPNTzVy+ajzt0M
Ksz9comGZgBePBpJkhKJYk36p/1u1BGnlg7ug7nq2txOMO02U3anFjVMi/qpT02vv0Vzew2t
Ktl+JLj6eTLGmIfWEw3mb0FIO9OlfmDKZopFlgCPMUNL/aJZvpLi6TBUYMK1KZo0NWkmJVoB
cpIIsDpFzurXk6DklPWj6NGvnq9YbbzgG1LAeykHHoTTMuH8OZylZphgcjzqQYDi3KPfL1gf
OgJhbQxgCAsMk8GcH71XOG9Br9oSKakOgR9f9t12zECLjq5/jBsyY3nA5vvrgFORaVqsE6bO
RObwWuPkVpKmh/A+nLvM3t7rlPIokDdrgIk2MXeZKm0p4Vc+ojRNmN1KTB4xpU0CRJr1xnNy
gcL8lF7ezZT2CwOHTjPKEGnyQtYza8l8vUxulTd9XC9YDuBrEjoxHWj2xCxBZh2zyKnOmqbZ
ldRdHB5VqI0SWLR1ugYpVgFINfCaEy9b1X52tWg2GPwkMJcuiU9BBX8G15OGQNiQB4Fj00Zh
NrYrTPWCCnI3GeSauW6quM46/c4Qo/47cPivol6P00PNgX7p3JH7qMyQUsoBOG3PYkeaXKFd
djyfWMYIA49R4//nSt4aZx5dYFGLIaKEOznjxw6cEA2MBBSu+TIdzifxTI3llgRwBInOEtmn
+tvryCFnHALTmQI5c2BoLT2T9KPmf4Wl5Tmm6owL3H3Km/kxUfzxd8GCzMMDyflFaf/w/KAb
46XoC0q2yyMTMEPHLOBVhumUrF9DzGPEeeD4QnHQvrr7hMNOvleYCNpeaL5Av0bEYKDrVw+z
I40WJMbFA/ljfomxwd1GPBAUIzQAPhloGrkvTKAVBSQijwX81JzMz0whKNyKyAjX2iZngKRU
DIm8RKbu1vPp08k5cL1pgrs6rRDgrrPJ2accllJK4s8i6hwdnrygXJi0Vi/73gnf+Y1nflHG
unUMZLI5684ZL08TyX2KL1EGuAtrHT46PP4jCoVXU8yhxo4L+jtDtUgSdEicAuj5bOFBpHBU
s79iLLHJ5dbJ4EV4v8GcQGxCDshxG4H/RzY3jilMiuhrsfll0tG5d6GXonTrPB2NkBtefzqI
hx/xX9h3lmYKvStfM2G5wERx+gyvxz+kvVFDWtcnMOT/9Hq2M8MfL0gFSzcuQDKTm52Gf3Zk
Dtxzc+BeSfjeoWaLfef0AyumhtQHJzuOJFtiAZwWCIDFfIacxXedn4BAdeC2mkz4+6sYhCP6
kVvns1Pgy/7NVDUeDGbJBazg+LjzTHNwmzRrorUvsLg1uqO4TYVR4bm0mdfhDJmuZObNDSmr
eVCfHwlN+xhDMY2HmG1tBhKmuA0umQxxHKP46rvO8+cdEOCz8gzGw3860RWwHd91/gof4dCe
bpktAqYK1ZcYBRHxJOGEdZiL/K7zF/hwm6dbBg+eUaWntT8Aq9L7dD7pYVzNzvb2/Sfuj9hX
0dt59OjR9s7OXX40Hu7uPbqvf+9t36e/Qwh2/Kb/8P72Th+7phy6Ol9BKBKUvbJZdLIEk/gW
RYb5yLvu7Rs9wDYvwToTYrlaKH2LoqDuMw7u7QGjT8xJlqI3LpqhHuhYMsrKb7UNdLbP2byd
e2bzngNHhrlWdP8IFrIXBhy13QPQmd3TKUQIyy6ieY5MOxO8+rau84GP/pAWeQ+bwPY9fPgk
0u0eD3f2tu+Zrdze2zZ/w8Vi/t7ZefRk3em3CFMkZ2sAfD5VCqAE/FL037962UBh8OC8z1jT
hoEXJPC8hL2ex6cOzeNni6nLn9xT/G5+PoiBO1fRpv76kfv6n+IhMHMK3NDrf3Rf/yHPh7Zr
wgLeazg3D9uc1aPjH16b7d7e3YYNgpaBI6ubs/vgoT1/D+7VNqqW8frHtCBFJmYHd7zaD+gc
OYlGh/LDM0mBTMllCddg+cI4AXHHAGI37TGfXYrABAa/mAKC4s6dvDmIHJSZUhQnJm9EboF9
pvVWrNZeqE8SJk6KPUy73dvZVqnw7z+8+AfyL8DrIcN5DpPDIZBPur/7qMd5m7Gbv7x62VfZ
VJrtE4dZy1vEINl65r7+4/N/yERG6jQpjOkFKophdGDw5rNJseSarwq/Q/Q3nySjU3PzGsiP
DW+IYa7AS84B9UiZpEGExXyAGa8RJ1k77Im2UtnAuKM6MqlouNNZlIzHmJBKlfGGZ7u0AiKn
rEc/NuF5odlZMpk+fmpyZQOQnueYH+Rfc7j5JsgTZKNZCjfwD6+8+++Cr0Q6EsdTRIsZvD+J
U5AgThIDi8Y2f8L7KHrZj36Yz0YodhzEkxRWkKUx3BKjZIopzmH6wgJEb8jJPp95nQBvMYye
x8BpzxbP8A1XIHhO03t1dBK9BBTMJxmQpEFO/V557z+PYZeiP/Wj50ANz/K8G+2/OPrpwB8c
pKAYJAzlH7rRj/HsIrmKXs2B1z7AQhWnidfiXZJmaImBF7PRJTp/4LSXcD3+kNlp76/zs+jH
OSBwl5JC/JCTd+YBHA/gaH0Y50Bgh7CL0P8V3DfA4g6J5xuDiOBP7eAK7jgA/avhy7Yw+uMk
yVDnnRWU9Rl28AoTlR3nkzkx8IH5v41BFn+D9rPLGFsYPhST3wbQ4x2QmVGcLcG+MpnCeU6i
YwxoK5ehgm4bbO4xYNww/ghwhFmUTmzcSTI8y3J0jk4al3EMOzBLElh2Wgxz3bTgUDBDkAFh
XnAjIn0Rv/3jOJ5NABOqq7kAAfUdzC4D4UegehyPm4/ScTmPZyUxOHiCRr2DMzxQi7b7VTyf
oRx8DNLy5Bwh/Dr/iCfvLax9AvDMK6j0ZwrJ+nOcjq5iOAx/OXx94j3fz0ZX0U/xBA12yw8C
ORSBLP4T3DBLaMuf8rMsOujj/37CeEVCzXeH3juHsxTIALyAicljPjmWz/xhlsNBC+3jcT96
AZzJp+inOQJgVp4BFZqB6J6h1Qdvf7th62zYWHgFZNGbC4xYBjEbtheYI7pN/4L/FuhVS1oA
os7PhTq7JYhgt4HmwWxE30DpDXOnQy0sospz4a/W1+oMlqqODtmShMZWlMNANLavFFxBABVL
c6ptYioguHn1TR2FymIbmTuj5DUqCtKonON7ZBo0FRfmhapLqnkNlbVsHASG2IA3Np9uYctn
cOkhtC3gWAEJN+8M6AgdaU8/SEa41OhW+Cak0k1IuM7SaSE9jsieUZgGCDXRmWjWfvJW0du2
G10mzEmYlN8jTm0Hp8fVlvGQ1rt83SmvoLWD2JpXOJ7L7r3uLahRV0Tm4TNM0lBTQHHlrKI/
P598kKEsr0RMPb1gGDmZjRkU9yOsALRcaGgMYcS1gtf//J3Kgf193akR9m3P/XzrPvrsmPHw
G5UQo9f4J9T34Qutu7N2oZ1wd6IL1df81v1+335r6vh1uOMM4wlC3VbnC/Dyqp6xFCKFz/i0
YVg5K+SczaeyU2K/pBJceUlUJqYiB2gOGaUxlqgr2K5tbb3cRmoINVY7eOeeGFPMwB58PvNi
KmAXfPV/uMxtYQvbCevpsR8+eKRRhHP4GOZ3hukhYxZBsfQWXL6nHoWqz+/IaeTO1ZiIn7lv
wIGl2PwYQ8qSGYFgCxhzsf+Kft+bLkWaUV+kQNZ3ZbJc+8azH8ItJNGixCCxFQptIg4gFTB2
FsrTB+dAXocFW0mlIEscddKiF3Nu5I8gc/TyccdrhU4KMtuEcQOJllpaJVF1RVdsJy6IhjFp
xp3FBUBX7KGsmjcPzXIcg6ZPY9zt8GASpigOUhgvrIV0pf5ZQBrqn8/RWyvv+sf9xj2L3p2K
oy7pmV5+juxJtPzllabBn60P/9fmtcUjm3G/bTX259a9Owv6tvZDQ5vPwP2cxv8GiiID4X9/
yPOPtz6OqdSr4xBmL1rP5+qfnyNRUl13bnQQqhdG5coQ6ufzFF2PzBKvhiTR2HUAMYQpIeaH
u2nkKdzTie42lK2OScNlYhgTZgGBnNB2IM0wW4Wv4EVhLgV0kHBOYF/2cAG5jfwWPDomHaJ3
0WcM49suM7fJRnk25+J4Z+RCOJ+5T8UBrMzLeLL5hEqIYZZCM+mN0/SCs5jBVEDG8ttG3K5v
PS2sb8XaWugO27cXXcMd5r5BqbxR9CFTtHCXYlu3t/vlWT5J2LmBq5WKkw0CA43UrS4c1gfO
xMuiEIeiDrYPXTeKa2hHFnunzFu5DXWu4sujcXvo9sc7K7uquTsVPkcNiIYxm2ZZEXnXOyUv
XW9QDuodMrcyNBnpcgn5CyQrty9/sC9TzvLmG87drBY3nMPmrHDDLaRUC0lfjbBE0Xa/v1O5
RYK9WkL39Jl9E65MAFmstdjrI7rUrmEmzeuo/LnT73+zWkN/qgdn8bTU8uShqYb+vN5Ut284
1X1VFvwsU22FAE1T/SEF+ouVsKdnV194qqs39KeKiudP5tntjXhb13NptALkyktuvE6hV6FC
iScdUW9H5Ms2ncSYaVG82AB/DAF1bgp0VwGKnINgYHh3Q6qZFNL9sRmpbHK0SLPgUrAWXEAs
VzoTXXbpoSCSaYoOcVpyUohKV49s1xyIrodvVhKhrQ3fu96XgJj7xl4KRw6dV3odvgZUGn4T
ulFozewAy9U9YIH54J8wbEHmGfKEs37H2BVCCj2weafRu0UDhtC3LHO3vHr1noiab514n2ui
AF6gpDBcJ3kVE+qVOQavh9ZHfpBBtVUXJ/LYSuzGedyAk74V/QVQDQfWmK3xomBWiZjBED8T
zhVjTfWoA0i7ga2iwQRLRKbjKPtux8aUYYgNUHJp9e9klqOkjOEu7is79hXK3lx/A2lspRN8
c4MdjDv5lCXyjjdy1u9rTj4tMY/zRWzvnMO8KSVDkV4kppXnrL9uqIx/ehdugD3ChBV4WN3d
9D3yPY0fPlVFA1ayV75AlipfjQ8yvT4vxK0X8HWSYHw0vmrOPLB8RndBIPVb6xPkFO05U0KB
VarR+BIcT/cfh6tSjha+0YGywWgFUK0/esaJrzz7uqnOfOFL0cbzk+fFplHYc3AiUAkO8QdI
oIIfOmK1n1PoVaKzOMxIAqI4vqZUuoq8the+RW8ZGzIVBmb+HOUjU96n2OxGwQrxRLRc/9kN
n1HftO6tnnChiEwkh6aGqn5SSUohIVIqbrqul6Fq3qNyFCx764dwaL0H0VcCfBt1nYcSLfOc
IG6ridMMDo3nk9kLABSRTJTDzOh3CtmlJ2x7YS2nBj6Ri5bSY7sv7k5YqHngEDcASerFTR21
qDAWjZLD0/85fHn46vD1CV++Gw7/0vqi5WNiWm4+q2mtHQYHx7T8jUldRSlOcAodE5xESghW
BWMwK0ZLcfUtOaHYlUM+uj6BwC92vvjNnzMCE37FTviUR9GL+QxvVaQm6mvPsiMRB6s9p5nn
sxGW5mJvVNxF7Ug93zGTl5OGwxt+s75DTIimGG82ECcqJAkGeavZiGgSWAH+HO/AaIK7R97i
+ADosulpfaHk+BRh/szs3VMB5jMHD/r9vn2+VXvhqYC8uUnthae6Mc1t6m88Jeg2t/AeP93i
dQX5bZ/dXiGW7PWbk8PHHSLVqY0wPcdEpnTg42g8S5IeU75oIgbLJxpCxyz0ADbmozpKjozX
o5ujyPgmIU2RYVh9NZ9N80IjHtHkSSn+4pH6MKNKvuG+CqqYwvytYyNx56O3P1EKOhN6L7h3
Jh7QeHjGEOn1RLukp8Lc1xLl6x5ZHEpZAynWrNyPZeaLPJKiKGmhb8XRRTK70viIqjMp5hzr
TdKxgB8m75kh+Oo19uOgGkijLVC1pzFLnhWWRRZcFt8rn3wirWbdcOceW1wPJl+B5V0tShyY
x+811N+9VoB5EmInia3yjJk1gjUlvHCCQIfPvlncicP3sjvvgq6+DXXlUF+HGUSKTwHSdiQX
r4aJ1/HfM5jGP5b0btHYaV1jnJtFO0oBAieZUeMixZM6n/F58fChriS8yQ39vbmiv7V39Df+
Jf19+JZuvKZlna9hPSKXI5z1vCOE5WT616/us8yH7Jwcqh3iwrteR/X7GZ7q3XyiFNBeyAU6
MPGR8m/lkKgf1K9LsDeGYhzI9uCwFEjiXgEUREN7S5gDBEVpSzwbpOUsnmF2g/DJ77ITkJpp
lc54B36R6ISPYztRTEBtNNfCCCTRnc93IqcGbWmbcnID5GUwq1zOGUAk7aNEyCo/77ULUyo6
a2gA0LC+PIvMCOSUqhUUVLJyrqBIY65djsdheV7YVKY1/mUBA2OOx6doI+5GG4PoczSE/49A
zkg2v4metdW6NUxLsrDS9otponQde1eYK8z20zN7fNt/cc7803jr2Wpfnm75HQzc10bul6H7
BV5zWyXus4VfHJ7MWYb3JTDZVmZnf4bDtq0aZ7igTX26rcbyOxldq1W7GfptcI9b4jm76Xg8
HR9qjMXMR/OhKAo6qGcu49Mt1DV3TE7+J0xpRffM7F1GRI6UEmg1jjDh8JUSQlQTkzRHNwMc
cnQtj9AWdxFPEhvnr+PhcPjnlvzdYQWCzQvCfPEgucpFIC6G+TRReZ/6UrEpaG4N3QUq48s9
4JhYM18OowJcUYnm3aKczamGBiXytHWPRcNa5mQwLe3NRWXwxkxFiLEyYVMiR+JFu0mM8EwU
5ChEmquTDeF+S+yM7gHunwWL4Vk6Gc3QE1h0BplOapCXZX6uFnWaJnkyNw1pByIdvWrwdAA2
MZxwXLoIun4LZRk8pZJiRo0NRzVXNbs3R+VSFDeHARdaYLxLvH1XClhbnyqSEaINxjfhDNDa
Pdt0Y4pZDZOrWZgXrsXIJI+RwghG3yg2JaK45HjYmCo56qa7ejLmVxiePCFxA+VVxBdxOokp
7cGAomDRjYodBlS/JwAj3dQCVsGXVX1h9S1dPSYPhIPLkisXTiJNepxmEqqOjG60QemDRk6N
etwAm/6G9Ta86i7iAhxTYuklvY0TKxQwnPNLH0auKo3M5ty5SnUuh06eCKTYxJjseemWQbTH
oDQHbY1xXF8RR2TjOwtwdvDOh9n+6796ADuxQ1T4XynM2OtFkmeYTiWCoiuA4E4sNLgipxVc
g0vEH/eNFx6GVnI3OokARK3THu7TBzIdVT0R/FUevnp7snidAyHhXes8QkkANC+GTQ7FmbG5
I/TpRrk4hqNIxFy6lAsEK6JifkPYF/epIffO904/yEH6ZHy59c664QZVt26mEmLvmNJw3oJq
8m9z0kWUx1I1hZAJioYTQsXSkc3EwH64SC5dxSbqjIy+BLugAw0UTDOQaHIoljRs/NdpiiEi
YpgjtBGi9695bKpC0EQkHQmmNfF8wrs2RUaXiQ0iXnEOP5CWBTj983QofWROLnBDnPD9CWKf
1k3Oi5SCZst4qV7Tn4saMawok3KWGtb3lG7yL1qtudBSxzOLn7CGqBCX90ECG7qCGvR/9k9O
Xh4ds5DtcF/GtYU/1KjOfv3u3eH/e3/07vC509L4tqzUsp3Kslln7BBWYe00jgE6YxB5HnJq
ybMUnVdM4jetgCnzD0DgPBLoXw+8L0B4OTkdbq16W/F5AeLBimqDw+Rgh8euUB4y9lmtFZXY
eugRCgdxqVfojzGmVqGVfNd5PutHx8m8UOF6GZwb6Qka6Bw9qbntKz6DfOFf8wI3qFEj1bb/
1Hq18RYge5ohHz6O55OSw5GFYgFsuRdzF7IaxdSY4ARXeLrTsvHy+N3Rq7cvj5ZNyuhtmyfV
OMCLo78cPo/+Tm/9Y8EwrLmbXMZXBfOlxGK6Y0Qd6QWzFJIMwl0hMZ/NOIxZl+/ZKJXmX8m9
rmD8iThpYYR8VgrueMzUmMw4duscwxGdwBhyKpWsMmyZLpSd0oxTVEdeo3qMasdQyHbQWw62
4O7EFcDhHW1gxx3J2qPrLVs4M117tHzZtdUu5gYWn9eaWGdPLOL9LE345rRgcm8dY4i0DDvf
T5f5IpYdX1n51Ae5doedEKM2Xf3GoO0TY5CXoavNJ8yZq1C0diP+3CShkq13QoPCKFj4OMh/
rHlrcbWJPiPA9W5oQ4bDZErKd+mBOxclxHieaTI0EN4ozx5nzIIDTsWp2cUZYIXmXVOWQ7WM
MvvlOniPQ+Cke76G5hRD1vmy70j5uc/AUSWfxwn+03F+77gtFS6L1PBcnkRG8KFHp8mIQyhB
Kniwmo/OlDsBZBA7R2HyAMS1btkKV5cSpZPQAR6lIzORLu+fUF9ZMVJf/Agy3AZnf8i47LH1
xo0shMPPFvBNhybCk6QAjb0sBTHFBcFNCwYSEDvT0WptjmQSoClRnj0mji7AhjSQZkWGBWFJ
OPKOOazoSw9sMJxoBN4f+bETiip2YcyeK06DLudEXQgBe+KWCFuFIT58fXJ08ldO1RF1WqWN
ekGG75a8VenAndhFIUvkkD8AcvYxKSVI+NzeC4bSFdGdP9wheQWusDtP7qAojpBHTQvIlzRt
EDoV44U6e6o8LVC3bkmCmrjTpr0msQt3OQQR7KgJKP3ANm4Ql80sCAYJx4WKg7RocXi1xN2S
bscVTDIGXyQTyhdJSfY4seSa6dgCLUDy8ekHOTMzKimCjn5ZIKfK7MMwHyXmpeVeLG8Vixei
Lin9NkqNSOd68prmRIWDqu5QvMg8IRJ/cPCIXGkLSYjJamHj+wZcoxXkjcRkHOXi6M7v76i/
daWWjtyjJKaqOHq1Ag7z6XTwGEbacJQjgNebkWA1X1vWTcoKbyIgx74FG9aQkC+E0UW78CGA
TP09uboGTfg9zoOqeJ1O8gEgmP9xb7hP55OseMxEZIkoHDHnXzF93JnPssdpnMWPoavH2ted
6hCVrm5/iMecPMJ+NpRF/czc6+wi2aTe5Pdqe3QHckd9/erkzf8evq5PUQQs07wlPQ2fQKP/
988FeehYXoK4LecgtMcJhy8izrcn9M8F8e99bHlinz2r94Ipa8q2rZfA5bpOujZbsZseS7NX
IHWw9hH/RiFaT0d+Np84jpjV0ZDwGG/ftzPMN+MF0Xem/BunlfUG4eqp6pSPf2Eiac4Zwlpp
us8mGGsnTpNG00P9uBoiMaBZ7TgwJ9jceckIXyEJi6Bm37Xy1SFRIQ84RUm+G6pOrcyloqRw
Z6kOD6wzp6Qs7H2BXdgClU/w1laZgs0ujmxvb1EUWSmzmW0a8McRZrXukOlMDJ0uC5I4WjkB
rD39HgiBLuC7zk5/uxN9f1P/hKMxKZhrq0udnNldR5Vwe1PXoZg3KDCHcfvVlM+4Vq9tKzYR
L/9+YFnkKkl8DHcU8gBHQwjx2cymRBEAKcubYPP+5EXvIcW2FgWg6mh5qFDgRB+YqVJCzLfM
/8uM/yLJEhu14q6beAXL6NUA26YtPiipQCndOyo+o2FXX1r/ndTWC3b8zI1mdgXeYCX8WC4b
XAs5uhzlq2V6sCvDtJtca/ta1vM10fAi2iflMLJ0G0f7r/eBsawDGzMR7j546CXJUVqN+1Vo
ek+Tk5lIsydHF0696kSQTuQ9/LJz36yD6PXR8Zuto8ODaGf7/t370cb7g2PmCt9nKXLhXXRI
pbrbIKYI1XTK2BdkmIE/0VNVgVCQe+p5ngVgV1gnO29BpKBhr7FCtKGBxi5OsS+DLuuBnC/+
Z2/XM8ErQMT0WSROj+zbi92czmE82D6TVFy1hZLJhhzsnKU3Z4Wxh1QUCE6uUzd9pi8PmUvt
p7qoDdL7EHPkuxYRUUer9HXOxShM/gDyM5AKtAR1W0GXlNBc5d0CGQCfTDBGxzEXruluci9d
R4oELiWeYkrzf80TcpLVzDCZa5g27GCX5Qdb6bz0/YScVRFK4+zZi9fJ8s5jjlzrXGisonst
X+cDx7Nxia9zdVtrDs9/EBfgP4BA9QT/73kJox3afUG+2uen/vPTyvOO+/Bf87zy+I43+DQv
noS9jP2rxxUOFiP1AdCFZpS2srvj3HTl6o5t4iWimB4BckiPIQ6FKcREtVMIh0dR3ZLnlA7n
oKiASoPNjPuhR3RdI/PoKmF8RRDLy7+7Y32AUK8Zel2k6h9ssFnhdtYNXJy0ZvXOcM5lVlC6
Wv/MHFUvJ2qNEdjMpo8kaPfOpzviTkHJsOFpSbCjfs5A4EcHA0y8uIGFEqKd+5viZHKZFqyg
qjWNvCbU0c72pqgQUMEQ03knInOO+fQRaBt/2MSeiO4mlF6DsPN3ew+foHmfv3za3t69/4R6
NJUp4E7rka89XqfQDZyVcE/3t/2e9g6e+CBDLATS1uuifrRH5bzRjNobXJUuIK3fs5paXAQ1
k6sj6TBGfwAfQS1uaipCMQ6WmP8TU+CGuMBlR5HSVEbHpCmwHKA9b8wPsLKgQMeaEq8JfHtw
pSYvKwg5Kvip5NoTRbzb0iXQErJv78JonrEacuR4Hp3PpYacVYeRKvTHExiTdJLHf3z1ctM6
/zh+KeRuieNuZTn/IT1hNZuhJqKRK288nzC64cXFrSh3C/2pleK0EfUDN34LWYw96pFBdZwN
c827eGU9wZyycEB3XKhVS8uZmoA2M2XHaH2c2iyreKajxcX08V2H6/Z0VpeQpCEdLg7I6Qiu
cJo3xShb90MpkdvUvNbt1LCEyn9grTuuZusAStWvjrPdncIADd1tbJJvlrO8MWWe3Y4yLd6w
VKw8oUiqUU5lskh7D7QtQ0UK5sNm73si4zQrkevtFtZnVedhUp5tzdkovMWV2nxahYxS3pUU
CFLNSaTg8J0SOUUgU2pHHYEEjOPzSRgr5oOeE1E9z8g7GnO/ztIRILTqS2QjCoPN7txJleM5
Bqtu3fjgGsD4FK1qQ69SNM26WrQRY1ucSxMVWTl+qalCpBg3uIoqZxGbLjqKy08i9gCsIvwX
r4jWhio5h6Yd59qyK0HLqpvdNlTwB0tsdJ5hIn78S5LX4ob0XVlyMaZWABBE1Jvj6Y3RtIal
PO/VkHQxWh5VcoLuu6lmlOt1stB9gJfqGbUWOJ17SUcloYnyxZXMxtiTZOtgL3qSXD3ZNpyJ
k8oTScZ+NuiwgwULt9B7/E+8+mc5YPg5ItUUL/p0mDxpTPlCvdhqeKLjYdMSnkS0Imk5p6KS
aJO3cAKHkJ0tJnlBigh1sogxwtjTfuyTKjxntxTiRZOi5IC34+FZch6jdGxSwLK6dYSlufKp
ASd29dPegVS/02KRLvCcrfCK7BXlLMfk+7QV2E15RSFtFNlfSj1trACnybMpxJ8K/omeqvB9
xNXPASEOghglrXUX43owI87YSBiK99eFUhcaJKw1blX7zl2BkIaKGJBReAvZQa6kTcPmIIcB
tP9tVZENdgy/+JSWnNqajUGq/P9txCtRkuADAA==
--------------000004020109050802030107--



From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:34:55 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05520
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:34:54 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i099A0fd030435
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 9 Jan 2004 01:11:49 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i099A0Mp030434
	for idwg-l-outgoing; Fri, 9 Jan 2004 01:10:00 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0999vfd030422
	for <idwg-l@hmc.edu>; Fri, 9 Jan 2004 01:09:57 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 10:09:56 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 10:09:54 +0100
Message-ID: <3FFE6FE2.2040704@francetelecom.com>
Date: Fri, 09 Jan 2004 10:09:54 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 11] Informational messages
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 09 Jan 2004 09:09:54.0650 (UTC) FILETIME=[58980BA0:01C3D690]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0999xfd030432
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 From Krzysztof Zaraska:
There is a need for INFORMATIONAL messages. For example, a honeypot
traffic is by definition anomalous, however it should be treated
differently whether it's malicious or not. Maybe these could be
implemented as alert messages with severity = 0?

Hervé: I'd like to wait a bit to see if issue 10 provides a solution 
that also solves this.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:34:58 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05540
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:34:57 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Dxofd002675
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 06:02:18 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08DxoV3002674
	for idwg-l-outgoing; Thu, 8 Jan 2004 05:59:50 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Dxkfd002652
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 05:59:47 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:59:45 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:59:40 +0100
Message-ID: <3FFD624B.5010607@francetelecom.com>
Date: Thu, 08 Jan 2004 14:59:39 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comment section 2.2.1
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 13:59:40.0196 (UTC) FILETIME=[A8C61640:01C3D5EF]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08Dxnfd002669
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 >> Also, despite this in section 2.2.1:
 >> [[
 >>    In anticipation of the widespread use of XML namespaces, this memo
 >>    includes the definition of the URI to be used to identify the IDMEF
 >>    namespace.
 >> ]]
 >> I could not find a definition of the namespace URI.

I think it's defined in section 8. Can somebody confirm ? Should it be 
  somewhere in the doc (e.g 4.2.1) ?.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:35:48 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05705
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:35:47 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DRMfd031364
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 05:29:28 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08DRM1X031363
	for idwg-l-outgoing; Thu, 8 Jan 2004 05:27:22 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DRJfd031339
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 05:27:19 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:27:17 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:27:16 +0100
Message-ID: <3FFD5AB4.3000009@francetelecom.com>
Date: Thu, 08 Jan 2004 14:27:16 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comment section 3.2
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 13:27:16.0490 (UTC) FILETIME=[223C16A0:01C3D5EB]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08DRMfd031361
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Section 3.2:
 >
 > Data typing should make reference to XML schema datatypes [2].  Even
 > among those who promote alternatives to XML schema, most folks use the
 > XML schema datatypes as defined.
 >
 > [2] http://www.w3.org/TR/xmlschema-2/

This means quite a lot of work, and the section is probably only 
pertinent if we keep the DTD. I'd like a resolution of the schema vs 
DTD before tackling this one.

 > Also, the number notations are muddling encoding issues with
 > presentation issues (cf. use of '.' and ',' in numbers).

