From idwg-l-manager@Mail.ac.hmc.edu Fri Feb 6 18:41:11 2004 Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00184 for ; Fri, 6 Feb 2004 18:41:10 -0500 (EST) Received: from mail2.ac.hmc.edu (localhost [127.0.0.1]) by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i16MoWWJ030696 for ; Fri, 6 Feb 2004 14:54:32 -0800 Received: (from majordomo@localhost) by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i16MoVHb030681 for idwg-l-outgoing; Fri, 6 Feb 2004 14:50:31 -0800 X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f Received: from turing.cs.hmc.edu (turing.cs.hmc.edu [134.173.42.99]) by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i16MoGWJ030469 for ; Fri, 6 Feb 2004 14:50:16 -0800 Received: by turing.cs.hmc.edu (Postfix, from userid 13403) id 0B14F5331D; Fri, 6 Feb 2004 14:50:10 -0800 (PST) Date: Fri, 6 Feb 2004 14:50:10 -0800 From: Mike Erlinger To: intrusion detection wg Subject: [owner-idwg-l@hmc.edu: BOUNCE idwg-l@mail2.ac.hmc.edu: Non-member submission from [Internet-Drafts@ietf.org]] Message-ID: <20040206225010.GA3681@cs.hmc.edu> Reply-To: mike@cs.hmc.edu Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="azLHFNyN32YCQGCU" Content-Disposition: inline User-Agent: Mutt/1.4i X-Spam-Status: No, hits=-2.5 required=8.0 tests=USER_AGENT_MUTT version=2.55 X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) Sender: owner-idwg-l@hmc.edu Precedence: bulk --azLHFNyN32YCQGCU Content-Type: text/plain; charset=us-ascii Content-Disposition: inline fyi -- Mike Erlinger, Professor and Chair Computer Science www: http://www.cs.hmc.edu/~mike email: mike@cs.hmc.edu smail: Computer Science Dept., Harvey Mudd College, 301 E. 12th Street, Claremont, CA, 91711 909-621-8912, FAX: 909-607-8364 --azLHFNyN32YCQGCU Content-Type: message/rfc822 Content-Disposition: inline X-Mail-Format-Warning: Bad RFC2822 header formatting in >From mike Fri Feb 6 12:44:47 2004 Return-Path: X-Original-To: mike@cs.hmc.edu Delivered-To: mike@cs.hmc.edu Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22]) by turing.cs.hmc.edu (Postfix) with ESMTP id B957753303 for ; Fri, 6 Feb 2004 12:44:47 -0800 (PST) Received: from mail2.ac.hmc.edu (localhost [127.0.0.1]) by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i16KiOWJ019240 for ; Fri, 6 Feb 2004 12:44:27 -0800 Received: (from majordomo@localhost) by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i16KiEtr019191; Fri, 6 Feb 2004 12:44:14 -0800 Date: Fri, 6 Feb 2004 12:44:14 -0800 From: owner-idwg-l@hmc.edu Message-Id: <200402062044.i16KiEtr019191@mail2.ac.hmc.edu> X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f To: idwg-l-approval@Mail.ac.hmc.edu Subject: BOUNCE idwg-l@mail2.ac.hmc.edu: Non-member submission from [Internet-Drafts@ietf.org] X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on turing X-Spam-Status: No, hits=0.3 required=7.5 tests=NO_REAL_NAME autolearn=no version=2.61 X-Spam-Level: MIME-Version: 1.0 >From idwg-l-manager Fri Feb 6 12:44:12 2004 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i16KhfWJ018967 for ; Fri, 6 Feb 2004 12:43:44 -0800 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15442; Fri, 6 Feb 2004 15:43:37 -0500 (EST) Message-Id: <200402062043.PAA15442@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: idwg-l@hmc.edu From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-idwg-idmef-xml-11.txt Date: Fri, 06 Feb 2004 15:43:36 -0500 Sender: dinaras@cnri.reston.va.us X-Spam-Status: No, hits=2.7 required=8.0 tests=MIME_BOUND_NEXTPART,NO_REAL_NAME,TO_MALFORMED version=2.55 X-Spam-Level: ** X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Intrusion Detection Exchange Format Working Group of the IETF. Title : The Intrusion Detection Message Exchange Format Author(s) : D. Curry, H. Debar Filename : draft-ietf-idwg-idmef-xml-11.txt Pages : 126 Date : 2004-2-6 The purpose of the Intrusion Detection Message Exchange Format (IDMEF) is to define data formats and exchange procedures for sharing information of interest to intrusion detection and response systems, and to the management systems which may need to interact with them. This Internet-Draft describes a data model to represent information exported by intrusion detection systems, and explains the rationale for using this model. An implementation of the data model in the Extensible Markup Language (XML) is presented, an XML Document Type Definition is developed, and examples are provided. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml-11.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-idwg-idmef-xml-11.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-idwg-idmef-xml-11.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2004-2-6160005.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-idwg-idmef-xml-11.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-idwg-idmef-xml-11.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2004-2-6160005.I-D@ietf.org> --OtherAccess-- --NextPart-- --azLHFNyN32YCQGCU-- From idwg-l-manager@Mail.ac.hmc.edu Wed Feb 11 09:11:29 2004 Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA01508 for ; Wed, 11 Feb 2004 09:11:29 -0500 (EST) Received: from mail2.ac.hmc.edu (localhost [127.0.0.1]) by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i1BD1dWJ008027 for ; Wed, 11 Feb 2004 05:05:35 -0800 Received: (from majordomo@localhost) by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i1BD1dQ1008026 for idwg-l-outgoing; Wed, 11 Feb 2004 05:01:39 -0800 X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f Received: from duke-out.exaprobe.net ([62.39.86.145]) by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i1BD1XWJ007980 for ; Wed, 11 Feb 2004 05:01:34 -0800 Received: from duke.exaprobe.net (localhost [127.0.0.1]) by duke-out.exaprobe.net (Postfix) with ESMTP id 5FCBF17C7A for ; Wed, 11 Feb 2004 14:02:59 +0100 (CET) Received: from localhost (unknown [127.0.0.1]) by duke.exaprobe.net (Postfix) with ESMTP id 520023F612 for ; Wed, 11 Feb 2004 13:02:59 +0000 (UTC) Received: from duke.exaprobe.net ([127.0.0.1]) by localhost (duke [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 13504-02 for ; Wed, 11 Feb 2004 14:02:58 +0100 (CET) Received: from dmaciejak (unknown [192.168.1.12]) by duke.exaprobe.net (Postfix) with ESMTP id 658CE3F611 for ; Wed, 11 Feb 2004 14:02:58 +0100 (CET) From: "David Maciejak" To: Subject: impact types too general ? Date: Wed, 11 Feb 2004 14:01:25 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000C_01C3F0A7.89F93080" X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Thread-Index: AcPwnyf2AROY8LgyQXOOjGeaTMrU4Q== Message-Id: <20040211130258.658CE3F611@duke.exaprobe.net> X-Virus-Scanned: by exaprobe.net X-Spam-Status: No, hits=4.3 required=8.0 tests=FORGED_MUA_OUTLOOK,HTML_70_80,HTML_MESSAGE, MISSING_OUTLOOK_NAME,X_AUTH_WARNING version=2.55 X-Spam-Level: **** X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) Sender: owner-idwg-l@hmc.edu Precedence: bulk This is a multi-part message in MIME format. ------=_NextPart_000_000C_01C3F0A7.89F93080 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi, In the last draft, we have 6 impact types (admin, dos, file, recon, user, other). Don't you think 'other' group is too general ? It would be great to have more categories like in Snort or Netforensics: (I don't know how many ..) For example - virus, exploit, evasion, monitoring, policy violations could be add - admin and user type could be join in an authentication/access/authorization group (and set severity correctly) David Maciejak ------=_NextPart_000_000C_01C3F0A7.89F93080 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 

