As Anton mentioned, there is a new event logging standard in the works. What Anton did not mention is the four areas that you need to talk about when you talk about a logging standard. Well, here they are:
- Common Event Syntax, like CEF
- Common Event Taxonomy. This is where you attach “meaning” or “semantics” to an event. There are a few proprietary ones, nothing standardized though.
- Common Event Transport
- Common Event Representation, defining what a device should log. An operating system should log user logins for example.
And don’t mix these things. The transport has nothing to do with the syntax! I don’t want to implement a SOAP environment to transport some events. Unfortunately a few companies and even standards have made that mistake! I don’t want to mention anyone here…
Stay tuned for http://cee.mitre.org to go live and learn more about all of this.
Hello,
Item 2 above is entirely not true; there is an existing standard called XDAS which defines event taxonomy as well as formats (item 1). This is an open standard developed by the OpenGroup.
http://www.opengroup.org/security/das/xdas_int.htm
It also includes an API definition for auditing that can use a variety of transport methods; item 3 above is not necessary as the format should be independent of delivery method.
Comment by David Corlette — May 16, 2007 @ 9:55 am
In this post, you state there are 20 vendors or so working with CEF. Are they posted somewhere on who they are?
http://www.loganalysis.org/pipermail/loganalysis/2007-April/000089.html
Comment by DC — June 29, 2007 @ 9:01 am
[…] for example is something that should not depend on the syntax and vice versa. I keep haing to make that point. The ArcSight CEF standard is not bound to any transport. Use anything. If you don’t have […]
Pingback by Raffy’s Computer Security Blog » CEE - CEF - Event Interoperability Standards — July 18, 2007 @ 5:44 pm
On http://cee.mitre.org is only apache test page! Where I can get CEE?
Comment by sectrix — November 27, 2007 @ 9:54 am
It is really close now! Hang on tight. The site is ready, but is going through approval processes. It’s very very close!
Comment by Raffael Marty — November 27, 2007 @ 10:08 am