I'm not sure that this is really the case, because there are 
differences in number input, at least between the EU and the US, that 
were supposed to be addressed by this specification.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:35:50 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05740
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:35:49 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0997bfd030063
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 9 Jan 2004 01:11:11 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0997bwG030062
	for idwg-l-outgoing; Fri, 9 Jan 2004 01:07:37 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0997Xfd030049
	for <idwg-l@hmc.edu>; Fri, 9 Jan 2004 01:07:34 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 10:07:33 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 10:07:31 +0100
Message-ID: <3FFE6F53.9040300@francetelecom.com>
Date: Fri, 09 Jan 2004 10:07:31 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 10] Severity scale too narrow
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 09 Jan 2004 09:07:32.0022 (UTC) FILETIME=[0394BD60:01C3D690]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0997afd030060
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 From Krzysztof Zaraska:
severity scale (3 grades only) is too narrow; for example, there is an
idea floating around of expressing the danger associated with the 
attack as exp(severity*vulnerabity_level), but you can't go far this 
way with 3 level severity scale only.


Hervé: we use 5 internally. It seems to be standard practice within 
the telco industry:
1) = critical
2) = warning
3) = minor
4) = normal
5) = unclassified/unclassifiable
This wouldn't solve your graduation issue, but it actually is enough 
for an operator. We also use another scale which has 3 levels,(solved 
within 1/2 hour), (solved within 1/2 day), (solved within 1 day), but 
that's maybe too operations-oriented.

IIRC, it is about the same with the Tivoli framework. I think there is 
a 0) = FATAL (i.e. system stops) in addition.




Possibilities:
- keep 3.
- move to five (and get appropriate definitions)
- something else

Please voice your opinion.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:36:22 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05813
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:36:21 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i099Gnfd031331
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 9 Jan 2004 01:18:39 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i099GnVA031328
	for idwg-l-outgoing; Fri, 9 Jan 2004 01:16:49 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i099Gjfd031306
	for <idwg-l@hmc.edu>; Fri, 9 Jan 2004 01:16:46 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 10:16:44 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 10:16:43 +0100
Message-ID: <3FFE717B.3040403@francetelecom.com>
Date: Fri, 09 Jan 2004 10:16:43 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
CC: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 8] Classification and ident
References: <Pine.BSF.4.21.0401081439180.1526-100000@lhotse.zaraska.dhs.org>
In-Reply-To: <Pine.BSF.4.21.0401081439180.1526-100000@lhotse.zaraska.dhs.org>
Content-Type: text/plain; charset=ISO-8859-2; format=flowed
X-OriginalArrivalTime: 09 Jan 2004 09:16:43.0864 (UTC) FILETIME=[4C812580:01C3D691]
X-Spam-Status: No, hits=-3.0 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,
	      REPLY_WITH_QUOTES,USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,
	      X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i099Gnfd031323
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Krzysztof Zaraska wrote:

> On Thu, 8 Jan 2004, Herve Debar wrote:
> 
> 
>> From Krzysztof Zaraska:
>>Also, we would propose introducing the "id" field here, containing a
>>unique identifier for the vulnerability in given database, as we can 
>>see that "name" field is being rather used as a description, and, as 
>>such, doesn't have to be unique. Having the "id" field, the 
>>construction of the relevant URL is trivial (some combination of 
>>database's base URL and the identifier).
>>
>>Hervé:
>>If I'm correct in what you suggest, the name field could still be your 
>>ID, particularly if it is made unique like issue 1 suggests. or are 
>>you thinking of an "ident" pointer like there is for analyzer ?
> 
> 
> The "ident" pointer. 
> 
> A relevant comment from Yoann Vandoorselaere on issue #1:
> 
> | Today most IDS aggregate several possible type alert behind a single
> | description, as you can see Snort's doing here... 
> 
> | CVE references CAN-1999-0517 and CAN-2002-0013 are quite different, but
> | aggregated under the same "SNMP public access udp" name.
> 
> As you can see, only by looking up "SNMP public access udp" we cannot
> determine whether we're dealing with CAN-1999-0517 or CAN-2002-0013. 
> 
> Inclusion of unique ids/idents solves this problem. 
<snip>

Proposal:

move from
       1..n
Alert------Classification

to
       1..n            0..n
Alert-------Message--------Classification

Message has 2 fields
- ident (reference)
- meaning (whatever one wants to put there)

And classification is reserved for documentation.

Rationale:
This is closer to the current state of the art, where people associate 
a unique message with their alerts and add classification as 
documentation, either their own or publicly available others. This is 
also symetric with analyzer.

Comments ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:36:54 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05955
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:36:53 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i097RVfd016853
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 23:30:33 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i097RVhK016850
	for idwg-l-outgoing; Thu, 8 Jan 2004 23:27:31 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i097RRfd016828
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 23:27:28 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 08:27:21 +0100
Received: from francetelecom.com ([10.193.106.38]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 08:27:20 +0100
Message-ID: <3FFE57D7.6050006@francetelecom.com>
Date: Fri, 09 Jan 2004 08:27:19 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Yoann Vandoorselaere <yoann@prelude-ids.org>
CC: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>,
        prelude-devel@prelude-ids.org, intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [prelude-devel] [IDMEF][Issue 9] Alert routing (fwd)
References: <Pine.BSF.4.21.0401081434190.1526-100000@lhotse.zaraska.dhs.org> <1073603926.18504.27.camel@arwen>
In-Reply-To: <1073603926.18504.27.camel@arwen>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 09 Jan 2004 07:27:20.0946 (UTC) FILETIME=[04B35520:01C3D682]
X-Spam-Status: No, hits=-3.0 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,
	      REPLY_WITH_QUOTES,USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,
	      X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i097RUfd016848
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Yoann Vandoorselaere wrote:
> On Thu, 2004-01-08 at 13:34, Krzysztof Zaraska wrote:
>>Subject: [IDMEF][Issue 9] Alert routing
>>
>>Tthe draft should be more explicit on hte hierarchy between manager 
>>and analyzer
>>
>>Situation 1 (serial/transfer)
>>-----------
>>Imagine 3 boxes, A=analyzer, B=manager/analyzer, C=manager, connected
>>thus:
>>
>>Analyzer-A -> (Manager-B / Analyzer-B) -> Manager-C
>>
>>You should ([even must ?] not have alerts on C whose analyzerid is
>>Analyzer-A.
> 
> 
> Herve, if I recall well about our old discussion, analyzerID can be
> anything as long as it is unique across the whole IDS environment. 

Right.

> I previously tried to express the need to be able to give a "name" to an
> analyzer, and that the analyzerID field might not be the best place for
> doing so as there might be real concern on checking whether a name is
> unique to the whole IDS environment, and that practicaly combining
> "analyzerID" + "manager analizerID", for uniqueness might not be doable
> in a given implementation.

I will create an issue for adding a textual name to an analyzer 
representation.

> So, following your schema here, analyzerID will be lost once the
> analyzer A alert come through the Manager B to Manager C. So how does an
> user looking at an alert coming from analyzer A on Manager C refer to
> the analyzer ?

I have been looking at this for a long time. I have the same 
operational problem because people have the same alert in multiple 
databases, and I have come to the conclusion that:

1) either B adds value to the alert (correlation, ...) and then it's a 
new alert with analyzerid=B and alertid=...
		OR
2) B doesn't add value to the alert, and then the situation is 
equivalent to having A send the alert to B and C. As such, B is some 
sort of network router pushing alerts instead of packets, but it does 
not modify them.

> Recording the path of an alert is something I started implementing
> sometime ago in Prelude... My intent is simply to insert the interface
> the alert was received on, and the interface the alert is going to be
> sent to if any. I used additional data for doing this, but having
> defined field withing IDMEF for that might be a better idea.

Could you please phrase a proposal for altering the draft ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:37:12 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06053
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:37:12 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DW9fd032163
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 05:34:02 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08DW98g032162
	for idwg-l-outgoing; Thu, 8 Jan 2004 05:32:09 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DW6fd032147
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 05:32:07 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:32:05 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:32:04 +0100
Message-ID: <3FFD5BD4.5010001@francetelecom.com>
Date: Thu, 08 Jan 2004 14:32:04 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comment section 3.2.4
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 13:32:04.0576 (UTC) FILETIME=[CDF28600:01C3D5EB]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08DW9fd032160
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Sections 3.2.4, :
 >
 > My earlier comment was this:
 > [[
 > Using XML character references to encode binary data seems seriously
 > broken to me.  Character references in XML denote Unicode code points,
 > *not* byte values.  I suggest looking to the XML encryption work for
 > ways to encode binary data in XML.
 > ]]
 >
 > Now I haven't a clue what this document is specifiying.  There is a
 > reference to a BYTE datatype, but no description I can see of how it
 > is encoded in XML.

I think that the comment is right. In fact, this reminds me of one of 
the issues I posted earlier, adding an encoding field to the 
additionaldata field to specify encoding. Do we need byte encoding 
outside of additionaldata ? I would like this question answered before 
deciding what to do with the BYTE type.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:37:25 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06130
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:37:24 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Naxfd011945
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 15:40:59 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08NawLF011943
	for idwg-l-outgoing; Thu, 8 Jan 2004 15:36:58 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from pa169.kurdwanowa.sdi.tpnet.pl (pa169.kurdwanowa.sdi.tpnet.pl [213.77.148.169])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Natfd011930
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 15:36:56 -0800
Received: by pa169.kurdwanowa.sdi.tpnet.pl (Postfix, from userid 1001)
	id 5339D2088; Thu,  8 Jan 2004 15:06:50 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
	by pa169.kurdwanowa.sdi.tpnet.pl (Postfix) with ESMTP
	id 201EC5878; Thu,  8 Jan 2004 15:06:50 +0100 (CET)
Date: Thu, 8 Jan 2004 15:06:49 +0100 (CET)
From: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
X-Sender: kzaraska@lhotse.zaraska.dhs.org
To: Herve Debar <herve.debar@francetelecom.com>
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 8] Classification and ident
In-Reply-To: <3FFDBF09.6080403@francetelecom.com>
Message-ID: <Pine.BSF.4.21.0401081439180.1526-100000@lhotse.zaraska.dhs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=ISO-8859-2
X-Spam-Status: No, hits=-2.0 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      REPLY_WITH_QUOTES,USER_AGENT_PINE
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by mail2.ac.hmc.edu id i08Nawfd011941
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

On Thu, 8 Jan 2004, Herve Debar wrote:

>  From Krzysztof Zaraska:
> Also, we would propose introducing the "id" field here, containing a
> unique identifier for the vulnerability in given database, as we can 
> see that "name" field is being rather used as a description, and, as 
> such, doesn't have to be unique. Having the "id" field, the 
> construction of the relevant URL is trivial (some combination of 
> database's base URL and the identifier).
> 
> Hervé:
> If I'm correct in what you suggest, the name field could still be your 
> ID, particularly if it is made unique like issue 1 suggests. or are 
> you thinking of an "ident" pointer like there is for analyzer ?

The "ident" pointer. 

A relevant comment from Yoann Vandoorselaere on issue #1:

| Today most IDS aggregate several possible type alert behind a single
| description, as you can see Snort's doing here... 

| CVE references CAN-1999-0517 and CAN-2002-0013 are quite different, but
| aggregated under the same "SNMP public access udp" name.

As you can see, only by looking up "SNMP public access udp" we cannot
determine whether we're dealing with CAN-1999-0517 or CAN-2002-0013. 

Inclusion of unique ids/idents solves this problem. 

If the names were made unique, this could work, but would require doing
extra lookups to determine (e.g.) CVE identifier from the name. Unless
it's said that the name field should contain the identifier; but then it
would stop being human readable (after all, "SNMP public access udp" is
more informative at the first sight than CAN-2002-0013: when I see "SNMP"
in the description field, I know I can simply ignore the alert if the
device in question has no SNMP agent). 

> BTW, your argument can be reversed: it is as easy to do ID->URL as 
> URL->ID. The URL is just bigger.

Not really. 

ID->URL convertion is a matter of simple string concatenation, while
URL->ID requires parsing (and possibly decoding escaped sequences, which 
can be specific to a particular HTTP implementation). 

Plus, the URLs which only point to the main page of the vulnerability
database site are permitted, what defeats the idea of performing URL->ID
convertion.

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem






From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:37:57 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06332
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:37:56 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08E7wfd003685
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 06:10:00 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08E7wX1003684
	for idwg-l-outgoing; Thu, 8 Jan 2004 06:07:58 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08E7tfd003667
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 06:07:56 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 15:07:54 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 15:07:52 +0100
Message-ID: <3FFD6438.3060808@francetelecom.com>
Date: Thu, 08 Jan 2004 15:07:52 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comment section 7.8
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 14:07:52.0959 (UTC) FILETIME=[CE7BC0F0:01C3D5F0]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08E7wfd003682
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 >> Section 7.8:
 >>
 >> The example contains what I think is an incorrect attempt to use XML
 >> namespace prefix 'VendorCo:'.  Specifically, there is no
 >> xmlns:VendorCo declaration in the XML data.  I don't think the 
attempt
 >> to define the namespace in the DTD is valid ... or if it is, I don't
 >> think it's advisable, because it means the namespace cannot be
 >> identified without access to the DTD.
 >>
 >> (I'm not certain about this, and think it should be run by an XML
 >> expert.)

Whoops, this one is tough, because it makes the comment against 
section 5 really problematic, because to my unexperienced eye it looks 
like it does exactly the extension process. Again, could somebody 
knowledgeable in XML validate this, or give us a lead on how to proceed ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:37:57 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06333
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:37:56 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08KV1fd008406
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 12:32:52 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08KV1oa008403
	for idwg-l-outgoing; Thu, 8 Jan 2004 12:31:01 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08KUvfd008380
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 12:30:58 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 21:30:56 +0100
Received: from francetelecom.com ([10.193.17.38]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 21:30:55 +0100
Message-ID: <3FFDBDFD.1060207@francetelecom.com>
Date: Thu, 08 Jan 2004 21:30:53 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 7] Classification and URL
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 20:30:55.0774 (UTC) FILETIME=[514F03E0:01C3D626]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08KV1fd008399
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 From Krzysztof Zaraska:
Having said that, I am not sure what is the use of "url" field anyhow, 
as it's unclear whether it's the main database URL or a
vulnerability-specific URL, and vulnerability-specific URLs could be
generated trivially from the "id" field.

Hervé:
The URL is a documentation pointer, refering the user to some sort of 
online documentation managed by the IDS vendor. I don't think there is 
any ambiguity there.

*Issue closed unless comments*

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:38:46 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06505
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:38:45 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08KZVfd009539
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 12:37:27 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08KZUfC009538
	for idwg-l-outgoing; Thu, 8 Jan 2004 12:35:30 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08KZRfd009502
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 12:35:28 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 21:35:25 +0100
Received: from francetelecom.com ([10.193.17.38]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 21:35:22 +0100
Message-ID: <3FFDBF09.6080403@francetelecom.com>
Date: Thu, 08 Jan 2004 21:35:21 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 8] Classification and ident
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 20:35:23.0093 (UTC) FILETIME=[F0A4A850:01C3D626]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08KZUfd009536
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 From Krzysztof Zaraska:
Also, we would propose introducing the "id" field here, containing a
unique identifier for the vulnerability in given database, as we can 
see that "name" field is being rather used as a description, and, as 
such, doesn't have to be unique. Having the "id" field, the 
construction of the relevant URL is trivial (some combination of 
database's base URL and the identifier).

Hervé:
If I'm correct in what you suggest, the name field could still be your 
ID, particularly if it is made unique like issue 1 suggests. or are 
you thinking of an "ident" pointer like there is for analyzer ?

BTW, your argument can be reversed: it is as easy to do ID->URL as 
URL->ID. The URL is just bigger.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:38:47 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06507
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:38:46 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DKMfd030210
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 05:22:17 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08DKMQk030209
	for idwg-l-outgoing; Thu, 8 Jan 2004 05:20:22 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DKJfd030192
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 05:20:20 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:20:18 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:20:17 +0100
Message-ID: <3FFD5910.3020508@francetelecom.com>
Date: Thu, 08 Jan 2004 14:20:16 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comment section A.3.4
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 13:20:17.0526 (UTC) FILETIME=[28834160:01C3D5EA]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08DKMfd030207
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Section A.3.4:
 > [[
 >    As a note of interest, XML Schemas, currently being developed by the
 >    W3C, will provide support for inheritance, as well as stronger data
 >    typing and other useful features.  Future versions of the IDMEF will
 >    probably use XML Schemas instead of DTDs; this is not currently
 >    possible because the XML Schema Recommendation has not been
 >    finalized.
 > ]]
 >
 > How *old* is this document?  XML schema was approved as a W3C
 > Recommendation (approximately their equivalent to IETF full standard)
 > over 18 months ago -- http://www.w3.org/XML/Schema

Suggestion: drop paragraph.

Now, we haven't moved to schemas yet. I have the IDMEF schema that was 
developped some time ago, as well as the examples, and will make these 
available as soon as I can. Do we want to 1) move completely, 2) keep 
DTD only or 3) provide both (if possible ??). Reactions please.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:40:11 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06700
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:40:10 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08KS4fd007860
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 12:32:04 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08KS3dn007859
	for idwg-l-outgoing; Thu, 8 Jan 2004 12:28:03 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08KS0fd007838
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 12:28:01 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 21:27:58 +0100
Received: from francetelecom.com ([10.193.17.38]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 21:27:57 +0100
Message-ID: <3FFDBD4B.2030405@francetelecom.com>
Date: Thu, 08 Jan 2004 21:27:55 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 6] Classification and name
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 20:27:57.0894 (UTC) FILETIME=[E748AE60:01C3D625]
X-Spam-Status: No, hits=-0.1 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08KS3fd007857
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Herve> The cve, bugtraq and vendor-specific for "origin" is a bit too
Herve> reductive. I'd like to either add more identifiers, or add a 
Herve> meaning field to allow people to put free text in there
Herve> (field that would only be valid if origin=unknown).

DaveC> I'm pretty sure the list was decided on at a meeting, and
DaveC> people were loathe to specify every Source Of The Day because
DaveC> it would always be out of date. I would not object to some
DaveC> kind of free-text or alternate-source type of functionality
DaveC> in...

Zaraska> We second that. Free-form string?

I also believe that if we went to a schema (or maybe even without), we 
could define a namespace.

OK, pending the namespace issue, the proposal is to:

add another keyword, meaning, that is free text, and is only valid if 
origin=unknown (and/or vendor-specific ?).

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:40:51 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06872
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:40:50 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i07HRTfd007143
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Wed, 7 Jan 2004 09:31:29 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i07HRT8B007139
	for idwg-l-outgoing; Wed, 7 Jan 2004 09:27:29 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from turing.cs.hmc.edu (turing.cs.hmc.edu [134.173.42.99])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i07HRNfd007055
	for <idwg-l@hmc.edu>; Wed, 7 Jan 2004 09:27:24 -0800
Received: by turing.cs.hmc.edu (Postfix, from userid 13403)
	id D921F53226; Wed,  7 Jan 2004 09:27:17 -0800 (PST)
Date: Wed, 7 Jan 2004 09:27:17 -0800
From: Mike Erlinger <mike@cs.hmc.edu>
To: intrusion detection wg <idwg-l@hmc.edu>
Cc: Mike Erlinger <mike@cs.hmc.edu>
Subject: Direction
Message-ID: <20040107172717.GA5550@cs.hmc.edu>
Reply-To: mike@cs.hmc.edu
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4i
X-Spam-Status: No, hits=-2.5 required=8.0
	tests=USER_AGENT_MUTT
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

Hi All

1.  Herve Debar, one of the past editors of IDMEF, has agreed to
    edit the IDMEF document to the bitter end...

2.  His first action will be to post the updated IDMEF (change to
    schemas) as an ID.

3.  He will then start posting email messages each devoted to a
    single possible change.  This is where people really need to act.
    Some of these proposed changes are simple issues that became
    evident during the conversion process or someone's implementation
    experience.  Other changes need more discussion/analysis, so
    please get involved.

4.  Obviously, anyone else is free to post suggested changes, but 
    please keep each mail message to a single change.

mike

ps.  i will be gone for two+ weeks, the first week of which i will
have no email.

-- 
Mike Erlinger, Professor and Chair Computer Science
www:      http://www.cs.hmc.edu/~mike
email:    mike@cs.hmc.edu
smail:    Computer Science Dept., Harvey Mudd College,
          301 E. 12th Street, Claremont, CA, 91711 
          909-621-8912,   FAX: 909-607-8364


From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:41:38 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06945
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:41:36 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i099CEfd030768
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 9 Jan 2004 01:14:06 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i099CE9t030767
	for idwg-l-outgoing; Fri, 9 Jan 2004 01:12:14 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i099CBfd030752
	for <idwg-l@hmc.edu>; Fri, 9 Jan 2004 01:12:12 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 10:12:10 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Fri, 9 Jan 2004 10:12:10 +0100
Message-ID: <3FFE7069.6040108@francetelecom.com>
Date: Fri, 09 Jan 2004 10:12:09 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 12]Messages too verbose
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 09 Jan 2004 09:12:10.0154 (UTC) FILETIME=[A95C50A0:01C3D690]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i099CEfd030765
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 From Krzysztof Zaraska:
Another problem is that alerts are too verbose, i.e. every message 
sent from sensor to the manager carries the same "Analyzer" object. In 
fact, it should be enough to send such data once at the beginning of 
the session. Fortunately, as we don't use XML on sensor->manager link, 
so we can do that at the implementation level without breaking the 
draft, but the idea could be worth considering.

Hervé:
This has been beaten to death on the mailing list. Solutions are to
- compress (XML compresses well .... :-)
- use ident references, with the risk of not being fully compliant.

*Issue closed*

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:41:39 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06946
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:41:36 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i06CtXfd030883
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Tue, 6 Jan 2004 04:59:33 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i06CtWYq030882
	for idwg-l-outgoing; Tue, 6 Jan 2004 04:55:32 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from pa169.kurdwanowa.sdi.tpnet.pl (pa169.kurdwanowa.sdi.tpnet.pl [213.77.148.169])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i06CtQfd030840
	for <idwg-l@hmc.edu>; Tue, 6 Jan 2004 04:55:27 -0800
Received: by pa169.kurdwanowa.sdi.tpnet.pl (Postfix, from userid 1001)
	id 7AD392078; Tue,  6 Jan 2004 13:55:19 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
	by pa169.kurdwanowa.sdi.tpnet.pl (Postfix) with ESMTP
	id 3991C5878; Tue,  6 Jan 2004 13:55:19 +0100 (CET)
Date: Tue, 6 Jan 2004 13:55:18 +0100 (CET)
From: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
X-Sender: kzaraska@lhotse.zaraska.dhs.org
To: Herve Debar <herve.debar@francetelecom.com>
Cc: "mike@cs.hmc.edu" <mike@cs.hmc.edu>,
        intrusion detection wg <idwg-l@hmc.edu>,
        Stuart Staniford <stuart@silicondefense.com>,
        David A Curry <davy@cynicus.net>, Sandro Poppi <spoppi@gmx.net>
Subject: Re: Status
In-Reply-To: <3FF95BF3.6010103@francetelecom.com>
Message-ID: <Pine.BSF.4.21.0401061309230.568-100000@lhotse.zaraska.dhs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-2.0 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      REPLY_WITH_QUOTES,USER_AGENT_PINE
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

On Mon, 5 Jan 2004, Herve Debar wrote:

> Hi Mike and all

Hi,

> First of all, all the best for 2004.

The same to all of you,
 
> I'm still around and interested as well.

And I'd like to express the interest on behalf of the Prelude IDS
developers. Deployed Prelude installations use IDMEF in production
environment. 

> ---------------------------------------------------------------
> Issue 1: add encoding information to additional data.
> 
> The current tag for introducing additionaldata is the following:
> <additionaldata type=[fixed list] meaning=[free text]>
> 
> I propose to specify a non-mandatory list for meaning, as a 
> best-current-practice, to help convergence on the description of 
> additional data. I would include "packet-dump" in the list.
> I would also add an encoding=[free-text] tag, describing the actual 
> encoding of the information. I would also propose a BCP list of 
> values, including "hex", "base64", "UTF-8", "unicode".

Agreed. This is absolutely necessary. 

> <Protocol ip_version=[number] iana_number=[number] iana_name=[free 
> text] >some text</Protocol>
> 
> That way we would have any IP protocol represented.

The problem is that we are usually dealing with a protocol stack.
Therefore, what about the layer 2 information for example? Ethernet
addresses can go into into Source/Target, but what about, say, VPI/VCI
fields in ATM, or any other connection identifier? [This is not an
academic problem, as some people are trying to combine Prelude with
logging all traffic at the session level for later inspection and would
appreciate some form of connection identifier within the alert.]

> ---------------------------------------------------------------
> Issue 4: classification
> 
> The cve, bugtraq and vendor-specific for "origin" is a bit too 
> reductive. 

We second that. Free-form string?

Also, we would propose introducing the "id" field here, containing a
unique identifier for the vulnerability in given database, as we can see
that "name" field is being rather used as a description, and, as such,
doesn't have to be unique. 

Having the "id" field, the construction of the relevant URL is trivial
(some combination of database's base URL and the identifier). 

Having said that, I am not sure what is the use of "url" field anyhow, as
it's unclear whether it's the main database URL or a
vulnerability-specific URL, and vulnerability-specific URLs could be
generated trivially from the "id" field.

> ---------------------------------------------------------------
> Issue 5: alert routing
> 
> I'm getting questions (actually I'm into a flamewar :-) related to 
> alert routing, 

Hm? If this was the flamewar we participated in, then I remember it has
ended long time ago without reaching agreement. :-)

> and I'm wondering if the draft shouldn't be more 
> explicit on hte hierarchy between manager and analyzer (actually, this 
> may also impact the requirements document, but the question I had was 
> on IDMEF.
> 
> Situation 1 (serial/transfer)
> -----------
> 
> Imagine 3 boxes, A=analyzer, B=manager/analyzer, C=manager, connected 
> thus:
> 
> Analyzer-A -> (Manager-B / Analyzer-B) -> Manager-C
> 
> You should ([even must ?] not have alerts on C whose analyzerid is 
> Analyzer-A.

I'd like to know a rationale for this. In Prelude it's a typical situation
that C sees alerts generated by A. And it's therefore very useful to know
where the alert actually originated. 

We were also proposing is a "path record" inside the alert, specifying the
managers the alert has travelled through. 

> There are probably others, this is what I have on my plate for the 
> moment. I haven't made any changes to the draft yet.

Not earlier than yesterday we've had these issues on prelude-devel
mailing list, raised by someone trying to express events originating from 
a honeypot in IDMEF:

- severity scale (3 grades only) is too narrow; for example, there is an
idea floating around of expressing the danger associated with the attack
as exp(severity*vulnerabity_level), but you can't go far this way with 3
level severity scale only

- there is a need for INFORMATIONAL messages. For example, a honeypot
traffic is by definition anomalous, however it should be treated
differently whether it's malicious or not. Maybe these could be
implemented as alert messages with severity = 0?

Another problem is that alerts are too verbose, i.e. every message sent
from sensor to the manager carries the same "Analyzer" object. In fact, it
should be enough to send such data once at the beginning of the session.
Fortunately, as we don't use XML on sensor->manager link, so we can do
that at the implementation level without breaking the draft, but the idea
could be worth considering.

I think there are also other thinks, I can look through our mailing list
archives and send you summary if you are interested. 

Best regards,
Krzysztof

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem






From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:41:48 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06979
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:41:46 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08KgOfd010928
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 12:44:26 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08KgOCk010927
	for idwg-l-outgoing; Thu, 8 Jan 2004 12:42:24 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08KgKfd010892
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 12:42:21 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 21:42:19 +0100
Received: from francetelecom.com ([10.193.17.38]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 21:42:17 +0100
Message-ID: <3FFDC0A7.7020008@francetelecom.com>
Date: Thu, 08 Jan 2004 21:42:15 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 9] Alert routing
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 20:42:17.0822 (UTC) FILETIME=[E7D747E0:01C3D627]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08KgOfd010923
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Tthe draft should be more explicit on hte hierarchy between manager 
and analyzer

Situation 1 (serial/transfer)
-----------
Imagine 3 boxes, A=analyzer, B=manager/analyzer, C=manager, connected
thus:

Analyzer-A -> (Manager-B / Analyzer-B) -> Manager-C

You should ([even must ?] not have alerts on C whose analyzerid is
Analyzer-A.

Situation 2 (parallelism/duplication)
-----------

Imagine 3 boxes, A=analyzer, B=manager, C=manager, connected thus:

              /---> Manager-B
Analyzer-A -<
              \---> Manager-C

The same alert on Manager-B and Manager C should [must ?] have the 
same analyzerid+alertid.

I believe that with these two constructs we cover any arrangement that 
anybody may want to make.

I'm not sure this has to go in the document, but it would probably 
clear some misunderstanding.


 From Krzysztof Zaraska on Situation 1:
I'd like to know a rationale for this. In Prelude it's a typical 
situation that C sees alerts generated by A. And it's therefore very 
useful to know where the alert actually originated. We were also 
proposing is a "path record" inside the alert, specifying the managers 
the alert has travelled through.

