{"id":87,"date":"2007-04-19T20:08:10","date_gmt":"2007-04-20T01:08:10","guid":{"rendered":"http:\/\/raffy.ch\/blog\/2007\/04\/19\/standard-logging-format-common-event-exchange-cee\/"},"modified":"2007-04-23T17:57:22","modified_gmt":"2007-04-23T22:57:22","slug":"standard-logging-format-common-event-exchange-cee","status":"publish","type":"post","link":"https:\/\/raffy.ch\/blog\/2007\/04\/19\/standard-logging-format-common-event-exchange-cee\/","title":{"rendered":"Standard Logging Format – Common Event Expression (CEE)"},"content":{"rendered":"

As Anton<\/a> mentioned, there is a new event logging standard in the works. What Anton did not mention is the four areas that you need to talk about when you talk about a logging standard. Well, here they are:<\/p>\n

    \n
  1. Common Event Syntax, like CEF<\/a><\/li>\n
  2. Common Event Taxonomy. This is where you attach “meaning” or “semantics” to an event. There are a few proprietary ones, nothing standardized though.<\/li>\n
  3. Common Event Transport<\/li>\n
  4. Common Event Representation, defining what a device should log. An operating system should log user logins for example.<\/li>\n<\/ol>\n

    And don’t mix these things. The transport has nothing to do with the syntax! I don’t want to implement a SOAP environment to transport some events. Unfortunately a few companies and even standards have made that mistake! I don’t want to mention anyone here…
    \nStay tuned for http:\/\/cee.mitre.org to go live and learn more about all of this.<\/p>\n","protected":false},"excerpt":{"rendered":"

    As Anton mentioned, there is a new event logging standard in the works. What Anton did not mention is the four areas that you need to talk about when you talk about a logging standard. Well, here they are: Common Event Syntax, like CEF Common Event Taxonomy. This is where you attach “meaning” or “semantics” […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-87","post","type-post","status-publish","format-standard","hentry","category-log-analysis"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t