In the last draft, we have 6 impact types = (admin, dos, file, recon, user, other).

 

Don’t you think ‘other’ = group is too general ?

 

 

It would be great to have more categories like = in Snort or Netforensics:

(I don’t know how many = ..)

 

For example

 

- virus, exploit, evasion, monitoring, policy violations could be add

- admin and user type could be join in an authentication/access/authorization group (and set severity = correctly)

 

 

David Maciejak

------=_NextPart_000_000C_01C3F0A7.89F93080-- From idwg-l-manager@Mail.ac.hmc.edu Fri Feb 13 06:12:46 2004 Received: from mail2.ac.hmc.edu (Mail.AC.HMC.Edu [134.173.32.22]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA04711 for ; Fri, 13 Feb 2004 06:12:45 -0500 (EST) Received: from mail2.ac.hmc.edu (localhost [127.0.0.1]) by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i1DAOGWJ015173 for ; Fri, 13 Feb 2004 02:27:22 -0800 Received: (from majordomo@localhost) by mail2.ac.hmc.edu (8.12.10/8.12.7/Submit) id i1DAOGgC015170 for idwg-l-outgoing; Fri, 13 Feb 2004 02:24:16 -0800 X-Authentication-Warning: mail2.ac.hmc.edu: majordomo set sender to owner-idwg-l@mail2.ac.hmc.edu using -f Received: from waga.cysol.co.jp (waga.cysol.co.jp [210.233.3.228]) by mail2.ac.hmc.edu (8.12.10/8.12.10) with ESMTP id i1DAO9WJ015132 for ; Fri, 13 Feb 2004 02:24:10 -0800 Received: from aso.priv.cysol.co.jp (aso.priv.cysol.co.jp [192.168.0.15]) by waga.cysol.co.jp (8.12.9/8.12.9) with ESMTP id i1DAO8Pt016929 for ; Fri, 13 Feb 2004 19:24:08 +0900 (JST) Received: from cysols.com (agari2.priv.cysol.co.jp [192.168.0.249]) by aso.priv.cysol.co.jp (8.12.9/8.12.7) with ESMTP id i1DAO7xL027991 for ; Fri, 13 Feb 2004 19:24:08 +0900 (JST) Message-ID: <402CA5C7.8080902@cysols.com> Date: Fri, 13 Feb 2004 19:24:07 +0900 From: Kohei OHTA User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: ja MIME-Version: 1.0 To: idwg-l@hmc.edu Subject: [Fwd: I-D ACTION:draft-kohei-idmef-schema-00.txt] X-Enigmail-Version: 0.76.4.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: multipart/mixed; boundary="------------050909010409080206020408" X-Spam-Status: No, hits=-0.8 required=8.0 tests=FWD_MSG,USER_AGENT_MOZILLA_UA,X_ACCEPT_LANG,X_AUTH_WARNING version=2.55 X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) Sender: owner-idwg-l@hmc.edu Precedence: bulk This is a multi-part message in MIME format. --------------050909010409080206020408 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit To all, We are working on IDMEF application with this definition in XML Schema. I know there are some discussions on IDMEF message definition in XML Schema. Just for your information. Kohei. -------- Original Message -------- Subject: I-D ACTION:draft-kohei-idmef-schema-00.txt Date: Tue, 10 Feb 2004 16:05:48 -0500 From: Internet-Drafts@ietf.org Reply-To: Internet-Drafts@ietf.org To: IETF-Announce: ; A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : XML Schema definition for IDMEF message Author(s) : K. Ohta Filename : draft-kohei-idmef-schema-00.txt Pages : 33 Date : 2004-2-10 The purpose of this document is to define a message format of IDMEF in XML Schema. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-kohei-idmef-schema-00.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-kohei-idmef-schema-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-kohei-idmef-schema-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --------------050909010409080206020408 Content-Type: Message/External-body; name="draft-kohei-idmef-schema-00.txt" Content-Disposition: inline; filename="draft-kohei-idmef-schema-00.txt" Content-Transfer-Encoding: 7bit Content-Type: text/plain Content-ID: <2004-2-10154659.I-D@ietf.org> --------------050909010409080206020408--