Hervé:
The drawings just clarify that there must be a change of both 
analyzerid and alertid when going through B, at the moment. I'm open 
to discussion, if there is a concensus for a "path-record" attribute 
that would chain all analyzerids.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:42:12 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06999
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:42:10 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i05JwTfd012217
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 5 Jan 2004 12:02:29 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i05JwTbm012216
	for idwg-l-outgoing; Mon, 5 Jan 2004 11:58:29 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i05JwPfd012203
	for <idwg-l@hmc.edu>; Mon, 5 Jan 2004 11:58:26 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i05JwBMm004047;
	Mon, 5 Jan 2004 14:58:13 -0500 (EST)
Message-Id: <200401051958.i05JwBMm004047@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: mike@cs.hmc.edu, intrusion detection wg <idwg-l@hmc.edu>,
        Stuart Staniford <stuart@silicondefense.com>,
        Sandro Poppi <spoppi@gmx.net>
Subject: Re: Status 
In-Reply-To: <3FF95BF3.6010103@francetelecom.com> 
References: <20040105005114.GF18716@cs.hmc.edu> 
            <3FF95BF3.6010103@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Mon, 05 Jan 2004 13:43:31 +0100
Date: Mon, 05 Jan 2004 14:58:11 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.0 required=8.0
	tests=IN_REP_TO,REFERENCES
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


I am here as well, and still interested, although pretty starved for time.

  Herve> ---------------------------------------------------------------
  Herve> Issue 1: add encoding information to additional data.

  Herve> The current tag for introducing additionaldata is the following:
  Herve> <additionaldata type=[fixed list] meaning=[free text]>

  Herve> I propose to specify a non-mandatory list for meaning, as a
  Herve> best-current-practice, to help convergence on the description of
  Herve> additional data. I would include "packet-dump" in the list.

I thought this had come up before and was rejected by the group, although I
may be misremembering things.  I don't have any strong feelings one way or
the other.

  Herve> I would also add an encoding=[free-text] tag, describing the actual
  Herve> encoding of the information. I would also propose a BCP list of
  Herve> values, including "hex", "base64", "UTF-8", "unicode".

The only concern I have with this is that it MIGHT conflict with the encoding
stuff associated with the whole IDMEF format (in which you specify an encoding
in the XML statement).  I am not up enough on encodings to know whether that
is the case or not.

  Herve> ---------------------------------------------------------------
  Herve> Issue 3: classification

  Herve> URL: in the examples, the urls are incomplete, in the sense that they
  Herve> point to the vendor web site and not to the specific vuln. Snort IDMEF
  Herve> messages include the full URL. I believe both are correct, and we
  Herve> should have instances of both in the examples.

That's fine by me... and as far as I know what has always been intended (it's
at least what *I* always intended).  The only reason specific links are not
in the examples now is laziness on my part...

  Herve> ---------------------------------------------------------------
  Herve> Issue 4: classification

  Herve> The cve, bugtraq and vendor-specific for "origin" is a bit too
  Herve> reductive. I'd like to either add more identifiers, or add a meaning
  Herve> field to allow people to put free text in there (field that would only
  Herve> be valid if origin=unknown). For example, I have a need to carry the
  Herve> following identifiers:

I'm pretty sure the list was decided on at a meeting, and people were loathe
to specify every Source Of The Day because it would always be out of date.
I would not object to some kind of free-text or alternate-source type of
functionality in...

  Herve> ---------------------------------------------------------------
  Herve> Issue 5: alert routing

  Herve> I'm getting questions (actually I'm into a flamewar :-) related to
  Herve> alert routing, and I'm wondering if the draft shouldn't be more
  Herve> explicit on hte hierarchy between manager and analyzer (actually, this
  Herve> may also impact the requirements document, but the question I had was
  Herve> on IDMEF.

  Herve> [manager/analyzer diagrams...]

  Herve> I believe that with these two constructs we cover any arrangement that
  Herve> anybody may want to make.

I think you're right.

--Dave


From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:42:43 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA07185
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:42:42 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i05Chcfd006307
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 5 Jan 2004 04:47:38 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i05ChcjO006306
	for idwg-l-outgoing; Mon, 5 Jan 2004 04:43:38 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i05ChYfd006288
	for <idwg-l@hmc.edu>; Mon, 5 Jan 2004 04:43:35 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Mon, 5 Jan 2004 13:43:32 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Mon, 5 Jan 2004 13:43:31 +0100
Message-ID: <3FF95BF3.6010103@francetelecom.com>
Date: Mon, 05 Jan 2004 13:43:31 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: mike@cs.hmc.edu
CC: intrusion detection wg <idwg-l@hmc.edu>,
        Stuart Staniford <stuart@silicondefense.com>,
        David A Curry <davy@cynicus.net>, Sandro Poppi <spoppi@gmx.net>
Subject: Re: Status
References: <20040105005114.GF18716@cs.hmc.edu>
In-Reply-To: <20040105005114.GF18716@cs.hmc.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 05 Jan 2004 12:43:31.0991 (UTC) FILETIME=[86AC1270:01C3D389]
X-Spam-Status: No, hits=-2.1 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,REFERENCES,REPLY_WITH_QUOTES,
	      USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i05Chbfd006304
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Hi Mike and all

First of all, all the best for 2004.

I'm still around and interested as well.

Mike Erlinger wrote:
> Needs:
>    Author/Editor for IDMEF

I'd like to restart that again, now that my situation is more stable.

>    An active list to deal with IDMEF questions/issues.

Here is my current list of issues. As usual, they are more geared 
towards the data model.

---------------------------------------------------------------
Issue 1: add encoding information to additional data.

The current tag for introducing additionaldata is the following:
<additionaldata type=[fixed list] meaning=[free text]>

I propose to specify a non-mandatory list for meaning, as a 
best-current-practice, to help convergence on the description of 
additional data. I would include "packet-dump" in the list.

I would also add an encoding=[free-text] tag, describing the actual 
encoding of the information. I would also propose a BCP list of 
values, including "hex", "base64", "UTF-8", "unicode".
---------------------------------------------------------------


---------------------------------------------------------------
Issue 2: duplicate information related to protocol information.

The current draft allow specification of tcp or udp as protocol only. 
This is a problem for other protocols. Moreover, the information can 
be inserted in two places, in source and destination, and there is no 
constraint ensuring that they should be the same.

I somehow think that the protocol should be something like:

<Protocol ip_version=[number] iana_number=[number] iana_name=[free 
text] >some text</Protocol>

That way we would have any IP protocol represented.

I haven't yet made my mind where to attach this protocol information.
---------------------------------------------------------------


---------------------------------------------------------------
Issue 3: classification

Before we release the draft, I have had a question on the 
Classification class, that may confuse some implementers, and we may 
need to precise things either the examples or the wording of the class.

URL: in the examples, the urls are incomplete, in the sense that they 
point to the vendor web site and not to the specific vuln. Snort IDMEF 
messages include the full URL. I believe both are correct, and we 
should have instances of both in the examples.

NAME: Snort reuses the same name for all references. e.g:

<Classification origin="cve">
<name>SNMP public access udp</name>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0013</url>
</Classification>
<Classification origin="cve">
<name>SNMP public access udp</name>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0012</url>
</Classification>
<Classification origin="cve">
<name>SNMP public access udp</name>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0517</url>
</Classification>
<Classification origin="vendor-specific">
<name>SNMP public access udp</name>
<url>http://www.snort.org/snort-db/sid.html?sid=1411</url>
</Classification>

I tend to think we should discourage that, at least for the 2 first 
lines, because the origin+name should be a primary key for the data.
---------------------------------------------------------------

---------------------------------------------------------------
Issue 4: classification

The cve, bugtraq and vendor-specific for "origin" is a bit too 
reductive. I'd like to either add more identifiers, or add a meaning 
field to allow people to put free text in there (field that would only 
be valid if origin=unknown). For example, I have a need to carry the 
following identifiers:

snort id (sid)
nessus plugin id
arachnids
open-source vuln database
icat

---------------------------------------------------------------


---------------------------------------------------------------
Issue 5: alert routing

I'm getting questions (actually I'm into a flamewar :-) related to 
alert routing, and I'm wondering if the draft shouldn't be more 
explicit on hte hierarchy between manager and analyzer (actually, this 
may also impact the requirements document, but the question I had was 
on IDMEF.

Situation 1 (serial/transfer)
-----------

Imagine 3 boxes, A=analyzer, B=manager/analyzer, C=manager, connected 
thus:

Analyzer-A -> (Manager-B / Analyzer-B) -> Manager-C

You should ([even must ?] not have alerts on C whose analyzerid is 
Analyzer-A.


Situation 2 (parallelism/duplication)
-----------

Imagine 3 boxes, A=analyzer, B=manager, C=manager, connected thus:

              /---> Manager-B
Analyzer-A -<
              \---> Manager-C

The same alert on Manager-B and Manager C should [must ?] have the 
same analyzerid+alertid.

I believe that with these two constructs we cover any arrangement that 
anybody may want to make.

I'm not sure this has to go in the document, but it would probably 
clear some misunderstanding.

---------------------------------------------------------------


There are probably others, this is what I have on my plate for the 
moment. I haven't made any changes to the draft yet.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:43:16 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA07223
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:43:14 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i050pMfd026677
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 4 Jan 2004 16:55:22 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i050pMk6026676
	for idwg-l-outgoing; Sun, 4 Jan 2004 16:51:22 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from turing.cs.hmc.edu (turing.cs.hmc.edu [134.173.42.99])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i050pJfd026656
	for <idwg-l@hmc.edu>; Sun, 4 Jan 2004 16:51:19 -0800
Received: by turing.cs.hmc.edu (Postfix, from userid 13403)
	id AC4BF53255; Sun,  4 Jan 2004 16:51:14 -0800 (PST)
Date: Sun, 4 Jan 2004 16:51:14 -0800
From: Mike Erlinger <mike@cs.hmc.edu>
To: intrusion detection wg <idwg-l@hmc.edu>
Cc: Mike Erlinger <mike@cs.hmc.edu>,
        Stuart Staniford <stuart@silicondefense.com>
Subject: Status
Message-ID: <20040105005114.GF18716@cs.hmc.edu>
Reply-To: mike@cs.hmc.edu
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4i
X-Spam-Status: No, hits=-2.5 required=8.0
	tests=USER_AGENT_MUTT
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

Hi All

In case you have not noticed IDWG has been silent for awhile.  Lots of reasons,
but still, it would be nice to finish things.  So, i am going to try to revive
the mail list and working group.  So here goes on how I see things.

Document status:
   Req doc is in the RFC editor queue
   IDXP doc is in the RFC editor queue
   Tunnel is RFC 3620
   IDMEF - the problem child.  Needs some work based on IESG comments.
   The IETF editor wants to publish the remaining 3 documents at the same time...

Mailing list:
   I moved it from Europe to a list that I have control of here at mudd.
   Hopefully, this will mean that I can avoid some of the email issues.
   The Working Group page at the IETF lists the way to get on and off the
    list.

Chair Status:
   I have not contacted Stuart recently.  His company was undergoing some issues.
   I will try to contact him this coming week and see if he is interested in
    continuing as co-chair.

   I am still around and interested.  Just got burned by too many things to do.
   I would really like to finish IDWG.
   I will be gone for 2+ weeks starting Jan 8th, but I hope to get the list going
    before I leave.

Needs:
   Author/Editor for IDMEF
   An active list to deal with IDMEF questions/issues.

IDMEF:
   The IESG had some issues with the IDMEF document.  One of them being a need
   to convert from DTD to Schema.  Some of this work was undertaken last summer
   and a reasonable document does exist, but was never posted nor finished.

   My plan is to get the latest version of IDMEF posted as an ID
   Get an author/editor
   Get the list of IESG questions/issues onto the mailing list
   Get discussion going on each of the questions/issues, reach a consensus
       on a solution via the mail list.
   Get the document out of the Working Group and back to the IESG.


comments/questions ?

mike

   

-- 
Mike Erlinger, Professor and Chair Computer Science
www:      http://www.cs.hmc.edu/~mike
email:    mike@cs.hmc.edu
smail:    Computer Science Dept., Harvey Mudd College,
          301 E. 12th Street, Claremont, CA, 91711 
          909-621-8912,   FAX: 909-607-8364


From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:43:33 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA07244
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:43:32 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Gdnfd026131
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 08:42:04 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08GdnB3026130
	for idwg-l-outgoing; Thu, 8 Jan 2004 08:39:49 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Gdkfd026113
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 08:39:47 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 17:39:45 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 17:39:45 +0100
Message-ID: <3FFD87D0.3080008@francetelecom.com>
Date: Thu, 08 Jan 2004 17:39:44 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] [Issue 4] additionaldata and encoding
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 16:39:45.0098 (UTC) FILETIME=[05BDD2A0:01C3D606]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08Gdnfd026128
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Herve> The current tag for introducing additionaldata is the
Herve> following:
Herve> <additionaldata type=[fixed list] meaning=[free text]>
Herve> I would also add an encoding=[free-text] tag, describing
Herve> the actual encoding of the information. I would also
Herve> propose a BCP list of values, including "hex",
Herve> "base64", "UTF-8", "unicode".

DaveC> The only concern I have with this is that it MIGHT
DaveC> conflict with the encoding stuff associated with the
DaveC> whole IDMEF format (in which you specify an encoding
DaveC> in the XML statement).  I am not up enough on encodings
DaveC> to know whether that is the case or not.

Zaraska> Agreed. This is absolutely necessary.
[NOTE: I have splitted the issue in 2, and have included K Zaraska's 
comment in both, as I believe it adresses the two final issues. My 
mistake if it does not.]

In fact, the IESG comments show that there is a problem there already, 
with the BYTE type. Does someone on the list have an authorized view 
on encodings ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:45:28 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA07591
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:45:28 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08GZkfd025345
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 08:39:40 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08GZk2u025344
	for idwg-l-outgoing; Thu, 8 Jan 2004 08:35:46 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08GZhfd025332
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 08:35:43 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 17:35:41 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 17:35:39 +0100
Message-ID: <3FFD86DB.1040305@francetelecom.com>
Date: Thu, 08 Jan 2004 17:35:39 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] [Issue 3] additionaldata and meaning
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 16:35:39.0545 (UTC) FILETIME=[73616890:01C3D605]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08GZkfd025342
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Herve> The current tag for introducing additionaldata is the
Herve> following:
Herve> <additionaldata type=[fixed list] meaning=[free text]>

Herve> I propose to specify a non-mandatory list for meaning,
Herve> as a best-current-practice, to help convergence on the
Herve> description of additional data. I would include "packet-dump"
Herve> in the list.

DaveC> I thought this had come up before and was rejected by the
DaveC> group, although I may be misremembering things.  I don't
DaveC> have any strong feelings one way or the other.

Zaraska> Agreed. This is absolutely necessary.
[NOTE: I have splitted the issue in 2, and have included K Zaraska's 
comment in both, as I believe it adresses the two final issues. My 
mistake if it does not.]

The rationale for proposing such a list is to help interoperability. I 
see it as a BCP rather than a normative reference. However, I am 
reluctant to have yet another draft that would be a BCP on how to use 
the free text in all possible fields of the IDMEF DTD/Schema. So I was 
hoping that a statement like

"MAY use one of the keywords of the following list to represent this 
kind of information ...."

would be acceptable to everybody. Please comment so that we can reach 
a concensus.

BTW, if we moved to schemas, my understanding is that we could then 
have an (extensible) namespace there. Am I right ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:47:32 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA07932
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:47:32 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Gkmfd027741
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 08:48:55 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08GkmZh027740
	for idwg-l-outgoing; Thu, 8 Jan 2004 08:46:48 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Gkjfd027728
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 08:46:45 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 17:46:44 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 17:46:43 +0100
Message-ID: <3FFD8973.2030100@francetelecom.com>
Date: Thu, 08 Jan 2004 17:46:43 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 5] duplicate information related to protocol information.
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 16:46:43.0914 (UTC) FILETIME=[FF6012A0:01C3D606]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08Gkmfd027738
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

The current draft allow specification of tcp or udp as protocol only. 
This is a problem for other protocols. Moreover, the information can 
be inserted in two places, in source and destination, and there is no 
constraint ensuring that they should be the same.

I somehow think that the protocol should be something like:

<Protocol ip_version=[number] iana_number=[number] iana_name=[free 
text] >some text</Protocol>

That way we would have any IP protocol represented.

I haven't yet made my mind where to attach this protocol information.

 From Krzysztof Zaraska ->
The problem is that we are usually dealing with a protocol stack.
Therefore, what about the layer 2 information for example? Ethernet
addresses can go into into Source/Target, but what about, say, VPI/VCI
fields in ATM, or any other connection identifier? [This is not an
academic problem, as some people are trying to combine Prelude with
logging all traffic at the session level for later inspection and 
would appreciate some form of connection identifier within the alert.]

I see this as actually 2 problems, although I blend them in one for 
the moment because they may have the same solution:

1) duplicate, possibly incoherent, information in messages.
2) inability to represent anything else than TCP and UDP. I think that
    at least for ICMP it's a shame.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:49:38 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA08123
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:49:37 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08E1sfd003019
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 06:03:53 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08E1sUK003018
	for idwg-l-outgoing; Thu, 8 Jan 2004 06:01:54 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08E1nfd002974
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 06:01:50 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 15:01:48 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 15:01:47 +0100
Message-ID: <3FFD62CB.8090206@francetelecom.com>
Date: Thu, 08 Jan 2004 15:01:47 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comments section 7
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 14:01:47.0340 (UTC) FILETIME=[F48EB8C0:01C3D5EF]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08E1rfd003011
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 >ection 7 examples:
 >>
 >> Section 2.2.1 claims that IDMEF elements will be in an XML namespace,
 >> but the examples given have no namespace declaration, so the elements
 >> used there are not namespace qualified.
 >>
 >> I think the use of a namespace is correct.  A simple fix is to use a
 >> default namespace declaration in the examples, e.g.:
 >>
 >>    <IDMEF-Message version="1.0" xmlns="????">
 >>      :
 >>    </IDMEF-Message>

I'll fix these that way in the doc, unless there are objections. 
Should I use the definition in section 8, "urn:iana:xml:ns:idmef" ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:49:47 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA08140
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:49:46 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Es9fd009502
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 06:56:15 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08Es9ST009501
	for idwg-l-outgoing; Thu, 8 Jan 2004 06:54:09 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08Es4fd009440
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 06:54:04 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 15:54:02 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 15:54:00 +0100
Message-ID: <3FFD6F08.9010209@francetelecom.com>
Date: Thu, 08 Jan 2004 15:54:00 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF][Issue 2] Incomplete URLs for Classifications in examples
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 14:54:00.0623 (UTC) FILETIME=[4023C3F0:01C3D5F7]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08Es8fd009499
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

In the examples, the urls are incomplete, in the sense that they point 
to the vendor web site and not to the specific vuln. Snort IDMEF 
messages include the full URL. I believe both are correct, and we 
should have instances of both in the examples.

*This has been changed in the current version (-11). There are now 
examples of both behaviours.*

Please only voice objections.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:52:12 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA08262
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:52:11 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DYgfd032606
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 05:36:33 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08DYgNf032605
	for idwg-l-outgoing; Thu, 8 Jan 2004 05:34:42 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DYcfd032587
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 05:34:39 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:34:37 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:34:36 +0100
Message-ID: <3FFD5C6C.4070403@francetelecom.com>
Date: Thu, 08 Jan 2004 14:34:36 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comment section 4
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 13:34:37.0033 (UTC) FILETIME=[28D19D90:01C3D5EC]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08DYffd032601
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Section 4.*:
 >
 > I think the UML-based data modelling could usefully be separated from
 > XML DTD definitions;  I'd go far as to suggest the UML data model
 > should be a separate document in its own right.  This would serve to
 > separate the essential data design from its representation in XML.

We have been through this earlier. They were two drafts, there is only 
one now. 2 suggestions:

1) i can make the DTD or schema separately available as a standalone 
doc on a web page.

2) contact S.Bellovin (Mike ?) to make sure we don't get that comment 
again.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan  9 10:57:33 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA09098
	for <idwg-archive@lists.ietf.org>; Fri, 9 Jan 2004 10:57:31 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DBufd029199
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Thu, 8 Jan 2004 05:13:56 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i08DBuXt029198
	for idwg-l-outgoing; Thu, 8 Jan 2004 05:11:56 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i08DBqfd029177
	for <idwg-l@hmc.edu>; Thu, 8 Jan 2004 05:11:53 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:11:51 +0100
Received: from francetelecom.com ([10.193.199.120]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Thu, 8 Jan 2004 14:11:50 +0100
Message-ID: <3FFD5716.9070207@francetelecom.com>
Date: Thu, 08 Jan 2004 14:11:50 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [IDMEF] IESG Comment section 3.1.3
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 08 Jan 2004 13:11:51.0013 (UTC) FILETIME=[FA9B8150:01C3D5E8]
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i08DBtfd029196
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Section 3.1.3:
 >
 > I'm not sure that this is a good thing to say:
 > [[
 >    If no language is specified for an IDMEF message, English SHALL be
 >    assumed.
 > ]]
 >
 > (RFC1766 --and 3066?-- has some words about i-default)

I haven't found i-default in any of these drafts. i-<something> seems 
to be for IANA-registered languages.

Suggestions:

1) refer to RFC 3066 for handling of the language tag (this should 
probably already there because xml:lang is defined somewhere).

2) Change "IDMEF-compliant applications SHOULD" to "IDMEF-compliant 
applications MUST" and drop the 2 other paragraphs in the section.

3) Keep "SHOULD", but change "English" in the next paragraph to en or 
en-US to be compliant with the ISO naming.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Sat Jan 10 19:38:56 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA26652
	for <idwg-archive@lists.ietf.org>; Sat, 10 Jan 2004 19:38:51 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0ANX4fd007515
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sat, 10 Jan 2004 15:35:17 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0ANX3vM007514
	for idwg-l-outgoing; Sat, 10 Jan 2004 15:33:03 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from pa169.kurdwanowa.sdi.tpnet.pl (pa169.kurdwanowa.sdi.tpnet.pl [213.77.148.169])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0ANX0fd007488
	for <idwg-l@hmc.edu>; Sat, 10 Jan 2004 15:33:01 -0800
Received: by pa169.kurdwanowa.sdi.tpnet.pl (Postfix, from userid 1001)
	id 55C102078; Sun, 11 Jan 2004 00:33:17 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
	by pa169.kurdwanowa.sdi.tpnet.pl (Postfix) with ESMTP
	id 2AC5E5878; Sun, 11 Jan 2004 00:33:17 +0100 (CET)
Date: Sun, 11 Jan 2004 00:33:16 +0100 (CET)
From: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
X-Sender: kzaraska@lhotse.zaraska.dhs.org
To: Herve Debar <herve.debar@francetelecom.com>
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 10] Severity scale too narrow
In-Reply-To: <3FFE6F53.9040300@francetelecom.com>
Message-ID: <Pine.BSF.4.21.0401110029150.1156-100000@lhotse.zaraska.dhs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,USER_AGENT_PINE,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

On Fri, 9 Jan 2004, Herve Debar wrote:

> Possibilities:
> - keep 3.

I oppose :)

> - move to five (and get appropriate definitions)

Good idea, especially if it can be kept consistant with other things...
For example, syslog has own severity scale as well...

> - something else

I was thinking about a float number within 0 - 1 range (0 - harmless, 1 -
top privilege level compromise). Very flexible, but unfortunately
a little fuzzy...

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem





From idwg-l-manager@Mail.ac.hmc.edu  Sat Jan 10 19:45:27 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA26901
	for <idwg-archive@lists.ietf.org>; Sat, 10 Jan 2004 19:45:27 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0ANSdfd006894
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sat, 10 Jan 2004 15:32:39 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0ANSdQx006893
	for idwg-l-outgoing; Sat, 10 Jan 2004 15:28:39 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from pa169.kurdwanowa.sdi.tpnet.pl (pa169.kurdwanowa.sdi.tpnet.pl [213.77.148.169])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0ANSafd006866
	for <idwg-l@hmc.edu>; Sat, 10 Jan 2004 15:28:36 -0800
Received: by pa169.kurdwanowa.sdi.tpnet.pl (Postfix, from userid 1001)
	id C5E292078; Sun, 11 Jan 2004 00:28:48 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
	by pa169.kurdwanowa.sdi.tpnet.pl (Postfix) with ESMTP
	id 9A5B45878; Sun, 11 Jan 2004 00:28:48 +0100 (CET)
Date: Sun, 11 Jan 2004 00:28:47 +0100 (CET)
From: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
X-Sender: kzaraska@lhotse.zaraska.dhs.org
To: Herve Debar <herve.debar@francetelecom.com>
Cc: intrusion detection wg <idwg-l@hmc.edu>, yoann@prelude-ids.org
Subject: Re: [IDMEF][Issue 8] Classification and ident
In-Reply-To: <3FFE717B.3040403@francetelecom.com>
Message-ID: <Pine.BSF.4.21.0401110025240.1156-100000@lhotse.zaraska.dhs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-1.0 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,USER_AGENT_PINE
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

On Fri, 9 Jan 2004, Herve Debar wrote:

> Proposal:
> 
> move from
>        1..n
> Alert------Classification
> 
> to
>        1..n            0..n
> Alert-------Message--------Classification
> 
> Message has 2 fields
> - ident (reference)
> - meaning (whatever one wants to put there)
> 
> And classification is reserved for documentation.

I mostly agree, however:

1. Isn't "message" confusing with the root object?

2. What's the rationale for using > 1 Classification/documentation fields
per vulnerbility id?

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem





From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 00:25:46 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA03333
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 00:25:43 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0B49ffd004979
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sat, 10 Jan 2004 20:12:41 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0B49eHN004978
	for idwg-l-outgoing; Sat, 10 Jan 2004 20:09:40 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail.neohapsis.com (7of9.neohapsis.com [207.227.243.97])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0B49cfd004959
	for <idwg-l@hmc.edu>; Sat, 10 Jan 2004 20:09:38 -0800
Date: Sat, 10 Jan 2004 22:09:34 -0600 (CST)
From: Greg Shipley <gshipley@neohapsis.com>
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: Severity, in general [WAS: [IDMEF][Issue 10] Severity scale too
 narrow]
In-Reply-To: <Pine.BSF.4.21.0401110029150.1156-100000@lhotse.zaraska.dhs.org>
Message-ID: <mail-0401102145140-98@7bs9.arbuncfvf.pbz>
References: <Pine.BSF.4.21.0401110029150.1156-100000@lhotse.zaraska.dhs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,REFERENCES,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


I'm not sure if it's appropriate for me to comment on the severity topic
as I'm clearly not working on any of the drafts / part of the working
group, but on the off chance the following insight might be useful, here
goes:

The severity topic is a can of worms, but I believe the adoption of "SIM"
solutions (Security Information Management) in operational environments is
a testament to the need for more flexible classification models.  Many of
today's commercial SIM solutions will take in data from a security device
(firewall, NIDS, etc.) and attach a weight to it based on other data
points (asset rankings, vulnerability informations, etc.).

Security analysts can then use that weighting to help prioritize which
events they choose to investigate.  In a world where it's not uncommon for
a security analyst to be presented with 10k+ events in any given day, the
event weighting system *must* support a granular enough system to allow
effective prioritization.  (Obviously three choices won't help much with
prioritizing 10k events/alerts)

Now, again, I'm not entirely sure that the need for weighting is relevant
to the discussion at hand, but I know the limitations of syslog have also
been a problem in operational security units, and I'd hate to see those
mistakes duplicated again here.

Taking this from another angle, if you have an alert generated from a
device such as a NIDS sensor, the sensor itself might not be completely
capable of determining the alert level without further data points.  For
example, assume that device A is a NIDS sensor, and device B is a
vulnerability scanner.  While each device has its own view of the world,
their combined view can be far more accurate.  Extending the example, if
Device A detects an "IIS UNICODE" BO-based attack against system with IP
address y, and Device B knows that system y is vulnerable to such an
attack, the severity rating of that event may be weighted as z by a third
sensor/device/aggregator.  (By the same token, if Device B knows that
system y is NOT vulnerable to the attack it might provide information to
downgrade the weighting)

Bottom line: All this to say that I don't know what the ideal solution is
for severity rankings, but I am quite sure that our world will be moving
away from "high, medium, and low" rankings.  If anything is to be done
with severity rankings, it might be worth considering using an integer.
That way, at least the decision of severity could be determined by
endusers, implementors, data aggregation mechanisms, etc., and not be as
limited.

This is what I'm seeing done "in the field" today, anyway.

