{"id":99,"date":"2007-06-07T01:01:00","date_gmt":"2007-06-07T06:01:00","guid":{"rendered":"http:\/\/raffy.ch\/blog\/2007\/06\/07\/common-event-exchange-formats-xdas\/"},"modified":"2007-06-07T01:01:00","modified_gmt":"2007-06-07T06:01:00","slug":"common-event-exchange-formats-xdas","status":"publish","type":"post","link":"https:\/\/raffy.ch\/blog\/2007\/06\/07\/common-event-exchange-formats-xdas\/","title":{"rendered":"Common Event Exchange Formats – XDAS"},"content":{"rendered":"

Not too long ago, I posted an entry about\nCEE, the Common Event Expression<\/a> standard which is a work in progress, lead by Mitre. I was one of the founding members of the working group and I have been in discussions with Mitre and other entities for a long time about common event formats. Anyways, one of the comments<\/a> to my blog entries pointed to an effort called\nDistributed Audit Service<\/a> (XDAS). I have not heard of this effort before and was a bit worried that we started something new (CEE) where there was already a legitimate solution. That’s definitely not what I want to do. Well, I finally had time to read through the 100! page document. It’s not at all what CEE is after. Let me tell you why XDAS is not what we (you) want:<\/p>\n

    \n
  1. How many people are actually using this standard for their audit logs? Anyone? I have been working in the log management space for quite a while and not just on the vendor side, but also in academia. I have NEVER heard of it before. So why should I use this if nobody else is? In contrast, CEF from ArcSight<\/a> is in use not just by ArcSight itself, but many of its partners.<\/li>\n
  2. I just mentioned it before. 100 pages! What’s the last time you read through 100 pages? I just did. Took me about an hour to read the document and I skipped a lot of the API definitions. My point being: A standard should be at most 10 pages! It’s not just the length of the document, it’s the complexity which comes with it. Nobody is going to read and adhere to this. The more you demand, the more mistakes are being made by vendors which implement this. Oh, and please don’t tell me to only read pages 1-10! Make it 10 pages if you want me to read only those.<\/li>\n
  3. How much time does it take to actually implement this? Has anyone done it? How long did it take you? I bet a couple of weeks, plus QA, etc. Much too long. I am NEVER going to make that investment.<\/li>\n
  4. Let’s get into details. Gosh. Why does this define APIs? Don’t dictate how I should do things. A standard needs to define the common interface, not how I have to open a stream and safe files and so on. It’s overkill. The implementations will differ and they should! And why lock yourself into this API transport. Can you support other transports?<\/li>\n
  5. It seems that there is an XDAS service that I need to integrate with. What is that? That’s not clear to me. Can I exchange logs (audit records) between just to parties or do I need an intermediary XDAS service? I am confused.<\/li>\n
  6. Keep the scope of the standard to what it wants to accomplish: event interchange! This thing talks about access control, RBAC, filtering, etc. Why? Please! That’s absolutely unnecessary and should not be part of an interchange standard!<\/li>\n
  7. In general, I am quite confused about the exact setting of this. Are we only talking about audit records? Security related only? What about other events? I want this to be very generic! Don’t give me a security specific solution! The world is opening up! We need generic solutions!<\/li>\n
  8. What kind of people wrote this? Using percent signs to escape entries and colons to separate them? Must be from the old AS\/400 world … Sorry… I just had to say this, in a world of CSV and key-value pairs it is sort of funny to see these things.<\/li>\n
  9. The glossary could really benefit from a definition of event<\/em> and log.<\/em><\/li>\n
  10. The standard requires a measure of uncertainty for timestamps. I have never heard of this. Could you please elaborate? How can I measure time uncertainty???<\/li>\n
  11. In section 2.5, access IDs and principle IDs are mentioned. What’s that?<\/li>\n
  12. Although the standard does not position itself with log management, it talks about alarms and actions. Why would you need to mention actions in this context at all?<\/li>\n
  13. A pointer to the original log entry? How do you do that? Log rotation, archiving, leave alone the mere problem of how to reference the original entry to start with.<\/li>\n
  14. Why does the standard require the length of a record to be communicated? Just drop that.<\/li>\n
  15. The caller has to provide an event_number. I like it. But sorry folks, syslog does not have it. How do you get that in there?<\/li>\n
  16. Originator identity: It specifies that this should be the UNIX id. ID of what? The process that logs? The user that initiated the action? The remote user that sent the packet to this machine to trigger some action? How do you know that?<\/li>\n
  17. I like the list of XDAS events. It’s a good start, but it’s definitely not all we need. We need much more! Again a nice list to start with.<\/li>\n
  18. Why is there so much information encoded in the outcome, instead of defining individual entries? There might be a valid reason, but please motivate these decisions.<\/li>\n<\/ol>\n

    That’s what I have for a quick review. Again, no need for us to stop working on CEE. There is still a need for a decent interoperability standard.<\/p>\n

    [tags]interoperability, log, event exchange, common exchange format, common event expression, log management[\/tags]<\/p>\n","protected":false},"excerpt":{"rendered":"

    Not too long ago, I posted an entry about CEE, the Common Event Expression standard which is a work in progress, lead by Mitre. I was one of the founding members of the working group and I have been in discussions with Mitre and other entities for a long time about common event formats. Anyways, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-99","post","type-post","status-publish","format-standard","hentry","category-log-analysis"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts\/99","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/comments?post=99"}],"version-history":[{"count":0,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts\/99\/revisions"}],"wp:attachment":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/media?parent=99"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/categories?post=99"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/tags?post=99"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}