Hope this helps,

-Greg


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 09:17:02 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA29106
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 09:17:02 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BDBbfd008649
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 05:14:49 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BDBb4s008648
	for idwg-l-outgoing; Sun, 11 Jan 2004 05:11:37 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BDBXfd008621
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 05:11:34 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Sun, 11 Jan 2004 14:11:25 +0100
Received: from francetelecom.com ([10.193.17.45]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Sun, 11 Jan 2004 14:11:23 +0100
Message-ID: <40014B77.8070405@francetelecom.com>
Date: Sun, 11 Jan 2004 14:11:19 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
CC: intrusion detection wg <idwg-l@hmc.edu>, yoann@prelude-ids.org
Subject: Re: [IDMEF][Issue 8] Classification and ident
References: <Pine.BSF.4.21.0401110025240.1156-100000@lhotse.zaraska.dhs.org>
In-Reply-To: <Pine.BSF.4.21.0401110025240.1156-100000@lhotse.zaraska.dhs.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 11 Jan 2004 13:11:24.0195 (UTC) FILETIME=[69DCA730:01C3D844]
X-Spam-Status: No, hits=-2.5 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,REFERENCES,REPLY_WITH_QUOTES,
	      USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0BDBbfd008646
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Krzysztof Zaraska wrote:

> On Fri, 9 Jan 2004, Herve Debar wrote:
> 
> 
>>Proposal:
>>
>>move from
>>       1..n
>>Alert------Classification
>>
>>to
>>       1..n            0..n
>>Alert-------Message--------Classification
>>
>>Message has 2 fields
>>- ident (reference)
>>- meaning (whatever one wants to put there)
>>
>>And classification is reserved for documentation.
> 
> 
> I mostly agree, however:
> 
> 1. Isn't "message" confusing with the root object?
Possibly. I didn't want to use signature, though.
> 
> 2. What's the rationale for using > 1 Classification/documentation fields
> per vulnerbility id?
Multiple CVE, BID, ... ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4




From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 11:05:50 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA03110
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 11:05:49 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BF2kfd019914
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 07:05:06 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BF2kVA019912
	for idwg-l-outgoing; Sun, 11 Jan 2004 07:02:46 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from linus.bcentralhost.com (linus.bcentralhost.com [205.158.154.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BF2hfd019900
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 07:02:43 -0800
Received: (root@localhost)
	by linus.bcentralhost.com
	id KAA11901; Sun, 11 Jan 2004 10:02:37 -0500 (EST)
	[ConcentricHost SMTP Relay 1.14]
Message-ID: <200401111502.KAA11901@linus.bcentralhost.com>
From: Dan White <dwhite@securecommercesystems.com>
To: Greg Shipley <gshipley@neohapsis.com>,
        intrusion detection wg <idwg-l@hmc.edu>
Reply-To: dwhite@securecommercesystems.com
Subject: Re: Severity, in general [WAS: [IDMEF][Issue 10] Severity scale too narrow]
Date: Sun, 11 Jan 2004 10:02:37 -0500 (EST)
In-Reply-To: <Pine.BSF.4.21.0401110029150.1156-100000@lhotse.zaraska.dhs.org> from Greg Shipley <gshipley@neohapsis.com> on Sat, 10 Jan 2004 22:09:34 -0600 (CST)
MIME-Version: 1.0
ReplyTo: dwhite@securecommercesystems.com
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-Spam-Status: No, hits=-0.7 required=8.0
	tests=IN_REP_TO,MSG_ID_ADDED_BY_MTA_3,QUOTED_EMAIL_TEXT,
	      X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 7bit

I agree with Greg,

SIM or Security Event Management products have many rules based
approaches that assign criticality. The real measure of severity
is the susceptibility to the enterprise of the attack. I.e. 
Does the vulnerabity that would allow an attack ssignature to be succssfull
exist?

Severity that is on a 1-10 scale with user configuration to change seems to be a reasonable suggestion?

---- Greg Shipley <gshipley@neohapsis.com> wrote:
> 
> I'm not sure if it's appropriate for me to comment on the severity topic
> as I'm clearly not working on any of the drafts / part of the working
> group, but on the off chance the following insight might be useful, here
> goes:
> 
> The severity topic is a can of worms, but I believe the adoption of "SIM"
> solutions (Security Information Management) in operational environments is
> a testament to the need for more flexible classification models.  Many of
> today's commercial SIM solutions will take in data from a security device
> (firewall, NIDS, etc.) and attach a weight to it based on other data
> points (asset rankings, vulnerability informations, etc.).
> 
> Security analysts can then use that weighting to help prioritize which
> events they choose to investigate.  In a world where it's not uncommon for
> a security analyst to be presented with 10k+ events in any given day, the
> event weighting system *must* support a granular enough system to allow
> effective prioritization.  (Obviously three choices won't help much with
> prioritizing 10k events/alerts)
> 
> Now, again, I'm not entirely sure that the need for weighting is relevant
> to the discussion at hand, but I know the limitations of syslog have also
> been a problem in operational security units, and I'd hate to see those
> mistakes duplicated again here.
> 
> Taking this from another angle, if you have an alert generated from a
> device such as a NIDS sensor, the sensor itself might not be completely
> capable of determining the alert level without further data points.  For
> example, assume that device A is a NIDS sensor, and device B is a
> vulnerability scanner.  While each device has its own view of the world,
> their combined view can be far more accurate.  Extending the example, if
> Device A detects an "IIS UNICODE" BO-based attack against system with IP
> address y, and Device B knows that system y is vulnerable to such an
> attack, the severity rating of that event may be weighted as z by a third
> sensor/device/aggregator.  (By the same token, if Device B knows that
> system y is NOT vulnerable to the attack it might provide information to
> downgrade the weighting)
> 
> Bottom line: All this to say that I don't know what the ideal solution is
> for severity rankings, but I am quite sure that our world will be moving
> away from "high, medium, and low" rankings.  If anything is to be done
> with severity rankings, it might be worth considering using an integer.
> That way, at least the decision of severity could be determined by
> endusers, implementors, data aggregation mechanisms, etc., and not be as
> limited.
> 
> This is what I'm seeing done "in the field" today, anyway.
> 
> Hope this helps,
> 
> -Greg
> 
> 


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 11:39:56 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA04479
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 11:39:56 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFe9fd024489
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 07:42:22 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BFe9pY024488
	for idwg-l-outgoing; Sun, 11 Jan 2004 07:40:09 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFe2fd024452
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 07:40:07 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0BFe0Mm027709;
	Sun, 11 Jan 2004 10:40:00 -0500 (EST)
Message-Id: <200401111540.i0BFe0Mm027709@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] IESG Comment section 3.1.3 
In-Reply-To: <3FFD5716.9070207@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 14:11:50 +0100
Date: Sun, 11 Jan 2004 10:40:00 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> Section 3.1.3:

  +> I'm not sure that this is a good thing to say: [[ If no language is
  +> specified for an IDMEF message, English SHALL be assumed. ]]
  +> (RFC1766 --and 3066?-- has some words about i-default)

  Herve> I haven't found i-default in any of these drafts. i-<something> seems
  Herve> to be for IANA-registered languages.
  Herve> Suggestions:
  Herve> 1) refer to RFC 3066 for handling of the language tag (this should
  Herve> probably already there because xml:lang is defined somewhere).
  Herve> 2) Change "IDMEF-compliant applications SHOULD" to "IDMEF-compliant
  Herve> applications MUST" and drop the 2 other paragraphs in the section.
  Herve> 3) Keep "SHOULD", but change "English" in the next paragraph to en or
  Herve> en-US to be compliant with the ISO naming.

The above questioned text occurs in a section titled "Languages in IDMEF" on
line 555 of the XML draft.  There's another section of the same title (with
different content) in Appendix A, down at line 6342, and this is where RFC
3066 is cited.

Given that we already talk about RFC 3066, I would be included to choose your
option (2) above.

--Dave
There is also a section with tgh



From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 11:40:59 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA04498
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 11:40:58 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFghfd024783
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 07:44:33 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BFggjh024782
	for idwg-l-outgoing; Sun, 11 Jan 2004 07:42:42 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFgefd024766
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 07:42:40 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0BFgcMm027725;
	Sun, 11 Jan 2004 10:42:38 -0500 (EST)
Message-Id: <200401111542.i0BFgcMm027725@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] IESG Comment section 3.2 
In-Reply-To: <3FFD5AB4.3000009@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 14:27:16 +0100
Date: Sun, 11 Jan 2004 10:42:38 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-0.9 required=8.0
	tests=IN_REP_TO,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004,
>>>>> Herve Debar, identified as "Herve" below, wrote:

  Herve> Section 3.2:

  +> Data typing should make reference to XML schema datatypes [2].  Even
  +> among those who promote alternatives to XML schema, most folks use the
  +> XML schema datatypes as defined.
  +> [2] http://www.w3.org/TR/xmlschema-2/

  Herve> This means quite a lot of work, and the section is probably only
  Herve> pertinent if we keep the DTD. I'd like a resolution of the schema vs
  Herve> DTD before tackling this one.

I believe the decision has already been made to go to schemas.  A "draft"
schema for IDMEF was produced back in May; the major piece of work is to
updated the draft text to talk about the schema instead of the DTD.

But I agree with you, this is only an issue if we keep the DTD approach.

  +> Also, the number notations are muddling encoding issues with
  +> presentation issues (cf. use of '.' and ',' in numbers).

  Herve> I'm not sure that this is really the case, because there are
  Herve> differences in number input, at least between the EU and the US, that
  Herve> were supposed to be addressed by this specification.

I agree -- we're trying to solve the EU/US input problem, not pretty-print.

--Dave


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 11:47:51 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA04603
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 11:47:50 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFmRfd025515
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 07:50:18 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BFmRMs025514
	for idwg-l-outgoing; Sun, 11 Jan 2004 07:48:27 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFmNfd025483
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 07:48:24 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0BFmLMm027791;
	Sun, 11 Jan 2004 10:48:22 -0500 (EST)
Message-Id: <200401111548.i0BFmLMm027791@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] IESG Comment section A.3.4 
In-Reply-To: <3FFD5910.3020508@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 14:20:16 +0100
Date: Sun, 11 Jan 2004 10:48:21 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> Section A.3.4:

  +> [[ As a note of interest, XML Schemas, currently being developed by the
  +> W3C, will provide support for inheritance, as well as stronger data typing
  +> and other useful features.  Future versions of the IDMEF will probably use
  +> XML Schemas instead of DTDs; this is not currently possible because the
  +> XML Schema Recommendation has not been finalized. ]]

  +> How *old* is this document?  XML schema was approved as a W3C
  +> Recommendation (approximately their equivalent to IETF full standard) over
  +> 18 months ago -- http://www.w3.org/XML/Schema

  Herve> Suggestion: drop paragraph.

Yes, drop the paragraph.

  Herve> Now, we haven't moved to schemas yet. I have the IDMEF schema that was
  Herve> developped some time ago, as well as the examples, and will make these
  Herve> available as soon as I can. Do we want to 1) move completely, 2) keep
  Herve> DTD only or 3) provide both (if possible ??). Reactions please.

I believe we did agree to move to schemas, although maybe I'm wrong.

My first choice would be (3), but recognize that this provides ample opportunity
for the two to get out of sync or be otherwise incompatible.  I think I would
only adopt this approach if there's a way to maintain the schema as the "real"
implementation, and use some schema-to-dtd conversion tool (if such a thing
exists) to produce the dtd.

If that's not possible, then my choice would be (1) -- schemas solve a lot of
the problems the DTD approach had to kind of kludge its way around (like data
types and data formats).

--Dave


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 11:51:02 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA04693
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 11:51:02 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFjdfd025116
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 07:47:28 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BFjdeR025115
	for idwg-l-outgoing; Sun, 11 Jan 2004 07:45:39 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFjafd025103
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 07:45:36 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0BFjYMm027770;
	Sun, 11 Jan 2004 10:45:34 -0500 (EST)
Message-Id: <200401111545.i0BFjYMm027770@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] IESG Comment section 3.2.4 
In-Reply-To: <3FFD5BD4.5010001@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 14:32:04 +0100
Date: Sun, 11 Jan 2004 10:45:34 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> Sections 3.2.4, :

  +> My earlier comment was this: [[ Using XML character references to encode
  +> binary data seems seriously broken to me.  Character references in XML
  +> denote Unicode code points, *not* byte values.  I suggest looking to the
  +> XML encryption work for ways to encode binary data in XML. ]]
  +> Now I haven't a clue what this document is specifiying.  There is a
  +> reference to a BYTE datatype, but no description I can see of how it is
  +> encoded in XML.

  Herve> I think that the comment is right. In fact, this reminds me of one
  Herve> of the issues I posted earlier, adding an encoding field to the
  Herve> additionaldata field to specify encoding. Do we need byte encoding
  Herve> outside of additionaldata ? I would like this question answered before
  Herve> deciding what to do with the BYTE type.

The comment is right... that text is REALLY, REALLY old and has been sort of
superceded by real world approaches.

I believe we may still need some sort of "binary data encoding" mechanism for
people who want to stuff raw packets in there or whatever -- at least, people
seemed to want to do that back in some of the meetings.  I'm certainly willing
to be told I'm wrong and we don't need this.

But if we do, I would suggest we look at some of the other RFCs that encode
such data in XML, and follow the same approach, rather than re-inventing the
wheel.

--Dave


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 11:51:29 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA04724
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 11:51:28 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFqPfd026277
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 07:54:21 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BFqP8d026276
	for idwg-l-outgoing; Sun, 11 Jan 2004 07:52:25 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFqMfd026263
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 07:52:23 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0BFqLMm027812;
	Sun, 11 Jan 2004 10:52:21 -0500 (EST)
Message-Id: <200401111552.i0BFqLMm027812@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] IESG Comment section 3.2.5 
In-Reply-To: <3FFD5CD9.8040103@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 14:36:25 +0100
Date: Sun, 11 Jan 2004 10:52:21 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  +> Also, I noticed this: [[ 3.2.5 Enumerated Types
  +> Enumerated types are represented by the ENUM data type, and consist of an
  +> ordered list of acceptable values.  Each value has a rank (number) and a
  +> representing keyword.
  +> Within IDMEF XML messages, the enumerated type keywords are used as
  +> attribute values, and the ranks are ignored.  However, those IDMEF-
  +> compliant applications that choose to represent these values internally in
  +> a numeric format MUST use the rank values identified in this memo. ]]
  +> What right has a spec of this type to tell an application to do
  +> internally?

  Herve> Suggestion: drop paragraph.

Agreed.  I think this is an artifact of the merge of the UML draft (which had
an SMI/SNMP flavor) and the XML draft, and probably never should have made it
through the merge.

--Dave



From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 11:58:27 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA05026
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 11:58:26 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFvTfd026822
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 07:59:24 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BFvT3m026821
	for idwg-l-outgoing; Sun, 11 Jan 2004 07:57:29 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFvRfd026806
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 07:57:27 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0BFvPMm027846;
	Sun, 11 Jan 2004 10:57:25 -0500 (EST)
Message-Id: <200401111557.i0BFvPMm027846@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] IESG Comment section 2.2.1 
In-Reply-To: <3FFD624B.5010607@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 14:59:39 +0100
Date: Sun, 11 Jan 2004 10:57:25 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  +> > Also, despite this in section 2.2.1: [[ In anticipation of the
  +> > widespread use of XML namespaces, this memo includes the definition of
  +> > the URI to be used to identify the IDMEF namespace. ]] I could not find
  +> > a definition of the namespace URI.

  Herve> I think it's defined in section 8. Can somebody confirm ? Should it be
  Herve> somewhere in the doc (e.g 4.2.1) ?.

It's sort of implicitly defined in the DTD as one of the global attributes on
all the tags.  But yes, the doc should really call it out more clearly.

--Dave


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 12:01:15 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA05556
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 12:01:14 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFx9fd027014
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 08:01:01 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BFx94H027013
	for idwg-l-outgoing; Sun, 11 Jan 2004 07:59:09 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BFx6fd026991
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 07:59:07 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0BFx5Mm027865;
	Sun, 11 Jan 2004 10:59:05 -0500 (EST)
Message-Id: <200401111559.i0BFx5Mm027865@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] IESG Comments section 7 
In-Reply-To: <3FFD62CB.8090206@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 15:01:47 +0100
Date: Sun, 11 Jan 2004 10:59:05 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  +> > Section 2.2.1 claims that IDMEF elements will be in an XML namespace,
  +> > but the examples given have no namespace declaration, so the elements
  +> > used there are not namespace qualified.
  +> > I think the use of a namespace is correct.  A simple fix is to use a
  +> > default namespace declaration in the examples, e.g.:
  +> > <IDMEF-Message version="1.0" xmlns="????"> : </IDMEF-Message>

  Herve> I'll fix these that way in the doc, unless there are objections.
  Herve> Should I use the definition in section 8, "urn:iana:xml:ns:idmef" ?

Again, I think it's implicitly there, by use of attributes in the DTD.  But
(a) I could be wrong, and (b) it ought to be more obvious.  The schmea cleans
this up a bit too, I believe.

I don't know what the value should be; the one that's there is one that I
basically made up.

--Dave


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 18:55:11 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA22780
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 18:55:01 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BMlNfd013124
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 14:50:31 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0BMlMbw013122
	for idwg-l-outgoing; Sun, 11 Jan 2004 14:47:22 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from annwn23.rutgers.edu (nbcs-av.rutgers.edu [128.6.72.254])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0BMlKfd013096
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 14:47:20 -0800
Received: from localhost (localhost [127.0.0.1])
	by annwn23.rutgers.edu (Postfix) with ESMTP
	id 024AC5306; Sun, 11 Jan 2004 17:47:10 -0500 (EST)
Received: from annwn23.rutgers.edu ([127.0.0.1])
 by localhost (annwn23.rutgers.edu [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 27899-08; Sun, 11 Jan 2004 17:47:09 -0500 (EST)
Received: from eden.rutgers.edu (narnia8.rutgers.edu [165.230.180.178])
	by annwn23.rutgers.edu (Postfix) with ESMTP
	id 959E352AF; Sun, 11 Jan 2004 17:47:09 -0500 (EST)
Received: from ethercept.com (ool-43554b7f.dyn.optonline.net [67.85.75.127])
	(using TLSv1 with cipher RC4-MD5 (128/128 bits))
	(No client certificate requested)
	by eden.rutgers.edu (Postfix) with ESMTP
	id 119E940075; Sun, 11 Jan 2004 17:47:07 -0500 (EST)
Message-ID: <4001D269.5020806@ethercept.com>
Date: Sun, 11 Jan 2004 17:47:05 -0500
From: Ozakil Azim <azim@ethercept.com>
Organization: Ethercept, LLC
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: intrusion detection wg <idwg-l@hmc.edu>
Cc: Greg Shipley <gshipley@neohapsis.com>
Subject: Re: Severity, in general [WAS: [IDMEF][Issue 10] Severity scale too
 narrow]
References: <Pine.BSF.4.21.0401110029150.1156-100000@lhotse.zaraska.dhs.org> <mail-0401102145140-98@7bs9.arbuncfvf.pbz>
In-Reply-To: <mail-0401102145140-98@7bs9.arbuncfvf.pbz>
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms070207060509070205040205"
X-Virus-Scanned: by NBCS 
X-Spam-Status: No, hits=-2.5 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,REFERENCES,REPLY_WITH_QUOTES,
	      USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

This is a cryptographically signed message in MIME format.

--------------ms070207060509070205040205
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Greg Shipley wrote:

>The severity topic is a can of worms, but I believe the adoption of "SIM"
>solutions (Security Information Management) in operational environments is
>a testament to the need for more flexible classification models.  Many of
>today's commercial SIM solutions will take in data from a security device
>(firewall, NIDS, etc.) and attach a weight to it based on other data
>points (asset rankings, vulnerability informations, etc.).
>
>  
>
Having worked on a SIM product in an earlier life, I tend to agree with 
Greg on this. Aggregating events and aggregating the impact of events 
was a problem we tried to solve by using a weighted system for risk 
assessment that took into consideration asset values, exposures, and 
perceived threats amongst other variables. An event reported by a 
'standalone' IDS was reevaluated in the context of the security of the 
whole enterprise.

 As per my reading of the draft, the 'severity' is an attribute of the 
'Impact' class that is meant to deliver the evaluated impact of the 
event as seen by the analyzer.  Even if this evaluation was used in a 
purely subjective manner, three grades of severity are too narrow. Given 
that the 'impact', as assessed by the 'analyzer',  may be further 
reassessed by higher order 'analyzers', we need to use some scale that 
can useful for further evaluation/aggregation. The question is whether 
one universal scale would suffice.

Analyzers assessing alerts from other analyzers need to take at least 
the following two aspects into consideration:
1) What is the trust relationship with the 'other' analyzer? Do I know 
this analyzer? What is my history with this analyzer? What is the role 
of this analyzer in the security posture of the enterprise? What is its 
rank in the security organization?  (my analogy drives from the P.o.V of 
a general gathering intelligence from a field agent :)
2) How severe does the analyzer think the event is? What is 'its' rating 
system? What are its grades?

Aspect 1) 'trust' between analyzers, I guess is out of scope of IDMEF. 
and aspect 2) seems to be what we are discussing.

My opinion is that the analyzer generating the alert knows best. If an 
analyzer decides based on its detection/analysis algorithms to have only 
three grades, that's okay.
If the analyzers decides to grade from 0-10,000 or 0.00 - 1.00, that's 
fine too. It would be great if the analyzer could specify the range of 
its 'severity' values on request
(or with each message - I may be wrong, but I don't seem to recall a 
query mechanism in the IDMEF draft). That way, each analyzer uses what 
it is most comfortable with, and leaves the 'normalizing' to the higher 
order 'analyzer'.

>That way, at least the decision of severity could be determined by
>endusers, implementors, data aggregation mechanisms, etc., and not be as
>limited.
>
>  
>
I agree that this decision needs to be re-determinable at all the way up 
the chain till the 'human'(A.I?) operator.

-azim

--------------ms070207060509070205040205
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINTjCC
A2IwggLLoAMCAQICEAvaCxfBP4mOqwl0erTOLjMwDQYJKoZIhvcNAQECBQAwXzELMAkGA1UE
BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1Ymxp
YyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk4MDUxMjAwMDAwMFoXDTA4
MDUxMjIzNTk1OVowgcwxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJp
U2lnbiBUcnVzdCBOZXR3b3JrMUYwRAYDVQQLEz13d3cudmVyaXNpZ24uY29tL3JlcG9zaXRv
cnkvUlBBIEluY29ycC4gQnkgUmVmLixMSUFCLkxURChjKTk4MUgwRgYDVQQDEz9WZXJpU2ln
biBDbGFzcyAxIENBIEluZGl2aWR1YWwgU3Vic2NyaWJlci1QZXJzb25hIE5vdCBWYWxpZGF0
ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALtaRIoEFrtV/QN6ii2UTxV4NrgNSrJv
nFS/vOh3Kp258Gi7ldkxQXB6gUu5SBNWLccI4YRCq8CikqtEXKpC8IIOAukv+8I7u77JJwpd
trA2QjO1blSIT4dKvxna+RXoD4e2HOPMxpqOf2okkuP84GW6p7F+78nbN2rISsgJBuSZAgMB
AAGjgbAwga0wDwYDVR0TBAgwBgEB/wIBADBHBgNVHSAEQDA+MDwGC2CGSAGG+EUBBwEBMC0w
KwYIKwYBBQUHAgEWH3d3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9SUEEwMQYDVR0fBCow
KDAmoCSgIoYgaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMS5jcmwwCwYDVR0PBAQDAgEG
MBEGCWCGSAGG+EIBAQQEAwIBBjANBgkqhkiG9w0BAQIFAAOBgQACfZ5vRUs4oLje6VNkIbzk
TCuPHv6SQKzYCjlqoTIhLAebq1n+0mIafVU4sDdz3PQHZmNiveFTcFKH56jYUulbLarh3s+s
MVTUixnI2COo7wQrMn0sGBzIfImoLnfyRNFlCk10te7TG5JzdC6JOzUTcudAMZrTssSr51a+
i+P7FTCCBPAwggRZoAMCAQICEAP1lksV6ih7KcmZ6xkRC9QwDQYJKoZIhvcNAQEEBQAwgcwx
FzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3
b3JrMUYwRAYDVQQLEz13d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvUlBBIEluY29ycC4g
QnkgUmVmLixMSUFCLkxURChjKTk4MUgwRgYDVQQDEz9WZXJpU2lnbiBDbGFzcyAxIENBIElu
ZGl2aWR1YWwgU3Vic2NyaWJlci1QZXJzb25hIE5vdCBWYWxpZGF0ZWQwHhcNMDMwNDA0MDAw
MDAwWhcNMDQwNDAzMjM1OTU5WjCCARAxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYD
VQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMUYwRAYDVQQLEz13d3cudmVyaXNpZ24uY29t
L3JlcG9zaXRvcnkvUlBBIEluY29ycC4gYnkgUmVmLixMSUFCLkxURChjKTk4MR4wHAYDVQQL
ExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxMzAxBgNVBAsTKkRpZ2l0YWwgSUQgQ2xhc3MgMSAt
IE5ldHNjYXBlIEZ1bGwgU2VydmljZTEUMBIGA1UEAxQLT3pha2lsIEF6aW0xITAfBgkqhkiG
9w0BCQEWEmF6aW1AZXRoZXJjZXB0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAOi1a+JYIWVM1nqGZAs8Zsm/pBuwUUGOZaJIkVy0mtVpltNgX/749Vm5JQalzGX1TGMm
Qfbu/SaWRRwuVRm20bHEje37pdb0/e/P7InPyccfczE7IXeK7kKtkrqyF0kGX1Z/ICszCnY9
gdzW3AJ0UPWkNjETdLijH2X8BgdKzT1DGIdy6f2uuWH3usO1E73hKAXXXutpTjXQ5oeDnhlq
hqcWKoZDmEmF4RB2UwglOIM5lrMhHbxV22jERn2KxvMj0mxh6xAmyuudY/oA90aKPQ9wMVUb
COhMnoDGdi1ODLnwwJjOE3yz74kPVkBcA0vi/fZ+o8xLLMjFnELnrAMFseUCAwEAAaOCAQYw
ggECMAkGA1UdEwQCMAAwgawGA1UdIASBpDCBoTCBngYLYIZIAYb4RQEHAQEwgY4wKAYIKwYB
BQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9DUFMwYgYIKwYBBQUHAgIwVjAVFg5W
ZXJpU2lnbiwgSW5jLjADAgEBGj1WZXJpU2lnbidzIENQUyBpbmNvcnAuIGJ5IHJlZmVyZW5j
ZSBsaWFiLiBsdGQuIChjKTk3IFZlcmlTaWduMBEGCWCGSAGG+EIBAQQEAwIHgDAzBgNVHR8E
LDAqMCigJqAkhiJodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9jbGFzczEuY3JsMA0GCSqGSIb3
DQEBBAUAA4GBAEOGetfWV8ZkLUpA4sa3RUi1RpF2fxEbPZkdELQac7NtKR+LnksqKU5Pw15S
QpcNRWuPhd4p2Dd1v6ZQM5I8T6JDdhMaVcTICNcsFpO/olcYZzKGBWVUGMdnVaJb30c76kz1
MqEw2pZyIUwo9QqUk8oZeTroOhc7R6rQnrcxwG3vMIIE8DCCBFmgAwIBAgIQA/WWSxXqKHsp
yZnrGREL1DANBgkqhkiG9w0BAQQFADCBzDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAd
BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5j
b20vcmVwb3NpdG9yeS9SUEEgSW5jb3JwLiBCeSBSZWYuLExJQUIuTFREKGMpOTgxSDBGBgNV
BAMTP1ZlcmlTaWduIENsYXNzIDEgQ0EgSW5kaXZpZHVhbCBTdWJzY3JpYmVyLVBlcnNvbmEg
Tm90IFZhbGlkYXRlZDAeFw0wMzA0MDQwMDAwMDBaFw0wNDA0MDMyMzU5NTlaMIIBEDEXMBUG
A1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsx
RjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9SUEEgSW5jb3JwLiBieSBS
ZWYuLExJQUIuTFREKGMpOTgxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDEzMDEG
A1UECxMqRGlnaXRhbCBJRCBDbGFzcyAxIC0gTmV0c2NhcGUgRnVsbCBTZXJ2aWNlMRQwEgYD
VQQDFAtPemFraWwgQXppbTEhMB8GCSqGSIb3DQEJARYSYXppbUBldGhlcmNlcHQuY29tMIIB
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6LVr4lghZUzWeoZkCzxmyb+kG7BRQY5l
okiRXLSa1WmW02Bf/vj1WbklBqXMZfVMYyZB9u79JpZFHC5VGbbRscSN7ful1vT978/sic/J
xx9zMTshd4ruQq2SurIXSQZfVn8gKzMKdj2B3NbcAnRQ9aQ2MRN0uKMfZfwGB0rNPUMYh3Lp
/a65Yfe6w7UTveEoBdde62lONdDmh4OeGWqGpxYqhkOYSYXhEHZTCCU4gzmWsyEdvFXbaMRG
fYrG8yPSbGHrECbK651j+gD3Roo9D3AxVRsI6EyegMZ2LU4MufDAmM4TfLPviQ9WQFwDS+L9
9n6jzEssyMWcQuesAwWx5QIDAQABo4IBBjCCAQIwCQYDVR0TBAIwADCBrAYDVR0gBIGkMIGh
MIGeBgtghkgBhvhFAQcBATCBjjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24u
Y29tL0NQUzBiBggrBgEFBQcCAjBWMBUWDlZlcmlTaWduLCBJbmMuMAMCAQEaPVZlcmlTaWdu
J3MgQ1BTIGluY29ycC4gYnkgcmVmZXJlbmNlIGxpYWIuIGx0ZC4gKGMpOTcgVmVyaVNpZ24w
EQYJYIZIAYb4QgEBBAQDAgeAMDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9jcmwudmVyaXNp
Z24uY29tL2NsYXNzMS5jcmwwDQYJKoZIhvcNAQEEBQADgYEAQ4Z619ZXxmQtSkDixrdFSLVG
kXZ/ERs9mR0QtBpzs20pH4ueSyopTk/DXlJClw1Fa4+F3inYN3W/plAzkjxPokN2ExpVxMgI
1ywWk7+iVxhnMoYFZVQYx2dVolvfRzvqTPUyoTDalnIhTCj1CpSTyhl5Oug6FztHqtCetzHA
be8xggSqMIIEpgIBATCB4TCBzDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsT
FlZlcmlTaWduIFRydXN0IE5ldHdvcmsxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVw
b3NpdG9yeS9SUEEgSW5jb3JwLiBCeSBSZWYuLExJQUIuTFREKGMpOTgxSDBGBgNVBAMTP1Zl
cmlTaWduIENsYXNzIDEgQ0EgSW5kaXZpZHVhbCBTdWJzY3JpYmVyLVBlcnNvbmEgTm90IFZh
bGlkYXRlZAIQA/WWSxXqKHspyZnrGREL1DAJBgUrDgMCGgUAoIICnTAYBgkqhkiG9w0BCQMx
CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNDAxMTEyMjQ3MDVaMCMGCSqGSIb3DQEJ
BDEWBBQvNZmTcEGTVYWnh+6WzTeL36gFTDBSBgkqhkiG9w0BCQ8xRTBDMAoGCCqGSIb3DQMH
MA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIB
KDCB8gYJKwYBBAGCNxAEMYHkMIHhMIHMMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G
A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazFGMEQGA1UECxM9d3d3LnZlcmlzaWduLmNv
bS9yZXBvc2l0b3J5L1JQQSBJbmNvcnAuIEJ5IFJlZi4sTElBQi5MVEQoYyk5ODFIMEYGA1UE
AxM/VmVyaVNpZ24gQ2xhc3MgMSBDQSBJbmRpdmlkdWFsIFN1YnNjcmliZXItUGVyc29uYSBO
b3QgVmFsaWRhdGVkAhAD9ZZLFeooeynJmesZEQvUMIH0BgsqhkiG9w0BCRACCzGB5KCB4TCB
zDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l
dHdvcmsxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9SUEEgSW5jb3Jw
LiBCeSBSZWYuLExJQUIuTFREKGMpOTgxSDBGBgNVBAMTP1ZlcmlTaWduIENsYXNzIDEgQ0Eg
SW5kaXZpZHVhbCBTdWJzY3JpYmVyLVBlcnNvbmEgTm90IFZhbGlkYXRlZAIQA/WWSxXqKHsp
yZnrGREL1DANBgkqhkiG9w0BAQEFAASCAQB7eBzZvn7P88VjMHoXydGtvJk5VmQaccrN74Md
bs8vaSmhDvAntIqC70epSuxRA6WaK5m1x4nF9LilrhBE1j54Pdsnrs4uLkcxup7Bnq/SpP2Q
1e1itHonzyw2KkF6UGuQHD1I9nvbvdsQhLvJECgBGbJco4NlsfJYEjk469FK2fgkMrb3benp
cUxem/52gX8KFKh3V/aHwt5QniiWOIBJTFUwkDdAvqftIRQ+0ytKvmakA6xuo5AfQaEsqDcw
c8+DbZZidPIcf+xdjCNlarlJImS17oBr3J4lMccL+7qpFKhD+jA5ZwL1f9Pmehboh8ysuAYW
fw599eQVbzJ1hGKdAAAAAAAA
--------------ms070207060509070205040205--



From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 21:47:13 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26871
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 21:47:13 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C1mjfd004080
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 17:50:51 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C1mjFM004079
	for idwg-l-outgoing; Sun, 11 Jan 2004 17:48:45 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C1mgfd004065
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 17:48:42 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0C1meMm029320;
	Sun, 11 Jan 2004 20:48:40 -0500 (EST)
Message-Id: <200401120148.i0C1meMm029320@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 5] duplicate information related to protocol information. 
In-Reply-To: <3FFD8973.2030100@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 17:46:43 +0100
Date: Sun, 11 Jan 2004 20:48:40 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> I somehow think that the protocol should be something like:

  Herve> <Protocol ip_version=[number] iana_number=[number] iana_name=[free
  Herve> text] >some text</Protocol>

  Herve> That way we would have any IP protocol represented.

This seems reasonable to me... it's at least quite a bit better than "tcp"
and "udp", and we'll at least need the flexibility of IPv4 -vs- IPv6
anyway...

  Herve> From Krzysztof Zaraska -> The problem is that we are usually dealing
  Herve> with a protocol stack.  Therefore, what about the layer 2 information
  Herve> for example? Ethernet addresses can go into into Source/Target, but
  Herve> what about, say, VPI/VCI fields in ATM, or any other connection
  Herve> identifier? [This is not an academic problem, as some people are
  Herve> trying to combine Prelude with logging all traffic at the session
  Herve> level for later inspection and would appreciate some form of
  Herve> connection identifier within the alert.]

I think Layer 2 is outside the scope of what IDMEF was originally thinking
about.  That doesn't mean it couldn't be added (although I'm loathe to do
so at this late date), or that Prelude (I don't know what that is, but I
assume it's an IDS project of some sort) couldn't define some type of an
extension for it.

--Dave


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 21:47:42 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26900
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 21:47:41 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C1hqfd003539
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 17:47:41 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C1hqcx003538
	for idwg-l-outgoing; Sun, 11 Jan 2004 17:43:52 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C1hnfd003525
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 17:43:49 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0C1hlMm029274;
	Sun, 11 Jan 2004 20:43:47 -0500 (EST)
Message-Id: <200401120143.i0C1hlMm029274@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] [Issue 3] additionaldata and meaning 
In-Reply-To: <3FFD86DB.1040305@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 17:35:39 +0100
Date: Sun, 11 Jan 2004 20:43:47 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> The current tag for introducing additionaldata is the following:
  Herve> <additionaldata type=[fixed list] meaning=[free text]>
  Herve> I propose to specify a non-mandatory list for meaning, as a
  Herve> best-current-practice, to help convergence on the description of
  Herve> additional data. I would include "packet-dump" in the list.

  Herve> The rationale for proposing such a list is to help interoperability. I
  Herve> see it as a BCP rather than a normative reference. However, I am
  Herve> reluctant to have yet another draft that would be a BCP on how to use
  Herve> the free text in all possible fields of the IDMEF DTD/Schema. So I was
  Herve> hoping that a statement like
  Herve> "MAY use one of the keywords of the following list to represent this
  Herve> kind of information ...."

The only thing that bothers me about "MAY" is you're going to end up with
people who make wonderful decisions like "that's not bluish-green, it's
cyan, so since you say 'may' I'll change it."

I think a better way might be to provide a halfway decent list, and then
say something like "SHOULD use one of the keywords if possible, although
MAY define a new word if there are no close matches".  Or something like
that.

--Dave


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 21:49:09 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26949
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 21:49:09 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C1qWfd004570
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 17:54:24 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C1qWaL004569
	for idwg-l-outgoing; Sun, 11 Jan 2004 17:52:32 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C1qTfd004545
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 17:52:30 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0C1qRMm029337;
	Sun, 11 Jan 2004 20:52:28 -0500 (EST)
Message-Id: <200401120152.i0C1qRMm029337@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 8] Classification and ident 
In-Reply-To: <3FFDBF09.6080403@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 21:35:21 +0100
Date: Sun, 11 Jan 2004 20:52:27 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> From Krzysztof Zaraska:  Also, we would propose introducing the "id"
  Herve> field here, containing a unique identifier for the vulnerability in
  Herve> given database, as we can see that "name" field is being rather used
  Herve> as a description, and, as such, doesn't have to be unique. Having the
  Herve> "id" field, the construction of the relevant URL is trivial (some
  Herve> combination of database's base URL and the identifier).

I would prefer not to make the assumption that a URL could be generated from
an ID.  By doing so, you're assuming that vulnerability databases and their
URLs are built in a certain way, which is not an assumption that should be
built into IDMEF.  Because as soon as you do it, someone's gonna break it.

If the goal is that the analyzer, in the end, should have a URL to go to, then
a URL is what should be sent.  If the goal is to have an ID at the end (which
may or may not be convertible to a URL), then an ID should be sent.  But let's
not have IDMEF dictating how one can be built from the other.

--Dave


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 21:51:17 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA27023
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 21:51:17 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C1u4fd004980
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 17:58:00 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C1u4Ot004979
	for idwg-l-outgoing; Sun, 11 Jan 2004 17:56:04 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C1u1fd004962
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 17:56:02 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0C1u0Mm029357;
	Sun, 11 Jan 2004 20:56:00 -0500 (EST)
Message-Id: <200401120156.i0C1u0Mm029357@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 9] Alert routing 
In-Reply-To: <3FFDC0A7.7020008@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Thu, 08 Jan 2004 21:42:15 +0100
Date: Sun, 11 Jan 2004 20:56:00 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> From Krzysztof Zaraska on Situation 1:  I'd like to know a rationale
  Herve> for this. In Prelude it's a typical situation that C sees alerts
  Herve> generated by A. And it's therefore very useful to know where the alert
  Herve> actually originated. We were also proposing is a "path record" inside
  Herve> the alert, specifying the managers the alert has travelled through.

  Herve> Hervé:  The drawings just clarify that there must be a change of both
  Herve> analyzerid and alertid when going through B, at the moment. I'm open
  Herve> to discussion, if there is a concensus for a "path-record" attribute
  Herve> that would chain all analyzerids.

Many, many moons ago (like, in the very first XML DTD for IDMEF) I had put
an "analyzer chain" in there.  It worked more or less like "Received from"
headers in SMTP messages; each box the message passed through added its own
entry to the list (I forget which end it added it to, but that's a minor
issue).

This idea was, in no uncertain terms, hated by the group and it was removed.

Personally, I still think it's the right thing to do.

--Dave



From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 21:53:25 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA27132
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 21:53:24 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C20efd005581
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 18:02:31 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C20evL005580
	for idwg-l-outgoing; Sun, 11 Jan 2004 18:00:40 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from etsn1007.eu.pg.com ([192.44.100.155])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C20afd005538
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 18:00:37 -0800
pgSenderHost: bdc-notes041.na.pg.com [155.125.116.41]
Received: from bdc-notes041.na.pg.com (bdc-notes041.na.pg.com [155.125.116.41])
	by etsn1007.eu.pg.com (8.8.8/Switch-3.1.0) with ESMTP id i0C20O1m024835
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 03:00:25 +0100 (MET)
To: idwg-l@hmc.edu
Subject: unsubscribe
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 5.0.10  March 22, 2002
From: cruz.jb@pg.com
Message-ID: <OFEB42B78D.C1784CC7-ON48256E19.000AEEE2-48256E19.000B0383@na.pg.com>
Date: Mon, 12 Jan 2004 10:00:20 +0800
X-MIMETrack: Serialize by Router on BDC-NOTES041.NA.PG.COM/PGI(Release 5.0.3 (Intl)|21
 March 2000) at 01/11/2004 09:00:25 PM,
	Serialize complete at 01/11/2004 09:00:25 PM
Content-Type: multipart/alternative; boundary="=_alternative 000B02ED48256E19_="
X-Spam-Status: No, hits=1.9 required=8.0
	tests=HTML_10_20,HTML_MESSAGE,NO_REAL_NAME,X_AUTH_WARNING
	version=2.55
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

This is a multipart message in MIME format.
--=_alternative 000B02ED48256E19_=
Content-Type: text/plain; charset="us-ascii"

Please unsubscribe me from the mailing list. Thanks - James 
--=_alternative 000B02ED48256E19_=
Content-Type: text/html; charset="us-ascii"


<br><font size=2 face="sans-serif">Please unsubscribe me from the mailing list. Thanks - James </font>
--=_alternative 000B02ED48256E19_=--


From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 21:56:28 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA27198
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 21:56:28 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C21Nfd005686
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 18:03:16 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C21N3l005685
	for idwg-l-outgoing; Sun, 11 Jan 2004 18:01:23 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C21Jfd005661
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 18:01:20 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0C21HMm029412;
	Sun, 11 Jan 2004 21:01:17 -0500 (EST)
Message-Id: <200401120201.i0C21HMm029412@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: Yoann Vandoorselaere <yoann@prelude-ids.org>,
        Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>,
        prelude-devel@prelude-ids.org, intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [prelude-devel] [IDMEF][Issue 9] Alert routing (fwd) 
In-Reply-To: <3FFE57D7.6050006@francetelecom.com> 
References: <Pine.BSF.4.21.0401081434190.1526-100000@lhotse.zaraska.dhs.org> <1073603926.18504.27.camel@arwen> 
            <3FFE57D7.6050006@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Fri, 09 Jan 2004 08:27:19 +0100
Date: Sun, 11 Jan 2004 21:01:17 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-2.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,REPLY_WITH_QUOTES,
	      X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Fri, 9 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> Yoann Vandoorselaere wrote:

  +> I previously tried to express the need to be able to give a "name" to
  +> an analyzer, and that the analyzerID field might not be the best place
  +> for doing so as there might be real concern on checking whether a name
  +> is unique to the whole IDS environment, and that practicaly combining
  +> "analyzerID" + "manager analizerID", for uniqueness might not be doable in
  +> a given implementation.

  Herve> I will create an issue for adding a textual name to an analyzer
  Herve> representation.

An analyzer can have a hostname (foo.bar.com), as the name is part of Node,
which is in turn part of Analyzer.  But I assume you're wanting something
like "Outside IDS 1" or something descriptive like that.

If we want to do this, I would suggest adding a "description" (or something)
field to Node.  That way you could have such descriptions on anything that
can be a Node (it would be left as an exercise for the analyzer or manager
to assign data to that field).

--Dave



From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 22:01:47 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27429
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 22:01:47 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C26Hfd006306
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 18:08:12 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C26Hni006303
	for idwg-l-outgoing; Sun, 11 Jan 2004 18:06:17 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C26Efd006281
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 18:06:15 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0C26DMm029431;
	Sun, 11 Jan 2004 21:06:13 -0500 (EST)
Message-Id: <200401120206.i0C26DMm029431@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 10] Severity scale too narrow 
In-Reply-To: <3FFE6F53.9040300@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Fri, 09 Jan 2004 10:07:31 +0100
Date: Sun, 11 Jan 2004 21:06:13 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Fri, 9 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> From Krzysztof Zaraska: severity scale (3 grades only) is too narrow;
  Herve> for example, there is an idea floating around of expressing the danger
  Herve> associated with the attack as exp(severity*vulnerabity_level), but you
  Herve> can't go far this way with 3 level severity scale only.

I am way skeptical of any scheme that purports to assign numerical values to
this type of data and claim that they are "accurate" in any meaningful way.

As I recall, the group was similarly skeptical when the idea was proposed in
the past (and it was proposed more than once).

  Herve> Hervé: we use 5 internally. It seems to be standard practice within
  Herve> the telco industry:  1) = critical 2) = warning 3) = minor 4) = normal
  Herve> 5) = unclassified/unclassifiable This wouldn't solve your graduation
  Herve> issue, but it actually is enough for an operator. We also use another
  Herve> scale which has 3 levels,(solved within 1/2 hour), (solved within 1/2
  Herve> day), (solved within 1 day), but that's maybe too operations-oriented.

This seems reasonable to me.  It's fairly standard in other areas as well,
e.g. Microsoft alerts (I think), FS/ISAC alerts, and others.

Although we could argue for hours about whether the numbers should be in
ascending or descending order (proposal: Herve's choice :-).

--Dave



From idwg-l-manager@Mail.ac.hmc.edu  Sun Jan 11 22:04:17 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27484
	for <idwg-archive@lists.ietf.org>; Sun, 11 Jan 2004 22:04:17 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C28ffd006600
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 18:10:32 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C28fAp006599
	for idwg-l-outgoing; Sun, 11 Jan 2004 18:08:41 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C28cfd006584
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 18:08:38 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0C28aMm029451;
	Sun, 11 Jan 2004 21:08:37 -0500 (EST)
Message-Id: <200401120208.i0C28aMm029451@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: herve.debar@francetelecom.com
Cc: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 11] Informational messages 
In-Reply-To: <3FFE6FE2.2040704@francetelecom.com> 
Comments: reply to message from Herve Debar <herve.debar@francetelecom.com> 
          dated Fri, 09 Jan 2004 10:09:54 +0100
Date: Sun, 11 Jan 2004 21:08:36 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


>>>>> On Fri, 9 Jan 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> From Krzysztof Zaraska:  There is a need for INFORMATIONAL
  Herve> messages. For example, a honeypot traffic is by definition anomalous,
  Herve> however it should be treated differently whether it's malicious or
  Herve> not. Maybe these could be implemented as alert messages with severity
  Herve> = 0?

Is a honeypot considered an IDS?  Or at least, is it considered an IDS in the
context of the IDMEF requirements doc?  I think it's kind of a stretch.

Personally I think it's way too late in the game to go extending IDMEF in major
ways to handle things it was not intended to handle.

--Dave



From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 00:21:05 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA01019
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 00:21:05 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C4Hjfd020174
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 20:20:40 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C4HjQK020173
	for idwg-l-outgoing; Sun, 11 Jan 2004 20:17:45 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from flock1.newmail.ru (morda.newmail.ru [212.48.140.150])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with SMTP id i0C4Hefd020149
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 20:17:43 -0800
Received: (qmail 18169 invoked from network); 12 Jan 2004 04:17:31 -0000
Received: from unknown (HELO hotmail.ru) (levon@hotmail.ru@212.46.255.196)
  by smtpd.newmail.ru with SMTP; 12 Jan 2004 04:17:31 -0000
Message-ID: <40021FEB.1060305@hotmail.ru>
Date: Mon, 12 Jan 2004 07:17:47 +0300
From: Levon <levon@hotmail.ru>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030827
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: idwg-l@hmc.edu
Subject: unsubscribe
X-Enigmail-Version: 0.76.6.0
X-Enigmail-Supports: pgp-inline, pgp-mime
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 7bit

Please unsubscribe me from the mailing list. Thanks - Levon



From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 00:32:18 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA01157
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 00:32:17 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C4Wpfd021964
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 20:34:51 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C4WpvI021963
	for idwg-l-outgoing; Sun, 11 Jan 2004 20:32:51 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from brahms.cis.nctu.edu.tw (brahms.cis.nctu.edu.tw [140.113.241.161])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C4Wlfd021950
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 20:32:48 -0800
Received: from [192.168.88.152] (seifert.cis.nctu.edu.tw [140.113.88.152])
	by brahms.cis.nctu.edu.tw (8.12.9/8.12.8) with ESMTP id i0C4Ws7e018567
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 12:32:55 +0800
Date: Mon, 12 Jan 2004 12:28:34 +0800
From: Po-Ching Lin <pachinko@brahms.cis.nctu.edu.tw>
To: idwg-l@hmc.edu
Subject: unsubscribe
Message-Id: <20040112122800.2B3D.PACHINKO@brahms.cis.nctu.edu.tw>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Mailer: Becky! Ver. 2.06.02
X-Spam-Status: No, hits=-0.4 required=8.0
	tests=X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 7bit


Please unsubscribe me from the mailing list. Thanks.

-- 
Po-Ching Lin <pachinko@brahms.cis.nctu.edu.tw>



From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 02:36:55 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA16565
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 02:36:55 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C6iEfd002127
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Sun, 11 Jan 2004 22:47:05 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C6iDo1002126
	for idwg-l-outgoing; Sun, 11 Jan 2004 22:44:13 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from icebox.st.hmc.edu (dsl081-232-104.lax1.dsl.speakeasy.net [64.81.232.104])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C6iBfd002113
	for <idwg-l@hmc.edu>; Sun, 11 Jan 2004 22:44:11 -0800
Received: by icebox.st.hmc.edu (Postfix, from userid 501)
	id 2A633527854; Sun, 11 Jan 2004 22:43:44 -0800 (PST)
Date: Sun, 11 Jan 2004 22:43:44 -0800
From: Matt Beaumont <mbeaumon@cs.hmc.edu>
To: idwg-l@hmc.edu
Subject: Proper unsubscription method
Message-ID: <20040112064343.GD14150@cs.hmc.edu>
Mail-Followup-To: idwg-l@hmc.edu
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="OaZoDhBhXzo6bW1J"
Content-Disposition: inline
User-Agent: Mutt/1.5.5.1i
X-Spam-Status: No, hits=-5.4 required=8.0
	tests=PGP_SIGNATURE_2,USER_AGENT_MUTT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


--OaZoDhBhXzo6bW1J
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Send mail to listkeeper@hmc.edu with "unsubscribe idwg-l" in the body
:)

-Matt
--OaZoDhBhXzo6bW1J
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (Darwin)

iD8DBQFAAkIf6jbu++NtcqMRAtzsAJ97oMajh81IdOGBNlY30MefE3EzrACeIJs1
TEuITHgN02rj0FQj6/dvf/k=
=Y/tQ
-----END PGP SIGNATURE-----

--OaZoDhBhXzo6bW1J--


From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 04:34:50 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA19693
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 04:34:45 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C8j5fd016944
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 00:47:42 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0C8j5pJ016943
	for idwg-l-outgoing; Mon, 12 Jan 2004 00:45:05 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from noops.org (adsl-66-127-227-194.dsl.sntc01.pacbell.net [66.127.227.194])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0C8j1fd016892
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 00:45:01 -0800
Received: (qmail 44400 invoked by uid 1000); 12 Jan 2004 08:44:58 -0000
Date: Mon, 12 Jan 2004 00:44:58 -0800
From: Thomas Cannon <tcannon@noops.org>
To: idwg-l@hmc.edu
Subject: Re: unsubscribe
Message-ID: <20040112084458.GA44308@noops.org>
References: <20040112122800.2B3D.PACHINKO@brahms.cis.nctu.edu.tw>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20040112122800.2B3D.PACHINKO@brahms.cis.nctu.edu.tw>
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=IN_REP_TO,REFERENCES,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

Po-Ching Lin said:

> 
> Please unsubscribe me from the mailing list. Thanks.


I, also, would like to be unsubscribed. I'm sorry for sending this to the group,
but nowhere in the headers, footer, or anywhere else does it indicate how to
contact list management or take care of this off-line. 

If someone could, for the benefit of others, please send out a list-management
how-to or contact, it might save a lot of wasteful traffic.

My appoligies for spamming everyone.

-thomas


From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 09:08:19 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA27044
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 09:08:19 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CDM8fd015872
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 05:24:03 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CDM8Gp015871
	for idwg-l-outgoing; Mon, 12 Jan 2004 05:22:08 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from rtlab.skku.ac.kr ([61.72.102.32])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CDM5fd015840
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 05:22:05 -0800
Received: from peppermint ([10.51.12.180])
	by rtlab.skku.ac.kr (8.12.10/8.12.10) with ESMTP id i0CDMUcU020290
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 22:22:30 +0900 (KST)
Message-Id: <200401121322.i0CDMUcU020290@rtlab.skku.ac.kr>
From: =?ks_c_5601-1987?B?x9G/tcHW?= <yjhan@rtlab.skku.ac.kr>
To: <idwg-l@hmc.edu>
Subject: unsubscribe
Date: Mon, 12 Jan 2004 22:17:09 +0900
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_001E_01C3D959.D246D500"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Thread-Index: AcPYuNlu+9+VfEPpQyW5e0pFx34VAAAVXCuA
X-Spam-Status: No, hits=4.7 required=8.0
	tests=FORGED_MUA_OUTLOOK,HTML_60_70,HTML_FONT_COLOR_BLUE,
	      HTML_FONT_FACE_BAD,HTML_FONT_FACE_ODD,HTML_MESSAGE,
	      MISSING_OUTLOOK_NAME,X_AUTH_WARNING
	version=2.55
X-Spam-Level: ****
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

This is a multi-part message in MIME format.

------=_NextPart_000_001E_01C3D959.D246D500
Content-Type: text/plain;
	charset="ks_c_5601-1987"
Content-Transfer-Encoding: 7bit

Please unsubscribe me from the mailing list. Thanks -  yjhan

------=_NextPart_000_001E_01C3D959.D246D500
Content-Type: text/html;
	charset="ks_c_5601-1987"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dks_c_5601-1987">
<META content=3D"MSHTML 6.00.2800.1276" name=3DGENERATOR></HEAD>
<BODY>
<DIV dir=3Dltr align=3Dleft><FONT face=3Dsans-serif><FONT =
size=3D2>Please unsubscribe me=20
from the mailing list. Thanks -&nbsp;<SPAN =
class=3D296291613-12012004><FONT=20
face=3D=B1=BC=B8=B2=20
color=3D#0000ff>&nbsp;yjhan</FONT></SPAN></FONT></FONT></DIV></BODY></HTM=
L>

------=_NextPart_000_001E_01C3D959.D246D500--



From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 09:10:08 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA27176
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 09:10:07 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CDMSfd015939
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 05:24:19 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CDMSSh015937
	for idwg-l-outgoing; Mon, 12 Jan 2004 05:22:28 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from bfmail.benefitfocus.com (mail.benefitfocus.com [209.177.236.237])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CDMPfd015905
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 05:22:25 -0800
Received: from bfifile1.benefitfocus.com ([192.168.0.3]) by bfmail.benefitfocus.com with Microsoft SMTPSVC(5.0.2195.6713); Mon, 12 Jan 2004 08:22:19 -0500
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Subject: unsubscribe
Date: Mon, 12 Jan 2004 08:22:19 -0500
Message-ID: <5C801C093D8FD511941900D0B79E9906018411D2@bfifile1.benefitfocus.com>
Thread-Topic: unsubscribe
Thread-Index: AcPYxl8OVZEsFIHLQOev3zQJewJn7QASKa/A
From: "Tommy Gambrell" <tommy.gambrell@benefitfocus.com>
Importance: normal
To: <idwg-l@hmc.edu>
X-OriginalArrivalTime: 12 Jan 2004 13:22:19.0718 (UTC) FILETIME=[1AFF4660:01C3D90F]
X-Spam-Status: No, hits=-0.4 required=8.0
	tests=X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0CDMSfd015933
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

unsubscribe




****************************************************************************************
BENEFITFOCUS.COM CONFIDENTIALITY NOTICE: This electronic message is intended only for the individual or entity to which it is addressed and may contain information that is confidential and protected by law. Unauthorized review, use, disclosure, or dissemination of this communication or its contents in any way is prohibited and may be unlawful. If you are not the intended recipient or a person responsible for delivering this message to an intended recipient, please notify the original sender immediately by e-mail or telephone, return the original message to the original sender or to bfpostmaster@benefitfocus.com, and destroy all copies or derivations of the original message. Thank you.  (BFeComNote Rev. 07/29/2003)
***************************************************************************************



From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 09:55:24 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA28617
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 09:55:24 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CE7Yfd021004
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 06:09:38 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CE7YVi020999
	for idwg-l-outgoing; Mon, 12 Jan 2004 06:07:34 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from moultrie.cse.sc.edu (moultrie.cse.sc.edu [129.252.138.7])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CE7Vfd020969
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 06:07:31 -0800
Received: from hadar (hadar.cse.sc.edu [129.252.130.109])
	by moultrie.cse.sc.edu (Postfix) with ESMTP id 8E2D41E4E9
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 09:07:30 -0500 (EST)
Date: Mon, 12 Jan 2004 09:07:30 -0500 (EST)
From: Chin-Tser Huang <huangct@cse.sc.edu>
X-X-Sender: huangct@hadar
To: idwg-l@hmc.edu
Subject: unsubscribe
In-Reply-To: <5C801C093D8FD511941900D0B79E9906018411D2@bfifile1.benefitfocus.com>
Message-ID: <Pine.GSO.4.44.0401120906530.313-100000@hadar>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-0.9 required=8.0
	tests=IN_REP_TO,USER_AGENT_PINE,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

unsubscribe

Chin-Tser Huang
Assistant Professor
Department of Computer Science and Engineering
University of South Carolina
Columbia, SC 29208
+1-803-777-4635 voice
+1-803-777-3767 fax




From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 10:00:00 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA27175
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 09:10:07 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CDESfd014999
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 05:17:39 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CDEStO014998
	for idwg-l-outgoing; Mon, 12 Jan 2004 05:14:28 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from ns2.arlut.utexas.edu (ns2.arlut.utexas.edu [146.6.211.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CDEPfd014978
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 05:14:25 -0800
Received: from ns5.arlut.utexas.edu (ns5.arlut.utexas.edu [10.4.1.6])
	by ns2.arlut.utexas.edu (8.12.10/8.12.9) with ESMTP id i0CDEOuO091927
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 07:14:24 -0600 (CST)
Received: from MATZNERPC.arlut.utexas.edu (rbescs-1.arlut.utexas.edu [10.9.16.222])
	by ns5.arlut.utexas.edu (8.12.10/8.12.9) with ESMTP id i0CDEOpg071227
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 07:14:24 -0600 (CST)
Message-Id: <5.2.1.1.2.20040112071354.0200b008@pop-server.arlut.utexas.edu>
X-Sender: matzner@pop-server.arlut.utexas.edu
X-Mailer: QUALCOMM Windows Eudora Version 5.2.1
Date: Mon, 12 Jan 2004 07:14:24 -0600
To: idwg-l@hmc.edu
From: Sara Matzner <matzner@arlut.utexas.edu>
Subject: unsubscribe
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
X-Virus-Scanned: by amavisd-milter (http://www.amavis.org/)
X-Spam-Status: No, hits=-0.4 required=8.0
	tests=X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

Please unsubscribe me from the mailing list.

-----------------------------------------------------------------
Sara Matzner                                           (512)835-3176 PHONE
Program Manager                                     (512)835-3259 FAX
Cyber Information Assurance and Decision Support (CIADS)
Signal & Information Sciences Laboratory
Applied Research Laboratories                   matzner@arlut.utexas.edu
The University of Texas at Austin (ARL:UT)
P.O. Box 8029, Austin, Texas 78713 



From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 10:06:54 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA00315
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 10:06:53 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CEMUfd023058
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 06:24:53 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CEMUsa023057
	for idwg-l-outgoing; Mon, 12 Jan 2004 06:22:30 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from srv0010.pine.nl (srv0010.pine.nl [213.156.9.9])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CEMQfd023030
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 06:22:27 -0800
Received: from localhost (localhost [127.0.0.1])
	by srv0010.pine.nl (Pine Digital Security Mailer [srv0010.pine.nl]) with ESMTP
	id BA4B714EC5B; Mon, 12 Jan 2004 15:22:25 +0100 (CET)
Received: from [172.16.0.31] (office.pine.nl [213.156.0.3])
	(using TLSv1 with cipher RC4-SHA (128/128 bits))
	(No client certificate requested)
	by srv0010.pine.nl (Pine Digital Security Mailer [srv0010.pine.nl]) with ESMTP
	id EEFD014EBDF; Mon, 12 Jan 2004 15:22:22 +0100 (CET)
In-Reply-To: <5.2.1.1.2.20040112071354.0200b008@pop-server.arlut.utexas.edu>
References: <5.2.1.1.2.20040112071354.0200b008@pop-server.arlut.utexas.edu>
Mime-Version: 1.0 (Apple Message framework v609)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <BBFE5B32-450A-11D8-AE87-00039369AC08@pine.nl>
Content-Transfer-Encoding: 7bit
Cc: idwg-l@hmc.edu
From: Patrick Oonk <patrick@pine.nl>
Subject: Re: unsubscribe
Date: Mon, 12 Jan 2004 15:22:21 +0100
To: Sara Matzner <matzner@arlut.utexas.edu>
X-Mailer: Apple Mail (2.609)
X-Virus-Scanned: by Pine Digital Security (http://www.pine.nl)
X-Spam-Status: No, hits=-2.9 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,
	      REPLY_WITH_QUOTES,USER_AGENT_APPLEMAIL,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 7bit

me three

On 12 Jan 2004, at 14:14, Sara Matzner wrote:

> Please unsubscribe me from the mailing list.
>
> -----------------------------------------------------------------
> Sara Matzner                                           (512)835-3176 
> PHONE
> Program Manager                                     (512)835-3259 FAX
> Cyber Information Assurance and Decision Support (CIADS)
> Signal & Information Sciences Laboratory
> Applied Research Laboratories                   
> matzner@arlut.utexas.edu
> The University of Texas at Austin (ARL:UT)
> P.O. Box 8029, Austin, Texas 78713



From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 10:31:15 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA02147
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 10:31:14 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CEhsfd026258
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 06:45:57 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CEhsQG026257
	for idwg-l-outgoing; Mon, 12 Jan 2004 06:43:54 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from ihemail1.firewall.lucent.com (ihemail1.lucent.com [192.11.222.161])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CEhpfd026232
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 06:43:52 -0800
Received: from nj0117exch001p.wins.lucent.com (h135-5-177-157.lucent.com [135.5.177.157])
	by ihemail1.firewall.lucent.com (Switch-2.2.8/Switch-2.2.0) with ESMTP id i0CEhds27213
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 08:43:41 -0600 (CST)
Received: by nj0117exch001p.wh.lucent.com with Internet Mail Service (5.5.2656.59)
	id <SXMJ17AG>; Mon, 12 Jan 2004 09:43:38 -0500
Message-ID: <6CF036121950A44C93F5DB88CF3398D40404A07A@nj0117exch001u.wh.lucent.com>
From: "O'Rourke, Paul F (Paul)" <porourke@lucent.com>
To: idwg-l@hmc.edu
Subject: unsubscribe
Date: Mon, 12 Jan 2004 09:43:36 -0500
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2656.59)
Content-Type: text/plain;
	charset="iso-8859-1"
X-Spam-Status: No, hits=-0.4 required=8.0
	tests=X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

unsubscribe

Paul O'Rourke
Lucent Technologies - Internet Research Department
973-428-7946



From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 10:45:23 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA02865
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 10:45:22 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CEvsfd028426
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 06:59:58 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CEvrXX028422
	for idwg-l-outgoing; Mon, 12 Jan 2004 06:57:53 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail7.messagelabs.com (mail7.messagelabs.com [194.151.197.68])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with SMTP id i0CEvnfd028365
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 06:57:50 -0800
X-VirusChecked: Checked
X-Env-Sender: Verkoelen@fel.tno.nl
X-Msg-Ref: server-6.tower-7.messagelabs.com!1073918591!6429216
X-StarScan-Version: 5.1.15; banners=-,-,-
Received: (qmail 27270 invoked from network); 12 Jan 2004 14:43:11 -0000
Received: from zeus.tno.nl (134.221.2.2)
  by server-6.tower-7.messagelabs.com with SMTP; 12 Jan 2004 14:43:11 -0000
Received: from fs1.fel.tno.nl (charta.fel.tno.nl [134.221.46.32])
	by zeus.tno.nl (8.11.7p1+Sun/8.10.2) with ESMTP id i0CEhAf27179
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 15:43:10 +0100 (MET)
Received: from mailscan.fel.tno.nl ([10.100.100.88]) by
          fs1.fel.tno.nl (Netscape Messaging Server 4.15) with ESMTP id
          HRDSVX00.J6H for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 15:43:09 +0100 
Received: from fel.tno.nl (Not Verified[134.203.11.254]) by mailscan.fel.tno.nl with NetIQ MailMarshal (v5.5.5.8)
	id <B00019c7a3>; Mon, 12 Jan 2004 15:42:56 +0100
Message-ID: <4002B26F.E6246C7E@fel.tno.nl>
Date: Mon, 12 Jan 2004 15:42:55 +0100
From: "CAA Verkoelen" <verkoelen@fel.tno.nl>
Organization: TNO-FEL
X-Mailer: Mozilla 4.79 [en]C-Netscape2000  (Windows NT 5.0; U)
X-Accept-Language: en,nl,fr,de
MIME-Version: 1.0
To: idwg-l@hmc.edu
Subject: unsubscribe
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Spam-Status: No, hits=-0.5 required=8.0
	tests=USER_AGENT_MOZILLA_XM,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 7bit

unsubscribe
-- 
Cor Verkoelen <verkoelen@fel.tno.nl>
TNO Physics and Electronics Laboratory
Command&Control and Information Management
P.O. Box 96864, 2509 JG The Hague, The Netherlands
T  +31 (0)70 3740195  / F   +31 (0)70 3740652

-- 
------------------------------------------------------------------------------
The disclaimer that applies to e-mail from
TNO Physics and Electronics Laboratory
can be found on: http://www.tno.nl/disclaimer/email.html
------------------------------------------------------------------------------


From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 10:51:37 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA03270
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 10:51:36 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CF6bfd029857
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 07:08:32 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CF6bgm029856
	for idwg-l-outgoing; Mon, 12 Jan 2004 07:06:37 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from smtp-bedford.mitre.org (smtp-bedford-x.mitre.org [192.160.51.76])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CF6Yfd029827
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 07:06:34 -0800
Received: from smtp-bedford.mitre.org (localhost.localdomain [127.0.0.1])
	by smtp-bedford.mitre.org (8.11.6/8.11.6) with ESMTP id i0CF6Yl12462
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 10:06:34 -0500
Received: from mailsrv2a.mitre.org (mailsrv2a.mitre.org [129.83.221.56])
	by smtp-bedford.mitre.org (8.11.6/8.11.6) with ESMTP id i0CF6Xg12453
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 10:06:33 -0500
Received: from mitre.org ([129.83.18.110]) by
          mailsrv2a.mitre.org (Netscape Messaging Server 4.15) with ESMTP
          id HRDTYX00.BDL for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 10:06:33 -0500 
Message-ID: <4002B7FA.5090803@mitre.org>
Date: Mon, 12 Jan 2004 10:06:34 -0500
From: "Baker,David W." <bakerd@mitre.org>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: idwg-l@hmc.edu
Subject: How To Unsubscribe
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Spam-Status: No, hits=-0.7 required=8.0
	tests=SIGNATURE_LONG_DENSE,USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,
	      X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 7bit

For those of you wishing to unsubscribe, you should send mail to:
listkeeper@hmc.edu

And place text in the body of the email (without the quotes):
'unsubscribe idwg-l your@email.address'

Make sure you send it to the correct email address, not to the list address of 
idwg-l@hmc.edu.  If you have a signature block in your email you should remove 
it, and only send the line listed above.  no subject is necessary for the email 
either.

Sincerely,
Dave B.
-- 
  ------------------------------------------------------------
  David W. Baker                            bakerd@mitre.org
  Lead Information Systems Engineer
  G071 - Cyber Analysis and Investigations  (703) 883-3658
  The MITRE Corporation                     (703) 883-4589 (F)
  Mailstop T420                             (877) 682-0632 (P)
  7515 Colshire Drive                       McLean, VA, 22102
  ------------------------------------------------------------




From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 11:20:07 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA04226
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 11:20:07 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CFQSfd032395
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 07:28:53 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CFQSX3032394
	for idwg-l-outgoing; Mon, 12 Jan 2004 07:26:28 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from pa169.kurdwanowa.sdi.tpnet.pl (pa169.kurdwanowa.sdi.tpnet.pl [213.77.148.169])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CFQOfd032378
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 07:26:25 -0800
Received: by pa169.kurdwanowa.sdi.tpnet.pl (Postfix, from userid 1001)
	id A57452078; Mon, 12 Jan 2004 16:26:20 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
	by pa169.kurdwanowa.sdi.tpnet.pl (Postfix) with ESMTP
	id 793CC5878; Mon, 12 Jan 2004 16:26:20 +0100 (CET)
Date: Mon, 12 Jan 2004 16:26:19 +0100 (CET)
From: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
X-Sender: kzaraska@lhotse.zaraska.dhs.org
To: "David A. Curry" <davy@cynicus.net>
Cc: "herve.debar@francetelecom.com" <herve.debar@francetelecom.com>,
        intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 10] Severity scale too narrow
In-Reply-To: <200401120206.i0C26DMm029431@intrepid.cynicus.net>
Message-ID: <Pine.BSF.4.21.0401121620260.475-100000@lhotse.zaraska.dhs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-2.4 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      REPLY_WITH_QUOTES,USER_AGENT_PINE,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

On Sun, 11 Jan 2004, David A. Curry wrote:

> 
> >>>>> On Fri, 9 Jan 2004, Herve Debar, identified as "Herve" below, wrote:
> 
>   Herve> From Krzysztof Zaraska: severity scale (3 grades only) is too narrow;
>   Herve> for example, there is an idea floating around of expressing the danger
>   Herve> associated with the attack as exp(severity*vulnerabity_level), but you
>   Herve> can't go far this way with 3 level severity scale only.
> 
> I am way skeptical of any scheme that purports to assign numerical values to
> this type of data and claim that they are "accurate" in any meaningful way.

Just to clarify: I was not proposing including this kind of metric in
IDMEF, I was merely giving an example of situation where 3 level severity
scale is too narrow. 

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem





From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 11:28:52 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA04435
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 11:28:51 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CFYNfd001055
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 07:37:13 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CFYNNh001054
	for idwg-l-outgoing; Mon, 12 Jan 2004 07:34:23 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from pa169.kurdwanowa.sdi.tpnet.pl (pa169.kurdwanowa.sdi.tpnet.pl [213.77.148.169])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CFYKfd001035
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 07:34:20 -0800
Received: by pa169.kurdwanowa.sdi.tpnet.pl (Postfix, from userid 1001)
	id B97D72078; Mon, 12 Jan 2004 16:34:20 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
	by pa169.kurdwanowa.sdi.tpnet.pl (Postfix) with ESMTP
	id 777615878; Mon, 12 Jan 2004 16:34:20 +0100 (CET)
Date: Mon, 12 Jan 2004 16:34:20 +0100 (CET)
From: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
X-Sender: kzaraska@lhotse.zaraska.dhs.org
To: "David A. Curry" <davy@cynicus.net>
Cc: "herve.debar@francetelecom.com" <herve.debar@francetelecom.com>,
        intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 8] Classification and ident
In-Reply-To: <200401120152.i0C1qRMm029337@intrepid.cynicus.net>
Message-ID: <Pine.BSF.4.21.0401121628060.475-100000@lhotse.zaraska.dhs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-2.4 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      REPLY_WITH_QUOTES,USER_AGENT_PINE,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

On Sun, 11 Jan 2004, David A. Curry wrote:

> 
> >>>>> On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:
> 
>   Herve> From Krzysztof Zaraska:  Also, we would propose introducing the "id"
>   Herve> field here, containing a unique identifier for the vulnerability in
>   Herve> given database, as we can see that "name" field is being rather used
>   Herve> as a description, and, as such, doesn't have to be unique. Having the
>   Herve> "id" field, the construction of the relevant URL is trivial (some
>   Herve> combination of database's base URL and the identifier).
> 
> I would prefer not to make the assumption that a URL could be generated from
> an ID.  By doing so, you're assuming that vulnerability databases and their
> URLs are built in a certain way, which is not an assumption that should be
> built into IDMEF.  Because as soon as you do it, someone's gonna break it.

Agreed. 

To clarify, the core of my argument is: neither classification.name nor
classification.url can be relied on to specify the vulnerability
accurately, hence the proposal of the "id" field. 

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem





From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 11:36:06 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA04678
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 11:36:05 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CFiVfd002619
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 07:46:23 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CFiUZ6002618
	for idwg-l-outgoing; Mon, 12 Jan 2004 07:44:30 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from pa169.kurdwanowa.sdi.tpnet.pl (pa169.kurdwanowa.sdi.tpnet.pl [213.77.148.169])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CFiRfd002582
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 07:44:27 -0800
Received: by pa169.kurdwanowa.sdi.tpnet.pl (Postfix, from userid 1001)
	id 328EE2078; Mon, 12 Jan 2004 16:44:28 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
	by pa169.kurdwanowa.sdi.tpnet.pl (Postfix) with ESMTP
	id 05DC25878; Mon, 12 Jan 2004 16:44:27 +0100 (CET)
Date: Mon, 12 Jan 2004 16:44:27 +0100 (CET)
From: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
X-Sender: kzaraska@lhotse.zaraska.dhs.org
To: "David A. Curry" <davy@cynicus.net>
Cc: "herve.debar@francetelecom.com" <herve.debar@francetelecom.com>,
        intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 5] duplicate information related to protocol
 information.
In-Reply-To: <200401120148.i0C1meMm029320@intrepid.cynicus.net>
Message-ID: <Pine.BSF.4.21.0401121635020.475-100000@lhotse.zaraska.dhs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-2.4 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      REPLY_WITH_QUOTES,USER_AGENT_PINE,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

On Sun, 11 Jan 2004, David A. Curry wrote:

> I think Layer 2 is outside the scope of what IDMEF was originally thinking
> about.  

If so, then the draft should state it clearly. 

> That doesn't mean it couldn't be added (although I'm loathe to do so
> at this late date),

I understand. :-)

> or that Prelude (I don't know what that is, but I assume it's an IDS
> project of some sort)

Correct. http://www.prelude-ids.org/

> couldn't define some type of an extension for it.

We already do, by putting the layer 2 information into Additional Data
objects. This way has turned out to be impractical, paticularly because of
problems related to constructing relevant database queries. So we're
looking at the other possible solutions. 

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem





From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 11:43:49 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA05082
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 11:43:48 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CFiMfd002576
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 07:46:23 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CFiMbU002575
	for idwg-l-outgoing; Mon, 12 Jan 2004 07:44:22 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from destro.newdream.net (postfix@destro.newdream.net [66.33.192.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CFiJfd002556
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 07:44:20 -0800
Received: by destro.newdream.net (Postfix, from userid 1133)
	id B0A4757B92; Mon, 12 Jan 2004 07:44:19 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by destro.newdream.net (Postfix) with ESMTP
	id AF3206F5BA; Mon, 12 Jan 2004 07:44:19 -0800 (PST)
Date: Mon, 12 Jan 2004 07:44:19 -0800 (PST)
From: Andy Walther <awalther@newdream.net>
To: "O'Rourke, Paul F (Paul)" <porourke@lucent.com>
Cc: idwg-l@hmc.edu
Subject: UNSUBSCRIBE PROCEDURES
In-Reply-To: <6CF036121950A44C93F5DB88CF3398D40404A07A@nj0117exch001u.wh.lucent.com>
Message-ID: <Pine.LNX.4.58.0401120741270.25347@destro.newdream.net>
References: <6CF036121950A44C93F5DB88CF3398D40404A07A@nj0117exch001u.wh.lucent.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=0.0 required=8.0
	tests=EMAIL_ATTRIBUTION,HTML_00_10,HTML_MESSAGE,IN_REP_TO,
	      REFERENCES,REPLY_WITH_QUOTES,SUBJ_ALL_CAPS,USER_AGENT_PINE,
	      X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

As mentioned previously, in case the message got lost in the shuffle, the
correct unsubscribe procedure is to send an email to

listkeeper@hmc.edu

containing BODY text of:

unsubscribe idwg-l

or

unsubscribe idwg-l <address>

if you are sending the email from a different email account than exists on
the list.

Andy



On Mon, 12 Jan 2004, O'Rourke, Paul F (Paul) wrote:

> unsubscribe
>
> Paul O'Rourke
> Lucent Technologies - Internet Research Department
> 973-428-7946
>


From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 18:54:46 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00197
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 18:54:45 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CMoXfd029114
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 14:53:28 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0CMoX16029113
	for idwg-l-outgoing; Mon, 12 Jan 2004 14:50:33 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail.neohapsis.com (mail.neohapsis.com [207.227.243.97])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0CMoSfd029043
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 14:50:28 -0800
Date: Mon, 12 Jan 2004 16:50:24 -0600 (CST)
From: Greg Shipley <gshipley@neohapsis.com>
To: "David A. Curry" <davy@cynicus.net>
Cc: herve.debar@francetelecom.com, intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 10] Severity scale too narrow 
In-Reply-To: <200401120206.i0C26DMm029431@intrepid.cynicus.net>
Message-ID: <mail-0401121613290-37@7bs9.arbuncfvf.pbz>
References: <200401120206.i0C26DMm029431@intrepid.cynicus.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-2.9 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,
	      REPLY_WITH_QUOTES,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


On Sun, 11 Jan 2004, David A. Curry wrote:

> I am way skeptical of any scheme that purports to assign numerical
> values to this type of data and claim that they are "accurate" in any
> meaningful way.
>
> As I recall, the group was similarly skeptical when the idea was
> proposed in the past (and it was proposed more than once).

If it's a done deal, it's a done deal, and please view my ramblings as
nothing more than comments from the peanut gallery.  (and please excuse me
and my monkey wrench!) I just know from EXPERIENCE that simple
classification metrics (e.g. 5 ratings) are not going to cut it in many
real world scenarios.  For example, when we were doing our SIM testing
last year in conjunction with Syracuse University we had days when we hit
2600 events PER SECOND from our IDS/FW sensors.  Without some ability to
classify/rank those events more granularly you can forget about ever
really sifting through the data, much less acting on it.

IMO, granular classification mechanisms are mandatory when dealing with
large data volumes.  Now, whether or not that classification falls under
the IDWG charter is, well, for you folks to decide!

As for your skepticism, I totally agree with your concern about accuracy.
However, we're watching the NIDS space evolve right under our noses, and
I'm going to speculate that confidence levels will be appearing in
commercial products in less than 12 months.  Take, for example,
SourceFire's RNA product; they are using passive vulnerability
identification techniques to gather data for alert classifications.
(e.g.  That MS RPC/DCOM alert is critical because the target is indeed
vulnerable to that MS RPC attack)  I believe SourceFire's RNA is shipping,
TODAY, and other vendors are not far behind.

(Perhaps one leaves the classification system intact, and inserts an
additional/optional confidence variable, instead?)

How does this relate to the IDWG?  Again, that's for you folks to decide,
and I really don't intend to cause problems here.  But, IMO, I'm guessing
that granular classification systems and/or confidence levels will be a
factor for commercial implementations.  The commercial market is already
moving there NOW.  (And I'd be curious to hear what any of them think, if
they are on this list, but I digress...)

My .02,

-Greg

P.S. As for the ascending vs. descending, as long as its documented and
consistent, I don't think it matters...  (Herve's choice?  :)


From idwg-l-manager@Mail.ac.hmc.edu  Mon Jan 12 20:38:35 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05262
	for <idwg-archive@lists.ietf.org>; Mon, 12 Jan 2004 20:38:34 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0D0m3fd021028
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Mon, 12 Jan 2004 16:50:51 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0D0m3Po021026
	for idwg-l-outgoing; Mon, 12 Jan 2004 16:48:03 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from nova.guarded.net (nova.guarded.net [65.23.126.13])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0D0m0fd020983
	for <idwg-l@hmc.edu>; Mon, 12 Jan 2004 16:48:00 -0800
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
Content-Class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----_=_NextPart_001_01C3D96E.E11FDC9C"
Subject: RE: [IDMEF][Issue 10] Severity scale too narrow 
Date: Mon, 12 Jan 2004 19:47:54 -0500
Message-ID: <4A285282AF0C874DAF2769E57179BC4E015E9A09@nova.guarded.net>
X-MS-Has-Attach: yes
Thread-Topic: [IDMEF][Issue 10] Severity scale too narrow 
thread-index: AcPZY3MwZPRwHUjlTJSAFYH8TL22WAACe9UA
From: "Matthew F. Caldwell" <mattc@guarded.net>
To: "Greg Shipley" <gshipley@neohapsis.com>,
        "David A. Curry" <davy@cynicus.net>
Cc: <herve.debar@francetelecom.com>, "intrusion detection wg" <idwg-l@hmc.edu>
X-Spam-Status: No, hits=-0.9 required=8.0
	tests=QUOTED_EMAIL_TEXT,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk

This is a multi-part message in MIME format.

------_=_NextPart_001_01C3D96E.E11FDC9C
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

=20
Greg,=20

	I agree using an integer to describe the level of severity is a
necessity. Our SIM/SEM solution already reassign the priority into
numeric form in the aggreagation phase. It could be made better for
everyone if assignment was already in the logging format. For example:
HIGH =3D 255 , MEDIUM =3D 128 LOW =3D 64. It is faster and more =
efficient to
use an integer format in correlation primarily because string
comparisons are costly CPU wise. When you compute/correlate/classify
3000/eps any CPU cycles you can spare increases the effectiveness of the
SIM/SEM solution and or analysts running queries on databases. =20

Matt


Matthew F. Caldwell, CISSP
Founder and Chief Security Officer
GuardedNet, Inc. (neuSECURE)
Web:www.guarded.net
Email:mattc@guarded.net
Phone: 404-591-8250

-----Original Message-----
From: Greg Shipley [mailto:gshipley@neohapsis.com]=20
Sent: Monday, January 12, 2004 5:50 PM
To: David A. Curry
Cc: herve.debar@francetelecom.com; intrusion detection wg
Subject: Re: [IDMEF][Issue 10] Severity scale too narrow=20


On Sun, 11 Jan 2004, David A. Curry wrote:

> I am way skeptical of any scheme that purports to assign numerical=20
> values to this type of data and claim that they are "accurate" in any=20
> meaningful way.
>
> As I recall, the group was similarly skeptical when the idea was=20
> proposed in the past (and it was proposed more than once).

If it's a done deal, it's a done deal, and please view my ramblings as
nothing more than comments from the peanut gallery.  (and please excuse
me and my monkey wrench!) I just know from EXPERIENCE that simple
classification metrics (e.g. 5 ratings) are not going to cut it in many
real world scenarios.  For example, when we were doing our SIM testing
last year in conjunction with Syracuse University we had days when we
hit 2600 events PER SECOND from our IDS/FW sensors.  Without some
ability to classify/rank those events more granularly you can forget
about ever really sifting through the data, much less acting on it.

IMO, granular classification mechanisms are mandatory when dealing with
large data volumes.  Now, whether or not that classification falls under
the IDWG charter is, well, for you folks to decide!

As for your skepticism, I totally agree with your concern about
accuracy.
However, we're watching the NIDS space evolve right under our noses, and
I'm going to speculate that confidence levels will be appearing in
commercial products in less than 12 months.  Take, for example,
SourceFire's RNA product; they are using passive vulnerability
identification techniques to gather data for alert classifications.
(e.g.  That MS RPC/DCOM alert is critical because the target is indeed
vulnerable to that MS RPC attack)  I believe SourceFire's RNA is
shipping, TODAY, and other vendors are not far behind.

(Perhaps one leaves the classification system intact, and inserts an
additional/optional confidence variable, instead?)

How does this relate to the IDWG?  Again, that's for you folks to
decide, and I really don't intend to cause problems here.  But, IMO, I'm
guessing that granular classification systems and/or confidence levels
will be a factor for commercial implementations.  The commercial market
is already moving there NOW.  (And I'd be curious to hear what any of
them think, if they are on this list, but I digress...)

My .02,

-Greg

P.S. As for the ascending vs. descending, as long as its documented and
consistent, I don't think it matters...  (Herve's choice?  :)


------_=_NextPart_001_01C3D96E.E11FDC9C
Content-Type: text/x-vcard;
	name="Matthew F. Caldwell (mattc@guarded.net).vcf"
Content-Description: Matthew F. Caldwell (mattc@guarded.net).vcf
Content-Disposition: attachment;
	filename="Matthew F. Caldwell (mattc@guarded.net).vcf"
Content-Transfer-Encoding: base64

QkVHSU46VkNBUkQNClZFUlNJT046Mi4xDQpOOkNhbGR3ZWxsO01hdHRoZXcNCkZOOk1hdHRoZXcg
Ri4gQ2FsZHdlbGwNCk9SRzpHdWFyZGVkTmV0LkluYywgVVNBO0V4ZWN1dGl2ZQ0KVElUTEU6Q1NP
DQpURUw7V09SSztWT0lDRTo0MDQtNTkxLTgyNTANClRFTDtDRUxMO1ZPSUNFOjQwNC05MzYtNjI5
OQ0KQURSO1dPUks7RU5DT0RJTkc9UVVPVEVELVBSSU5UQUJMRTo7QXRsYW50YSAtIENvcnBvcmF0
ZTsyMDYgUmVpbmhhcmR0IFN0cmVldD0wRD0wQUExO0F0bGFudGE7R0E7MzAzMTI7VU5JVEVEIFNU
PQ0KQVRFUw0KTEFCRUw7V09SSztFTkNPRElORz1RVU9URUQtUFJJTlRBQkxFOkF0bGFudGEgLSBD
b3Jwb3JhdGU9MEQ9MEEyMDYgUmVpbmhhcmR0IFN0cmVldD0wRD0wQUExPTBEPTBBQXRsYW50YSwg
R0EgMzAzMTI9DQo9MEQ9MEFVTklURUQgU1RBVEVTDQpFTUFJTDtQUkVGO0lOVEVSTkVUOm1hdHRj
QGd1YXJkZWQubmV0DQpSRVY6MjAwMzEwMDdUMTg0ODM4Wg0KRU5EOlZDQVJEDQo=

------_=_NextPart_001_01C3D96E.E11FDC9C--


From idwg-l-manager@Mail.ac.hmc.edu  Tue Jan 13 11:43:43 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23290
	for <idwg-archive@lists.ietf.org>; Tue, 13 Jan 2004 11:43:42 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DFVpfd025052
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Tue, 13 Jan 2004 07:35:52 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0DFVp4D025048
	for idwg-l-outgoing; Tue, 13 Jan 2004 07:31:51 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from intrepid.cynicus.net (ool-44c4bee1.dyn.optonline.net [68.196.190.225])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DFVmfd025025
	for <idwg-l@hmc.edu>; Tue, 13 Jan 2004 07:31:48 -0800
Received: from intrepid.cynicus.net (localhost [127.0.0.1])
	by intrepid.cynicus.net (8.12.10/8.12.10) with ESMTP id i0DFVZMm006103;
	Tue, 13 Jan 2004 10:31:35 -0500 (EST)
Message-Id: <200401131531.i0DFVZMm006103@intrepid.cynicus.net>
X-Mailer: exmh version 2.6.3 04/04/2003 with nmh-1.0.4
To: detmar.liesen@gmx.de
Cc: idwg-l@hmc.edu
Subject: IDMEF Implementations (fwd)
Content-Transfer-Encoding: quoted-printable
Date: Tue, 13 Jan 2004 10:31:35 -0500
From: "David A. Curry" <davy@cynicus.net>
X-Spam-Status: No, hits=0.0 required=8.0
	tests=none
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: quoted-printable


Detmar,

I'm copying your message to the IDWG mailing list; maybe there's some fol=
ks
there with an interest who can help you.

--Dave

------- Forwarded Message


  From:    Detmar Liesen <detmar.liesen@gmx.de>
  To:      davy@cynicus.net
  Date:    Tue, 13 Jan 2004 08:08:56 +0100
  Subject: IDMEF Implementations

  Hi David,
  we proudly present....
  =

  The threatman-project (www.sourceforge.net/projects/threatman) has rele=
ased
  first alpha code for the idmef/idxp-device-proxy, one basic part of the=

  threat-management framework that we're developing.
  =

  Until now we can't do much more than sending back and forth idmef-messa=
ges
  over the beep tunnel, but it's a first start.
  =

  Sandro Poppi, who has also taken over maintenance of the snort-idmef-pl=
ugin
  (www.sourceforge.net/projects/snort-idmef), has done the most programmi=
ng.
  =

  Next, we'll try to write first proof-of-concept code for correlating
  idmef-messages with asset/vuln. information.
  =

  Do you have some good advise, how to handle this?
  What are the best methods for comparing xml-data from different xml-doc=
s?
  What methods shall we use for storing data (xml-db with mysql or native=

  xml).
  You know, I don't want to reinvent the wheel...
  ;)
  Of course it'd be great to plug into the acid database, so that correla=
tion
  information can be displayed within acid. We will provide an acid-outpu=
t
  plugin for sure.
  =

  I think I am going to use perl for the correlation-engine as a start,
  because with perl it's much easier to write proof-of-concept code when =
you're not
  such an advanced programmer. We can backport the code to C/C++ later.
  =

  I'd be very grateful for your ideas and comments.
  =

  Thanks,
  --Detmar
  =

  -- =

  +++ GMX - die erste Adresse f=FCr Mail, Message, More +++
  Neu: Preissenkung f=FCr MMS und FreeMMS! http://www.gmx.net
  =



------- End of Forwarded Message




From idwg-l-manager@Mail.ac.hmc.edu  Tue Jan 13 14:27:22 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA05929
	for <idwg-archive@lists.ietf.org>; Tue, 13 Jan 2004 14:27:22 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DIhHfd003096
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Tue, 13 Jan 2004 10:46:22 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0DIhHvk003094
	for idwg-l-outgoing; Tue, 13 Jan 2004 10:43:17 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DIhDfd003061
	for <idwg-l@hmc.edu>; Tue, 13 Jan 2004 10:43:14 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 13 Jan 2004 19:43:12 +0100
Received: from francetelecom.com ([10.193.106.52]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 13 Jan 2004 19:43:11 +0100
Message-ID: <400338CF.6010007@francetelecom.com>
Date: Tue, 13 Jan 2004 01:16:15 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: herve.debar@francetelecom.com
CC: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 6] Classification and name
References: <3FFDBD4B.2030405@francetelecom.com>
In-Reply-To: <3FFDBD4B.2030405@francetelecom.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 13 Jan 2004 18:43:11.0511 (UTC) FILETIME=[185F8270:01C3DA05]
X-Spam-Status: No, hits=-2.9 required=8.0
	tests=DATE_IN_PAST_12_24,EMAIL_ATTRIBUTION,IN_REP_TO,
	      QUOTED_EMAIL_TEXT,REFERENCES,REPLY_WITH_QUOTES,
	      USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0DIhHfd003084
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Herve Debar wrote:
> Herve> The cve, bugtraq and vendor-specific for "origin" is a bit too
> Herve> reductive. I'd like to either add more identifiers, or add a 
> Herve> meaning field to allow people to put free text in there
> Herve> (field that would only be valid if origin=unknown).
> 
> DaveC> I'm pretty sure the list was decided on at a meeting, and
> DaveC> people were loathe to specify every Source Of The Day because
> DaveC> it would always be out of date. I would not object to some
> DaveC> kind of free-text or alternate-source type of functionality
> DaveC> in...
> 
> Zaraska> We second that. Free-form string?
> 
> I also believe that if we went to a schema (or maybe even without), we 
> could define a namespace.
> 
> OK, pending the namespace issue, the proposal is to:
> 
> add another keyword, meaning, that is free text, and is only valid if 
> origin=unknown (and/or vendor-specific ?).

*See issue 8 for continued disccussion. This one is closed.*

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4





From idwg-l-manager@Mail.ac.hmc.edu  Tue Jan 13 14:29:54 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06029
	for <idwg-archive@lists.ietf.org>; Tue, 13 Jan 2004 14:29:53 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DIhMfd003147
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Tue, 13 Jan 2004 10:46:22 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0DIhM1I003146
	for idwg-l-outgoing; Tue, 13 Jan 2004 10:43:22 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DIhJfd003117
	for <idwg-l@hmc.edu>; Tue, 13 Jan 2004 10:43:19 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 13 Jan 2004 19:43:18 +0100
Received: from francetelecom.com ([10.193.106.52]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 13 Jan 2004 19:43:17 +0100
Message-ID: <40033A0B.3050105@francetelecom.com>
Date: Tue, 13 Jan 2004 01:21:31 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: herve.debar@francetelecom.com
CC: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 8] Classification and ident
References: <3FFDBF09.6080403@francetelecom.com>
In-Reply-To: <3FFDBF09.6080403@francetelecom.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 13 Jan 2004 18:43:17.0667 (UTC) FILETIME=[1C0AD730:01C3DA05]
X-Spam-Status: No, hits=-1.4 required=8.0
	tests=DATE_IN_PAST_12_24,IN_REP_TO,REFERENCES,
	      USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0DIhMfd003144
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

Here is my proposal for advancing the discussion on classification. 
This is not a formal text change in the draft, but sort of a midway 
point for general agreement.

Model:

+-------+ 1..n  +--------------+ 0..n  +----------------+ 0..1+----+
| Alert |<>-----|Classification|<>-----| Reference      |<>---|URL |
+-------+       +--------------+       +----------------+     +----+
                 | STRING ident |       | STRING origin  |
		| STRING name  |       | STRING meaning |
		|              |       | STRING name    |
                 +--------------+       +----------------+

Description
- Classification is the only mandatory piece of information, 
indicating what the alert is about. It provides an identification 
(pointer to previously transmitted information) and a name. The name 
must be filled in and non-blank if identification is not filled.
- Reference is there for documentation purposes, to provide additional 
information and naming about the Classification.
- Providing an URL for the reference is mandatory.

Rationale:
This structure is closer to the state of the art. It allows passing 
classification information by reference, like source and destination, 
which is useful for avoiding overload.

Problems:
- What to do if there are different "reference" sets for the same 
Classification.name ?
- do we provide a namespace for origin, that allows us to get rid of 
meaning ?

Comments ?

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4





From idwg-l-manager@Mail.ac.hmc.edu  Tue Jan 13 14:30:37 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06109
	for <idwg-archive@lists.ietf.org>; Tue, 13 Jan 2004 14:30:36 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DIhHfd003099
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Tue, 13 Jan 2004 10:46:22 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0DIhH4m003095
	for idwg-l-outgoing; Tue, 13 Jan 2004 10:43:17 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DIhDfd003054
	for <idwg-l@hmc.edu>; Tue, 13 Jan 2004 10:43:14 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 13 Jan 2004 19:43:09 +0100
Received: from francetelecom.com ([10.193.106.52]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 13 Jan 2004 19:43:08 +0100
Message-ID: <40030F61.7050505@francetelecom.com>
Date: Mon, 12 Jan 2004 22:19:29 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: "David A. Curry" <davy@cynicus.net>
CC: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] IESG Comment section 3.1.3
References: <200401111540.i0BFe0Mm027709@intrepid.cynicus.net>
In-Reply-To: <200401111540.i0BFe0Mm027709@intrepid.cynicus.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 13 Jan 2004 18:43:08.0292 (UTC) FILETIME=[16745440:01C3DA05]
X-Spam-Status: No, hits=-2.4 required=8.0
	tests=DATE_IN_PAST_12_24,EMAIL_ATTRIBUTION,IN_REP_TO,REFERENCES,
	      REPLY_WITH_QUOTES,USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,
	      X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0DIhHfd003085
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

David A. Curry wrote:
> Given that we already talk about RFC 3066, I would be included to choose your
> option (2) above.

Done in current draft.

*Comment resolved*

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4





From idwg-l-manager@Mail.ac.hmc.edu  Tue Jan 13 14:32:41 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06184
	for <idwg-archive@lists.ietf.org>; Tue, 13 Jan 2004 14:32:39 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DIhKfd003133
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Tue, 13 Jan 2004 10:46:22 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0DIhKZZ003132
	for idwg-l-outgoing; Tue, 13 Jan 2004 10:43:20 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0DIhHfd003083
	for <idwg-l@hmc.edu>; Tue, 13 Jan 2004 10:43:17 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp1.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 13 Jan 2004 19:43:15 +0100
Received: from francetelecom.com ([10.193.106.52]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 13 Jan 2004 19:43:14 +0100
Message-ID: <400339F6.7060300@francetelecom.com>
Date: Tue, 13 Jan 2004 01:21:10 +0100
From: Herve Debar <herve.debar@francetelecom.com>
Reply-To: herve.debar@francetelecom.com
Organization: France Telecom R et D
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: "David A. Curry" <davy@cynicus.net>
CC: intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF] IESG Comment section 3.2.5
References: <200401111552.i0BFqLMm027812@intrepid.cynicus.net>
In-Reply-To: <200401111552.i0BFqLMm027812@intrepid.cynicus.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 13 Jan 2004 18:43:14.0699 (UTC) FILETIME=[1A45F5B0:01C3DA05]
X-Spam-Status: No, hits=-2.9 required=8.0
	tests=DATE_IN_PAST_12_24,EMAIL_ATTRIBUTION,IN_REP_TO,
	      QUOTED_EMAIL_TEXT,REFERENCES,REPLY_WITH_QUOTES,
	      USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0DIhKfd003124
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

David A. Curry wrote:

>>>>>>On Thu, 8 Jan 2004, Herve Debar, identified as "Herve" below, wrote:
> 
> 
>   +> Also, I noticed this: [[ 3.2.5 Enumerated Types
>   +> Enumerated types are represented by the ENUM data type, and consist of an
>   +> ordered list of acceptable values.  Each value has a rank (number) and a
>   +> representing keyword.
>   +> Within IDMEF XML messages, the enumerated type keywords are used as
>   +> attribute values, and the ranks are ignored.  However, those IDMEF-
>   +> compliant applications that choose to represent these values internally in
>   +> a numeric format MUST use the rank values identified in this memo. ]]
>   +> What right has a spec of this type to tell an application to do
>   +> internally?
> 
>   Herve> Suggestion: drop paragraph.
> 
> Agreed.  I think this is an artifact of the merge of the UML draft (which had
> an SMI/SNMP flavor) and the XML draft, and probably never should have made it
> through the merge.
> 
> --Dave
> 
> 
Formal proposal:
---------

Replace:

<section title="Enumerated Types">
<t>Enumerated types are represented by the ENUM data type, and consist
of an ordered list of acceptable values.  Each value has a rank
(number) and a representing keyword.</t>

<t>Within IDMEF XML messages, the enumerated type keywords are used as
attribute values, and the ranks are ignored.  However, those IDMEF-
compliant applications that choose to represent these values
internally in a numeric format MUST use the rank values identified in
this memo.</t>
</section>

by

<section title="Enumerated Types">
<t>Enumerated types are represented by the ENUM data type, and consist
of an ordered list of acceptable values.</t>
</section>


Possibility:
------------
Create namespaces for all enum types to allow easier evolution of the 
standard ?

*Unless strong objections, this change will appear in next draft.*

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4





From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan 16 20:48:59 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09455
	for <idwg-archive@lists.ietf.org>; Fri, 16 Jan 2004 20:48:58 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H11nfd013498
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 16 Jan 2004 17:05:49 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0H11nGK013495
	for idwg-l-outgoing; Fri, 16 Jan 2004 17:01:49 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail.prelude-ids.org ([195.69.197.65])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H11jfd013448
	for <idwg-l@hmc.edu>; Fri, 16 Jan 2004 17:01:46 -0800
Received: from 192.168.1.101 (i-195-137-71-87.freedom2surf.net [195.137.71.87])
	by mail.prelude-ids.org (Postfix) with ESMTP id 368C7A4CB
	for <idwg-l@hmc.edu>; Sat, 17 Jan 2004 01:55:39 +0100 (CET)
Subject: [Fwd: Re: [prelude-devel] [IDMEF][Issue 9] Alert routing (fwd)]
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: IDWG <idwg-l@hmc.edu>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-JPmbPHcRpYi+7QZk9rQk"
Message-Id: <1074301061.8170.16.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5 
Date: Sat, 17 Jan 2004 00:57:41 +0000
X-Spam-Status: No, hits=-5.2 required=8.0
	tests=FWD_MSG,PGP_SIGNATURE_2,USER_AGENT_XIMIAN
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


--=-JPmbPHcRpYi+7QZk9rQk
Content-Type: multipart/mixed; boundary="=-TnmZCske0zo7M26xwQr/"


--=-TnmZCske0zo7M26xwQr/
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

didn't made it... re-sending...

--=20
Yoann Vandoorselaere, http://www.prelude-ids.org

"Programming is a race between programmers, who try and make more and=20
 more idiot-proof software, and universe, which produces more and more=20
 remarkable idiots. Until now, universe leads the race"  -- R. Cook


--=-TnmZCske0zo7M26xwQr/
Content-Disposition: inline
Content-Description: Forwarded message - Re: [prelude-devel] [IDMEF][Issue
	9] Alert routing (fwd)
Content-Type: message/rfc822

Subject: Re: [prelude-devel] [IDMEF][Issue 9] Alert routing (fwd)
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: herve.debar@francetelecom.com
Cc: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>,  prelude-devel@prelude-ids.org, intrusion detection wg <idwg-l@hmc.edu>
In-Reply-To: <3FFE57D7.6050006@francetelecom.com>
References: <Pine.BSF.4.21.0401081434190.1526-100000@lhotse.zaraska.dhs.org>
	 <1073603926.18504.27.camel@arwen>  <3FFE57D7.6050006@francetelecom.com>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-lC7q72VLLNyX28SFKf3C"
Message-Id: <1073641339.18768.28.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5
Date: Fri, 09 Jan 2004 09:42:19 +0000


--=-lC7q72VLLNyX28SFKf3C
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Fri, 2004-01-09 at 07:27, Herve Debar wrote:
> Yoann Vandoorselaere wrote:
> > On Thu, 2004-01-08 at 13:34, Krzysztof Zaraska wrote:
> >>Subject: [IDMEF][Issue 9] Alert routing
> >>
> >>Tthe draft should be more explicit on hte hierarchy between manager=20
> >>and analyzer
> >>
> >>Situation 1 (serial/transfer)
> >>-----------
> >>Imagine 3 boxes, A=3Danalyzer, B=3Dmanager/analyzer, C=3Dmanager, conne=
cted
> >>thus:
> >>
> >>Analyzer-A -> (Manager-B / Analyzer-B) -> Manager-C
> >>
> >>You should ([even must ?] not have alerts on C whose analyzerid is
> >>Analyzer-A.
> >=20
> >=20
> > Herve, if I recall well about our old discussion, analyzerID can be
> > anything as long as it is unique across the whole IDS environment.=20
>=20
> Right.
>=20
> > I previously tried to express the need to be able to give a "name" to a=
n
> > analyzer, and that the analyzerID field might not be the best place for
> > doing so as there might be real concern on checking whether a name is
> > unique to the whole IDS environment, and that practicaly combining
> > "analyzerID" + "manager analizerID", for uniqueness might not be doable
> > in a given implementation.
>=20
> I will create an issue for adding a textual name to an analyzer=20
> representation.
>=20
> > So, following your schema here, analyzerID will be lost once the
> > analyzer A alert come through the Manager B to Manager C. So how does a=
n
> > user looking at an alert coming from analyzer A on Manager C refer to
> > the analyzer ?
>=20
> I have been looking at this for a long time. I have the same=20
> operational problem because people have the same alert in multiple=20
> databases, and I have come to the conclusion that:
>=20
> 1) either B adds value to the alert (correlation, ...) and then it's a=20
> new alert with analyzerid=3DB and alertid=3D...

This sound ok to me, as long as the name field, discussed above, is not
modified.

> 		OR
> 2) B doesn't add value to the alert, and then the situation is=20
> equivalent to having A send the alert to B and C. As such, B is some=20
> sort of network router pushing alerts instead of packets, but it does=20
> not modify them.

sound ok also.

> > Recording the path of an alert is something I started implementing
> > sometime ago in Prelude... My intent is simply to insert the interface
> > the alert was received on, and the interface the alert is going to be
> > sent to if any. I used additional data for doing this, but having
> > defined field withing IDMEF for that might be a better idea.
>=20
> Could you please phrase a proposal for altering the draft ?

Roughly :=20
- add a list of the following AlertPath object within the Message class.

+---------------------+
|      AlertPath      |
+---------------------+
| STRING name         |       0..1 +----------+
| STRING hop          |<>----------|InAddress |
|                     |            +----------+
|                     |       0..1 +----------+
|                     |<>----------|OutAddress|
|                     |            +----------+
+---------------------+

Or something like it.

- name could contain the name of the Analyzer/Manager this alert passed
through.

- hop is the hop number for this path element...

- InAddress, of the Addresss class is address where the alert was
received, if any.

- OutAddress, of the Addresss class is address where the alert is sent
to, if any.

BTW, it might be better to change InAddress, and OutAddress to Node...

--=20
Yoann Vandoorselaere <yoann@prelude-ids.org>

--=-lC7q72VLLNyX28SFKf3C
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQA//nd74tfUv0C+vv8RAkcdAJ9C3hxWXI0ro96F2+cQL7whIdGVfwCfVxEj
cniDixkz5N6G102mCRGK5Mg=
=VWra
-----END PGP SIGNATURE-----

--=-lC7q72VLLNyX28SFKf3C--

--=-TnmZCske0zo7M26xwQr/--

--=-JPmbPHcRpYi+7QZk9rQk
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBACIiF4tfUv0C+vv8RAv6AAKCczevfXcvyDZg98Dq9z1AQwZGTpQCgykmF
oeCm+7rO79gdsocYK5FO69s=
=dgST
-----END PGP SIGNATURE-----

--=-JPmbPHcRpYi+7QZk9rQk--



From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan 16 20:50:10 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09486
	for <idwg-archive@lists.ietf.org>; Fri, 16 Jan 2004 20:50:09 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H117fd013389
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 16 Jan 2004 17:05:07 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0H117A3013388
	for idwg-l-outgoing; Fri, 16 Jan 2004 17:01:07 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail.prelude-ids.org ([195.69.197.65])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H114fd013368
	for <idwg-l@hmc.edu>; Fri, 16 Jan 2004 17:01:05 -0800
Received: from 192.168.1.101 (i-195-137-71-87.freedom2surf.net [195.137.71.87])
	by mail.prelude-ids.org (Postfix) with ESMTP id 6682BA4CB
	for <idwg-l@hmc.edu>; Sat, 17 Jan 2004 01:54:57 +0100 (CET)
Subject: [Fwd: Re: [prelude-devel] [IDMEF][Issue 9] Alert routing (fwd)]
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: IDWG <idwg-l@hmc.edu>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-fEsZ0AeZ3YwKntkBS+sS"
Message-Id: <1074301019.8170.14.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5 
Date: Sat, 17 Jan 2004 00:56:59 +0000
X-Spam-Status: No, hits=-5.2 required=8.0
	tests=FWD_MSG,PGP_SIGNATURE_2,USER_AGENT_XIMIAN
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


--=-fEsZ0AeZ3YwKntkBS+sS
Content-Type: multipart/mixed; boundary="=-d073gs/+6/XkXtt+Xpdn"


--=-d073gs/+6/XkXtt+Xpdn
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

didn't made it... re-sending...

--=20
Yoann Vandoorselaere, http://www.prelude-ids.org

"Programming is a race between programmers, who try and make more and=20
 more idiot-proof software, and universe, which produces more and more=20
 remarkable idiots. Until now, universe leads the race"  -- R. Cook


--=-d073gs/+6/XkXtt+Xpdn
Content-Disposition: inline
Content-Description: Forwarded message - Re: [prelude-devel] [IDMEF][Issue
	9] Alert routing (fwd)
Content-Type: message/rfc822

Subject: Re: [prelude-devel] [IDMEF][Issue 9] Alert routing (fwd)
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
Cc: prelude-devel@prelude-ids.org, Herve Debar <herve.debar@francetelecom.com>, intrusion detection wg <idwg-l@hmc.edu>
In-Reply-To: <Pine.BSF.4.21.0401081434190.1526-100000@lhotse.zaraska.dhs.org>
References: <Pine.BSF.4.21.0401081434190.1526-100000@lhotse.zaraska.dhs.org>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-yKuK6d8tiCCnkIFFr4KS"
Message-Id: <1073603926.18504.27.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5
Date: Thu, 08 Jan 2004 23:18:46 +0000


--=-yKuK6d8tiCCnkIFFr4KS
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Thu, 2004-01-08 at 13:34, Krzysztof Zaraska wrote:
> Now, what about that one?=20

[...]
Note: please CC me as I'm not on the idwd list.

> Subject: [IDMEF][Issue 9] Alert routing
>=20
> Tthe draft should be more explicit on hte hierarchy between manager=20
> and analyzer
>=20
> Situation 1 (serial/transfer)
> -----------
> Imagine 3 boxes, A=3Danalyzer, B=3Dmanager/analyzer, C=3Dmanager, connect=
ed
> thus:
>=20
> Analyzer-A -> (Manager-B / Analyzer-B) -> Manager-C
>=20
> You should ([even must ?] not have alerts on C whose analyzerid is
> Analyzer-A.

Herve, if I recall well about our old discussion, analyzerID can be
anything as long as it is unique across the whole IDS environment.=20

I previously tried to express the need to be able to give a "name" to an
analyzer, and that the analyzerID field might not be the best place for
doing so as there might be real concern on checking whether a name is
unique to the whole IDS environment, and that practicaly combining
"analyzerID" + "manager analizerID", for uniqueness might not be doable
in a given implementation.

So, following your schema here, analyzerID will be lost once the
analyzer A alert come through the Manager B to Manager C. So how does an
user looking at an alert coming from analyzer A on Manager C refer to
the analyzer ?


> Situation 2 (parallelism/duplication)
> -----------
>=20
> Imagine 3 boxes, A=3Danalyzer, B=3Dmanager, C=3Dmanager, connected thus:
>=20
>               /---> Manager-B
> Analyzer-A -<
>               \---> Manager-C
>=20
> The same alert on Manager-B and Manager C should [must ?] have the=20
> same analyzerid+alertid.
>=20
> I believe that with these two constructs we cover any arrangement that=20
> anybody may want to make.
>=20
> I'm not sure this has to go in the document, but it would probably=20
> clear some misunderstanding.
>=20
>=20
>  From Krzysztof Zaraska on Situation 1:
> I'd like to know a rationale for this. In Prelude it's a typical=20
> situation that C sees alerts generated by A. And it's therefore very=20
> useful to know where the alert actually originated. We were also=20
> proposing is a "path record" inside the alert, specifying the managers=20
> the alert has travelled through.

Recording the path of an alert is something I started implementing
sometime ago in Prelude... My intent is simply to insert the interface
the alert was received on, and the interface the alert is going to be
sent to if any. I used additional data for doing this, but having
defined field withing IDMEF for that might be a better idea.

--=20
Yoann Vandoorselaere <yoann@prelude-ids.org>

--=-yKuK6d8tiCCnkIFFr4KS
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQA//eVW4tfUv0C+vv8RAjiwAJoDxFF1sV9GxD7jCvDy9Cn6zAZjoQCgwVlN
D1nP7V9v+5x1jUWE9HIelvk=
=rRFV
-----END PGP SIGNATURE-----

--=-yKuK6d8tiCCnkIFFr4KS--

--=-d073gs/+6/XkXtt+Xpdn--

--=-fEsZ0AeZ3YwKntkBS+sS
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBACIhb4tfUv0C+vv8RAqO4AJ9kozQ0Z/aPT7LJCm9O8sPdHwZH0gCeIOxL
Os1RRTcdTkJ1EPpZ4GGv6gU=
=q3RR
-----END PGP SIGNATURE-----

--=-fEsZ0AeZ3YwKntkBS+sS--



From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan 16 20:51:49 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09520
	for <idwg-archive@lists.ietf.org>; Fri, 16 Jan 2004 20:51:49 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H127fd013602
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 16 Jan 2004 17:06:07 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0H127Fm013601
	for idwg-l-outgoing; Fri, 16 Jan 2004 17:02:07 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail.prelude-ids.org ([195.69.197.65])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H123fd013529
	for <idwg-l@hmc.edu>; Fri, 16 Jan 2004 17:02:03 -0800
Received: from 192.168.1.101 (i-195-137-71-87.freedom2surf.net [195.137.71.87])
	by mail.prelude-ids.org (Postfix) with ESMTP id DF7D6A4CB
	for <idwg-l@hmc.edu>; Sat, 17 Jan 2004 01:55:56 +0100 (CET)
Subject: [Fwd: Re: [prelude-devel] [IDMEF][Issue 10] Severity scale too
	narrow (fwd)]
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: IDWG <idwg-l@hmc.edu>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-RK8p+xMcrzPnW/rwChFN"
Message-Id: <1074301079.8169.18.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5 
Date: Sat, 17 Jan 2004 00:57:59 +0000
X-Spam-Status: No, hits=-5.2 required=8.0
	tests=FWD_MSG,PGP_SIGNATURE_2,USER_AGENT_XIMIAN
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


--=-RK8p+xMcrzPnW/rwChFN
Content-Type: multipart/mixed; boundary="=-gSByy+Agvm5MjfmeNlem"


--=-gSByy+Agvm5MjfmeNlem
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable


--=20
Yoann Vandoorselaere, http://www.prelude-ids.org

"Programming is a race between programmers, who try and make more and=20
 more idiot-proof software, and universe, which produces more and more=20
 remarkable idiots. Until now, universe leads the race"  -- R. Cook


--=-gSByy+Agvm5MjfmeNlem
Content-Disposition: inline
Content-Description: Forwarded message - Re: [prelude-devel] [IDMEF][Issue
	10] Severity scale too narrow (fwd)
Content-Type: message/rfc822

Subject: Re: [prelude-devel] [IDMEF][Issue 10] Severity scale too narrow
	(fwd)
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
Cc: prelude-devel@prelude-ids.org, Herve Debar <herve.debar@francetelecom.com>, intrusion detection wg <idwg-l@hmc.edu>,  JHORVAT1@steelcase.com
In-Reply-To: <Pine.BSF.4.21.0401091152190.443-100000@lhotse.zaraska.dhs.org>
References: <Pine.BSF.4.21.0401091152190.443-100000@lhotse.zaraska.dhs.org>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-gGP7l89c6ajJ69frWlJg"
Message-Id: <1073653569.18768.42.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5
Date: Fri, 09 Jan 2004 13:06:09 +0000


--=-gGP7l89c6ajJ69frWlJg
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Fri, 2004-01-09 at 10:52, Krzysztof Zaraska wrote:

> ---------- Forwarded message ----------
> Date: Fri, 09 Jan 2004 10:07:31 +0100
> From: Herve Debar <herve.debar@francetelecom.com>
> To: intrusion detection wg <idwg-l@hmc.edu>
> Subject: [IDMEF][Issue 10] Severity scale too narrow
>=20
>  From Krzysztof Zaraska:
> severity scale (3 grades only) is too narrow; for example, there is an
> idea floating around of expressing the danger associated with the=20
> attack as exp(severity*vulnerabity_level), but you can't go far this=20
> way with 3 level severity scale only.
>=20
>=20
> Herv=E9: we use 5 internally. It seems to be standard practice within=20
> the telco industry:
> 1) =3D critical
> 2) =3D warning
> 3) =3D minor
> 4) =3D normal
> 5) =3D unclassified/unclassifiable
> This wouldn't solve your graduation issue, but it actually is enough=20
> for an operator. We also use another scale which has 3 levels,(solved=20
> within 1/2 hour), (solved within 1/2 day), (solved within 1 day), but=20
> that's maybe too operations-oriented.
>=20
> IIRC, it is about the same with the Tivoli framework. I think there is=20
> a 0) =3D FATAL (i.e. system stops) in addition.
>=20
>=20
>=20
>=20
> Possibilities:
> - keep 3.
> - move to five (and get appropriate definitions)
> - something else
>=20
> Please voice your opinion.

IMO 3 is for sure too short. The addition of "normal" and
"unclassified/unclassifiable" would help by allowing us to send
informational events.=20

Thought it still feel kinda limitative to me...

--=20
Yoann Vandoorselaere <yoann@prelude-ids.org>

--=-gGP7l89c6ajJ69frWlJg
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQA//qdB4tfUv0C+vv8RAmU9AJ4tfa3sxQYAtznArc5LQ9rxfe/1LgCeOYa7
q6fjimMx4yRa2a8OEWNkpNY=
=zO1Q
-----END PGP SIGNATURE-----

--=-gGP7l89c6ajJ69frWlJg--

--=-gSByy+Agvm5MjfmeNlem--

--=-RK8p+xMcrzPnW/rwChFN
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBACIiX4tfUv0C+vv8RAgQHAJ9giK2PWt0tuvuYIBCqyxrug117zACfX7Pm
I4zIu8fNysFs+gx+0ewOKR8=
=Hy+u
-----END PGP SIGNATURE-----

--=-RK8p+xMcrzPnW/rwChFN--



From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan 16 20:51:55 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09539
	for <idwg-archive@lists.ietf.org>; Fri, 16 Jan 2004 20:51:55 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H148fd014236
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 16 Jan 2004 17:06:18 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0H1481R014235
	for idwg-l-outgoing; Fri, 16 Jan 2004 17:04:08 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail.prelude-ids.org ([195.69.197.65])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H145fd014207
	for <idwg-l@hmc.edu>; Fri, 16 Jan 2004 17:04:06 -0800
Received: from 192.168.1.101 (i-195-137-71-87.freedom2surf.net [195.137.71.87])
	by mail.prelude-ids.org (Postfix) with ESMTP id 2048AA4CB
	for <idwg-l@hmc.edu>; Sat, 17 Jan 2004 01:57:59 +0100 (CET)
Subject: [Fwd: Re: [prelude-devel] [IDMEF][Issue 1] Duplicate name in
	classifications (fwd)]
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: IDWG <idwg-l@hmc.edu>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-mYgDNkrX7OeGRRZZVEg4"
Message-Id: <1074301201.7451.0.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5 
Date: Sat, 17 Jan 2004 01:00:01 +0000
X-Spam-Status: No, hits=-5.6 required=8.0
	tests=FWD_MSG,PGP_SIGNATURE_2,USER_AGENT_XIMIAN,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


--=-mYgDNkrX7OeGRRZZVEg4
Content-Type: multipart/mixed; boundary="=-o1pHGPe9B1xTuuq56Ez4"


--=-o1pHGPe9B1xTuuq56Ez4
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable


--=20
Yoann Vandoorselaere, http://www.prelude-ids.org

"Programming is a race between programmers, who try and make more and=20
 more idiot-proof software, and universe, which produces more and more=20
 remarkable idiots. Until now, universe leads the race"  -- R. Cook


--=-o1pHGPe9B1xTuuq56Ez4
Content-Disposition: inline
Content-Description: Forwarded message - Re: [prelude-devel] [IDMEF][Issue
	1] Duplicate name in classifications (fwd)
Content-Type: message/rfc822

Subject: Re: [prelude-devel] [IDMEF][Issue 1] Duplicate name in
	classifications (fwd)
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
Cc: prelude-devel@prelude-ids.org, Herve Debar <herve.debar@francetelecom.com>, intrusion detection wg <idwg-l@hmc.edu>
In-Reply-To: <1073602540.18504.8.camel@arwen>
References: <Pine.BSF.4.21.0401081250310.1319-100000@lhotse.zaraska.dhs.org>
	 <1073602540.18504.8.camel@arwen>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-zyCIbpLIzcl207dYejdG"
Message-Id: <1073676175.18768.71.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5
Date: Fri, 09 Jan 2004 19:22:55 +0000


--=-zyCIbpLIzcl207dYejdG
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Thu, 2004-01-08 at 22:55, Yoann Vandoorselaere wrote:
>=20
> Today most IDS aggregate several possible type alert behind a single
> description, as you can see Snort's doing here...=20
>=20
> CVE references CAN-1999-0517 and CAN-2002-0013 are quite different, but
> aggregated under the same "SNMP public access udp" name.
>=20
> Now you might argues that this should be splited up into 2 differents
> Snort rules, but it might not always be possible.

BTW, url and origin attribute are required.=20

Now, what's the expected policy when a sensor, say a honeypot, generate
an alert triggered by some unexpected traffic but can't categorize it ?

IMO, in this case, the honeypot should only have to fill the
classification name field...

--=20
Yoann Vandoorselaere <yoann@prelude-ids.org>

--=-zyCIbpLIzcl207dYejdG
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQA//v+P4tfUv0C+vv8RAmrlAKDILAdGFOrYSVNQiDiecpVhY+xK8gCgl7C8
qSgD+wx8z72y82O6H4omJ/w=
=JdIU
-----END PGP SIGNATURE-----

--=-zyCIbpLIzcl207dYejdG--

--=-o1pHGPe9B1xTuuq56Ez4--

--=-mYgDNkrX7OeGRRZZVEg4
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBACIkR4tfUv0C+vv8RAqDTAKDKQr77KxEZQM2eTD8fqusYWAMAMACgn6A8
JWpTddIOilZGYKSZWy1tzSo=
=XSsJ
-----END PGP SIGNATURE-----

--=-mYgDNkrX7OeGRRZZVEg4--



From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan 16 21:03:01 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09722
	for <idwg-archive@lists.ietf.org>; Fri, 16 Jan 2004 21:03:00 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H1MEfd017742
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 16 Jan 2004 17:24:19 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0H1ME1N017736
	for idwg-l-outgoing; Fri, 16 Jan 2004 17:22:14 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail.prelude-ids.org ([195.69.197.65])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H1M9fd017684
	for <idwg-l@hmc.edu>; Fri, 16 Jan 2004 17:22:10 -0800
Received: from 192.168.1.101 (i-195-137-71-87.freedom2surf.net [195.137.71.87])
	by mail.prelude-ids.org (Postfix) with ESMTP
	id 72A4A419; Sat, 17 Jan 2004 02:15:58 +0100 (CET)
Subject: Re: [prelude-devel] [IDMEF][Issue 10] Severity scale too narrow
	(fwd)
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
Cc: prelude-devel@prelude-ids.org, Herve Debar <herve.debar@francetelecom.com>,
        IDWG <idwg-l@hmc.edu>, JHORVAT1@steelcase.com
In-Reply-To: <1073653569.18768.42.camel@arwen>
References: <Pine.BSF.4.21.0401091152190.443-100000@lhotse.zaraska.dhs.org>
	 <1073653569.18768.42.camel@arwen>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-OWzydaDcq7MG2A8drFu/"
Message-Id: <1074302276.7447.17.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5 
Date: Sat, 17 Jan 2004 01:17:56 +0000
X-Spam-Status: No, hits=-7.6 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,MIME_LONG_LINE_QP,
	      PGP_SIGNATURE_2,QUOTED_EMAIL_TEXT,REFERENCES,
	      REPLY_WITH_QUOTES,USER_AGENT_XIMIAN,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


--=-OWzydaDcq7MG2A8drFu/
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Fri, 2004-01-09 at 13:06, Yoann Vandoorselaere wrote:
> On Fri, 2004-01-09 at 10:52, Krzysztof Zaraska wrote:
> >  From Krzysztof Zaraska:

> > severity scale (3 grades only) is too narrow; for example, there is an
> > idea floating around of expressing the danger associated with the=20
> > attack as exp(severity*vulnerabity_level), but you can't go far this=20
> > way with 3 level severity scale only.
> >=20
> >=20
> > Herv=E9: we use 5 internally. It seems to be standard practice within=20
> > the telco industry:
> > 1) =3D critical
> > 2) =3D warning
> > 3) =3D minor
> > 4) =3D normal
> > 5) =3D unclassified/unclassifiable
> > This wouldn't solve your graduation issue, but it actually is enough=20
> > for an operator. We also use another scale which has 3 levels,(solved=20
> > within 1/2 hour), (solved within 1/2 day), (solved within 1 day), but=20
> > that's maybe too operations-oriented.
> >=20
> > IIRC, it is about the same with the Tivoli framework. I think there is=20
> > a 0) =3D FATAL (i.e. system stops) in addition.

[...]

> > Possibilities:
> > - keep 3.
> > - move to five (and get appropriate definitions)
> > - something else
> >=20
> > Please voice your opinion.
>=20
> IMO 3 is for sure too short. The addition of "normal" and
> "unclassified/unclassifiable" would help by allowing us to send
> informational events.=20
>=20
> Thought it still feel kinda limitative to me...

Replying to myself after some thinking:=20

IMO 5 severity is still not enough for describing different _kind_ of
events with different _significant_ levels...  My proposition is for the
Impact class to carry a "category" attribute together with the existing
"severity" attribute.

As it was already stated here, it is useful for an IDS to issue
_informational_ report about events going on the system. Theses report
might be used later for correlation purpose. But even for here, you need
to qualify how significant was an informational message.

So here is the proposal :

[category]
1) alert
2) informational

[severity]
1) normal
2) warning
3) critical
3) unknown

Please comment,

--=20
Yoann Vandoorselaere, http://www.prelude-ids.org

"Programming is a race between programmers, who try and make more and=20
 more idiot-proof software, and universe, which produces more and more=20
 remarkable idiots. Until now, universe leads the race"  -- R. Cook


--=-OWzydaDcq7MG2A8drFu/
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBACI1E4tfUv0C+vv8RAozYAKCWcLtez+cLb+bDfbjDSEeVyUNDRACeNYou
cesZwsKyDyg/o63WIyF4WVo=
=WWd1
-----END PGP SIGNATURE-----

--=-OWzydaDcq7MG2A8drFu/--



From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan 16 22:03:36 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA10861
	for <idwg-archive@lists.ietf.org>; Fri, 16 Jan 2004 22:03:36 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H2C9fd027723
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 16 Jan 2004 18:14:25 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0H2C9fx027721
	for idwg-l-outgoing; Fri, 16 Jan 2004 18:12:09 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail.prelude-ids.org ([195.69.197.65])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0H2C6fd027674
	for <idwg-l@hmc.edu>; Fri, 16 Jan 2004 18:12:07 -0800
Received: from 192.168.1.101 (i-195-137-71-87.freedom2surf.net [195.137.71.87])
	by mail.prelude-ids.org (Postfix) with ESMTP
	id C8FFA621; Sat, 17 Jan 2004 03:05:59 +0100 (CET)
Subject: Re: [prelude-devel] [IDMEF][Issue 10] Severity scale too narrow
	(fwd)
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
Cc: prelude-devel@prelude-ids.org, Herve Debar <herve.debar@francetelecom.com>,
        IDWG <idwg-l@hmc.edu>, JHORVAT1@steelcase.com
In-Reply-To: <1074302276.7447.17.camel@arwen>
References: <Pine.BSF.4.21.0401091152190.443-100000@lhotse.zaraska.dhs.org>
	 <1073653569.18768.42.camel@arwen>  <1074302276.7447.17.camel@arwen>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-bBWsY/JADpRzOGSPVpDW"
Message-Id: <1074305283.7451.21.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5 
Date: Sat, 17 Jan 2004 02:08:03 +0000
X-Spam-Status: No, hits=-7.3 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,PGP_SIGNATURE_2,REFERENCES,
	      REPLY_WITH_QUOTES,USER_AGENT_XIMIAN,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


--=-bBWsY/JADpRzOGSPVpDW
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Sat, 2004-01-17 at 01:17, Yoann Vandoorselaere wrote:
> On Fri, 2004-01-09 at 13:06, Yoann Vandoorselaere wrote:
> > On Fri, 2004-01-09 at 10:52, Krzysztof Zaraska wrote:
> > >  From Krzysztof Zaraska:

[...]

> [severity]
> 1) normal
> 2) warning
> 3) critical
> 3) unknown

forgot "minor" too...

--=20
Yoann Vandoorselaere, http://www.prelude-ids.org

"Programming is a race between programmers, who try and make more and=20
 more idiot-proof software, and universe, which produces more and more=20
 remarkable idiots. Until now, universe leads the race"  -- R. Cook


--=-bBWsY/JADpRzOGSPVpDW
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBACJkC4tfUv0C+vv8RAtITAKCJe+FN4RJ9yi9WgWsmN4o0StzdLQCfc9j8
51Z3/YXIrdLWpjqkdfNtN7E=
=+Pn4
-----END PGP SIGNATURE-----

--=-bBWsY/JADpRzOGSPVpDW--



From idwg-l-manager@Mail.ac.hmc.edu  Tue Jan 27 09:59:02 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA07318
	for <idwg-archive@lists.ietf.org>; Tue, 27 Jan 2004 09:59:01 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0RDsifd012361
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Tue, 27 Jan 2004 05:55:46 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0RDsigM012358
	for idwg-l-outgoing; Tue, 27 Jan 2004 05:54:44 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0RDsffd012320
	for <idwg-l@hmc.edu>; Tue, 27 Jan 2004 05:54:41 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 27 Jan 2004 14:54:34 +0100
Received: from francetelecom.com ([10.193.199.230]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 27 Jan 2004 14:54:33 +0100
Message-ID: <40166D99.2000700@francetelecom.com>
Date: Tue, 27 Jan 2004 14:54:33 +0100
From: Herve Debar <herve.debar@francetelecom.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: "Matthew F. Caldwell" <mattc@guarded.net>
CC: Greg Shipley <gshipley@neohapsis.com>, "David A. Curry" <davy@cynicus.net>,
        intrusion detection wg <idwg-l@hmc.edu>
Subject: Re: [IDMEF][Issue 10] Severity scale too narrow
References: <4A285282AF0C874DAF2769E57179BC4E015E9A09@nova.guarded.net>
In-Reply-To: <4A285282AF0C874DAF2769E57179BC4E015E9A09@nova.guarded.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 27 Jan 2004 13:54:33.0622 (UTC) FILETIME=[17E3DB60:01C3E4DD]
X-Spam-Status: No, hits=-3.0 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,
	      REPLY_WITH_QUOTES,USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,
	      X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0RDsifd012355
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit

 > On Sun, 11 Jan 2004, David A. Curry wrote:
 >
 >
 >>I am way skeptical of any scheme that purports to assign numerical
 >>values to this type of data and claim that they are "accurate" in any
 >>meaningful way.
 >>
 >>As I recall, the group was similarly skeptical when the idea was
 >>proposed in the past (and it was proposed more than once).

I think in similar terms. I'd like to propose an enumerated, textual 
list, and let people assign whatever internal numerical values they 
want. Maybe this "numerical" value could be provided for as an option, 
but the enumerated string would be mandatory.


Greg Shipley wrote:
 > If it's a done deal, it's a done deal, and please view my ramblings as
 > nothing more than comments from the peanut gallery.  (and please 
excuse me
 > and my monkey wrench!) I just know from EXPERIENCE that simple
 > classification metrics (e.g. 5 ratings) are not going to cut it in many
 > real world scenarios.  For example, when we were doing our SIM testing
 > last year in conjunction with Syracuse University we had days when we hit
 > 2600 events PER SECOND from our IDS/FW sensors.  Without some ability to
 > classify/rank those events more granularly you can forget about ever
 > really sifting through the data, much less acting on it.

First of all, it's an open discussion, so any input is valid.

In fact, I have a completely opposite feeling apout integer values. What 
I want in an alert is
1) do I have to do something about it
	and if 1)==TRUE
2) how much time do I have to comply with my business objectives.

Using integer values is akin to setting a threshold, and this depends on 
organizations. That's why I like the enumerated list, and people then 
set their own sensitivity to it.

Matthew F. Caldwell wrote:
> 	I agree using an integer to describe the level of severity is a
> necessity. Our SIM/SEM solution already reassign the priority into
> numeric form in the aggreagation phase. It could be made better for
> everyone if assignment was already in the logging format. For example:
> HIGH = 255 , MEDIUM = 128 LOW = 64. It is faster and more efficient to
> use an integer format in correlation primarily because string
> comparisons are costly CPU wise. When you compute/correlate/classify
> 3000/eps any CPU cycles you can spare increases the effectiveness of the
> SIM/SEM solution and or analysts running queries on databases.  

I remember the old CSIDS sensor doing that. We just never got around to 
using something else than the 1-5 scale. As much as I understand how 
this is important for the reasoning of your engine, I'm not sure that 
this is information that will be transported as is by IDMEF messages.

I'm still mulling this one around, and am not up for a definite proposal.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4



From idwg-l-manager@Mail.ac.hmc.edu  Tue Jan 27 10:05:56 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA07906
	for <idwg-archive@lists.ietf.org>; Tue, 27 Jan 2004 10:05:55 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0RDhXfd009110
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Tue, 27 Jan 2004 05:47:33 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0RDhXJV009109
	for idwg-l-outgoing; Tue, 27 Jan 2004 05:43:33 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from p-mail2.rd.francetelecom.com (p-mail2.rd.francetelecom.com [195.101.245.16])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0RDhTfd009074
	for <idwg-l@hmc.edu>; Tue, 27 Jan 2004 05:43:30 -0800
Received: from parmhs4.rd.francetelecom.fr ([10.193.117.63]) by parsmtp2.rd.francetelecom.com with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 27 Jan 2004 14:43:16 +0100
Received: from francetelecom.com ([10.193.199.230]) by parmhs4.rd.francetelecom.fr with Microsoft SMTPSVC(5.0.2195.6747);
	 Tue, 27 Jan 2004 14:43:14 +0100
Message-ID: <40166AF2.9050703@francetelecom.com>
Date: Tue, 27 Jan 2004 14:43:14 +0100
From: Herve Debar <herve.debar@francetelecom.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Yoann Vandoorselaere <yoann@prelude-ids.org>
CC: IDWG <idwg-l@hmc.edu>
Subject: Re: [Fwd: Re: [prelude-devel] [IDMEF][Issue 1] Duplicate name inclassifications
 (fwd)]
References: <1074301201.7451.0.camel@arwen>
In-Reply-To: <1074301201.7451.0.camel@arwen>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-OriginalArrivalTime: 27 Jan 2004 13:43:14.0765 (UTC) FILETIME=[83427FD0:01C3E4DB]
X-Spam-Status: No, hits=-2.9 required=8.0
	tests=EMAIL_ATTRIBUTION,FWD_MSG,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      REFERENCES,REPLY_WITH_QUOTES,USER_AGENT_MOZILLA_UA,
	      X_ACCEPT_LANG
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail2.ac.hmc.edu id i0RDhXfd009107
Sender: owner-idwg-l@hmc.edu
Precedence: bulk
Content-Transfer-Encoding: 8bit



Yoann Vandoorselaere wrote:
>>Today most IDS aggregate several possible type alert behind a single
>>description, as you can see Snort's doing here... 
>>
>>CVE references CAN-1999-0517 and CAN-2002-0013 are quite different, but
>>aggregated under the same "SNMP public access udp" name.
>>
>>Now you might argues that this should be splited up into 2 differents
>>Snort rules, but it might not always be possible.
> 
> 
> BTW, url and origin attribute are required. 
> 
> Now, what's the expected policy when a sensor, say a honeypot, generate
> an alert triggered by some unexpected traffic but can't categorize it ?
> 
> IMO, in this case, the honeypot should only have to fill the
> classification name field...

Would the proposed solution (see issue 8 discussion) satisfy you. I 
think it is closer to this.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4



From idwg-l-manager@Mail.ac.hmc.edu  Tue Jan 27 14:28:50 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA19128
	for <idwg-archive@lists.ietf.org>; Tue, 27 Jan 2004 14:28:39 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0RHupfd014263
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Tue, 27 Jan 2004 09:58:12 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0RHupqG014261
	for idwg-l-outgoing; Tue, 27 Jan 2004 09:56:51 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from mail.prelude-ids.org ([195.69.197.65])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0RHukfd014142
	for <idwg-l@hmc.edu>; Tue, 27 Jan 2004 09:56:47 -0800
Received: from 192.168.1.101 (i-195-137-71-87.freedom2surf.net [195.137.71.87])
	by mail.prelude-ids.org (Postfix) with ESMTP
	id B67562A12F; Tue, 27 Jan 2004 18:49:25 +0100 (CET)
Subject: Re: [IDMEF][Issue 10] Severity scale too narrow
From: Yoann Vandoorselaere <yoann@prelude-ids.org>
To: Herve Debar <herve.debar@francetelecom.com>
Cc: "Matthew F. Caldwell" <mattc@guarded.net>,
        Greg Shipley <gshipley@neohapsis.com>,
        "David A. Curry" <davy@cynicus.net>,
        intrusion detection wg <idwg-l@hmc.edu>
In-Reply-To: <40166D99.2000700@francetelecom.com>
References: <4A285282AF0C874DAF2769E57179BC4E015E9A09@nova.guarded.net>
	 <40166D99.2000700@francetelecom.com>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-/+RPwSFCcraUSTRlQNpW"
Message-Id: <1075225925.8516.6.camel@arwen>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5 
Date: Tue, 27 Jan 2004 17:52:05 +0000
X-Spam-Status: No, hits=-7.8 required=8.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,PGP_SIGNATURE_2,
	      QUOTED_EMAIL_TEXT,REFERENCES,REPLY_WITH_QUOTES,
	      USER_AGENT_XIMIAN,X_AUTH_WARNING
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


--=-/+RPwSFCcraUSTRlQNpW
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Tue, 2004-01-27 at 13:54, Herve Debar wrote:
>  > On Sun, 11 Jan 2004, David A. Curry wrote:
>  >
>  >
>  >>I am way skeptical of any scheme that purports to assign numerical
>  >>values to this type of data and claim that they are "accurate" in any
>  >>meaningful way.
>  >>
>  >>As I recall, the group was similarly skeptical when the idea was
>  >>proposed in the past (and it was proposed more than once).
>=20
> I think in similar terms. I'd like to propose an enumerated, textual=20
> list, and let people assign whatever internal numerical values they=20
> want. Maybe this "numerical" value could be provided for as an option,=20
> but the enumerated string would be mandatory.

Wouldn't numerical value be a problem for interoperability between
products ?

--=20
Yoann Vandoorselaere, http://www.prelude-ids.org

"Programming is a race between programmers, who try and make more and=20
 more idiot-proof software, and universe, which produces more and more=20
 remarkable idiots. Until now, universe leads the race"  -- R. Cook


--=-/+RPwSFCcraUSTRlQNpW
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBAFqVF4tfUv0C+vv8RAj4gAJ0aS1FW4t2MeVLog9tw+O2kgnu2uACdHj37
+f5hNk4NymxpHbOoG4fhPH4=
=Vkir
-----END PGP SIGNATURE-----

--=-/+RPwSFCcraUSTRlQNpW--



From idwg-l-manager@Mail.ac.hmc.edu  Fri Jan 30 17:10:18 2004
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA21125
	for <idwg-archive@lists.ietf.org>; Fri, 30 Jan 2004 17:10:17 -0500 (EST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0UL9rZO012324
	for <idwg-l-outgoing@mail2.ac.hmc.edu>; Fri, 30 Jan 2004 13:13:53 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0UL9rNs012320
	for idwg-l-outgoing; Fri, 30 Jan 2004 13:09:53 -0800
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
Received: from turing.cs.hmc.edu (turing.cs.hmc.edu [134.173.42.99])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0UL9bZO012168
	for <idwg-l@hmc.edu>; Fri, 30 Jan 2004 13:09:38 -0800
Received: by turing.cs.hmc.edu (Postfix, from userid 13403)
	id D4583532A8; Fri, 30 Jan 2004 13:09:32 -0800 (PST)
Date: Fri, 30 Jan 2004 13:09:32 -0800
From: Mike Erlinger <mike@cs.hmc.edu>
To: intrusion detection wg <idwg-l@hmc.edu>
Subject: [owner-idwg-l@hmc.edu: BOUNCE idwg-l@mail2.ac.hmc.edu:    Non-member submission from ["McMahon, Joseph" <jmcmahon@redsiren.com>]]
Message-ID: <20040130210932.GA19856@cs.hmc.edu>
Reply-To: mike@cs.hmc.edu
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="pWyiEgJYm5f9v55/"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
User-Agent: Mutt/1.4i
X-Spam-Status: No, hits=-3.5 required=8.0
	tests=EMAIL_ATTRIBUTION,QUOTED_EMAIL_TEXT,USER_AGENT_MUTT
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Sender: owner-idwg-l@hmc.edu
Precedence: bulk


--pWyiEgJYm5f9v55/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline


-- 
Mike Erlinger, Professor and Chair Computer Science
www:      http://www.cs.hmc.edu/~mike
email:    mike@cs.hmc.edu
smail:    Computer Science Dept., Harvey Mudd College,
          301 E. 12th Street, Claremont, CA, 91711 
          909-621-8912,   FAX: 909-607-8364

--pWyiEgJYm5f9v55/
Content-Type: message/rfc822
Content-Disposition: inline

X-Mail-Format-Warning: Bad RFC2822 header formatting in >From mike  Tue Jan 27 08:12:11 2004
Return-Path: <owner-idwg-l@Mail.ac.hmc.edu>
X-Original-To: mike@cs.hmc.edu
Delivered-To: mike@cs.hmc.edu
Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22])
	by turing.cs.hmc.edu (Postfix) with ESMTP id 3022E53AE9
	for <mike@cs.hmc.edu>; Tue, 27 Jan 2004 08:12:11 -0800 (PST)
Received: from mail2.ac.hmc.edu (localhost [127.0.0.1])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0RGC8fd029829
	for <idwg-l-approval@mail2.ac.hmc.edu>; Tue, 27 Jan 2004 08:12:08 -0800
Received: (from majordomo@localhost)
	by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i0RGC8Su029828;
	Tue, 27 Jan 2004 08:12:08 -0800
Date: Tue, 27 Jan 2004 08:12:08 -0800
From: owner-idwg-l@hmc.edu
Message-Id: <200401271612.i0RGC8Su029828@mail2.ac.hmc.edu>
X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f
To: idwg-l-approval@Mail.ac.hmc.edu
Subject: BOUNCE idwg-l@mail2.ac.hmc.edu:    Non-member submission from ["McMahon, Joseph" <jmcmahon@redsiren.com>]   
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on turing
X-Spam-Status: No, hits=0.3 required=7.5 tests=NO_REAL_NAME autolearn=no 
	version=2.61
X-Spam-Level: 
MIME-Version: 1.0

>From idwg-l-manager Tue Jan 27 08:12:07 2004
Received: from ADMINMAIL.corp.veritect ([63.110.76.62])
	by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i0RGC5fd029794
	for <idwg-l@hmc.edu>; Tue, 27 Jan 2004 08:12:05 -0800
Received: by adminmail.corp.veritect with Internet Mail Service (5.5.2653.19)
	id <DMQCV29K>; Tue, 27 Jan 2004 11:12:02 -0500
Message-ID: <BA23608423B8F947A7D3CC789B4BB4B8018252EC@adminmail.corp.veritect>
From: "McMahon, Joseph" <jmcmahon@redsiren.com>
To: "'Herve Debar'" <herve.debar@francetelecom.com>,
        "Matthew F. Caldwell"
	 <mattc@guarded.net>
Cc: Greg Shipley <gshipley@neohapsis.com>,
        "David A. Curry"
	 <davy@cynicus.net>,
        intrusion detection wg <idwg-l@hmc.edu>
Subject: RE: [IDMEF][Issue 10] Severity scale too narrow
Date: Tue, 27 Jan 2004 11:12:00 -0500
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
X-Spam-Status: No, hits=-1.5 required=8.0
	tests=EMAIL_ATTRIBUTION,ORIGINAL_MESSAGE,QUOTED_EMAIL_TEXT
	version=2.55
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)

Ugh, "textual list" for severities.  Integers work just fine - let people
use them as they wish - and it serves people and computers/software more
easily than text does.  Text is more arbitrary, prone to a wider
interpretation and harder & more expensive for computers to process.

I could see the textual "description" of the severity being an option, but
the severity should be an integer value.  In addition, if people want a
broader scale, I think a 32-bit integer provides a wide range...the core of
the problem is that no one is going to settle on a "standard" for severity.
Some will want 1 to be "high/critical/fatal/...(whatever text someone
picks...)" and some will want 2^32 to be high.  

A study was done years ago on Enterprise Mgmt software and one of the
conclusions was that the human operators (of tools like NetView, Node
Manager, CA Unicenter, etc) can only really organize/work with 3-5 levels of
classification, after that it becomes meaningless.  The old "severe, but not
really bad" and "really, really, no I really mean it, fatal", etc.


-----Original Message-----
From: Herve Debar [mailto:herve.debar@francetelecom.com]
Sent: Tuesday, January 27, 2004 8:55 AM
To: Matthew F. Caldwell
Cc: Greg Shipley; David A. Curry; intrusion detection wg
Subject: Re: [IDMEF][Issue 10] Severity scale too narrow


 > On Sun, 11 Jan 2004, David A. Curry wrote:
 >
 >
 >>I am way skeptical of any scheme that purports to assign numerical
 >>values to this type of data and claim that they are "accurate" in any
 >>meaningful way.
 >>
 >>As I recall, the group was similarly skeptical when the idea was
 >>proposed in the past (and it was proposed more than once).

I think in similar terms. I'd like to propose an enumerated, textual 
list, and let people assign whatever internal numerical values they 
want. Maybe this "numerical" value could be provided for as an option, 
but the enumerated string would be mandatory.


Greg Shipley wrote:
 > If it's a done deal, it's a done deal, and please view my ramblings as
 > nothing more than comments from the peanut gallery.  (and please 
excuse me
 > and my monkey wrench!) I just know from EXPERIENCE that simple
 > classification metrics (e.g. 5 ratings) are not going to cut it in many
 > real world scenarios.  For example, when we were doing our SIM testing
 > last year in conjunction with Syracuse University we had days when we hit
 > 2600 events PER SECOND from our IDS/FW sensors.  Without some ability to
 > classify/rank those events more granularly you can forget about ever
 > really sifting through the data, much less acting on it.

First of all, it's an open discussion, so any input is valid.

In fact, I have a completely opposite feeling apout integer values. What 
I want in an alert is
1) do I have to do something about it
	and if 1)==TRUE
2) how much time do I have to comply with my business objectives.

Using integer values is akin to setting a threshold, and this depends on 
organizations. That's why I like the enumerated list, and people then 
set their own sensitivity to it.

Matthew F. Caldwell wrote:
> 	I agree using an integer to describe the level of severity is a
> necessity. Our SIM/SEM solution already reassign the priority into
> numeric form in the aggreagation phase. It could be made better for
> everyone if assignment was already in the logging format. For example:
> HIGH = 255 , MEDIUM = 128 LOW = 64. It is faster and more efficient to
> use an integer format in correlation primarily because string
> comparisons are costly CPU wise. When you compute/correlate/classify
> 3000/eps any CPU cycles you can spare increases the effectiveness of the
> SIM/SEM solution and or analysts running queries on databases.  

I remember the old CSIDS sensor doing that. We just never got around to 
using something else than the 1-5 scale. As much as I understand how 
this is important for the reasoning of your engine, I'm not sure that 
this is information that will be transported as is by IDMEF messages.

I'm still mulling this one around, and am not up for a definite proposal.

Hervé
-- 
Hervé Debar             <mailto:herve.debar@francetelecom.com>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4

--pWyiEgJYm5f9v55/--