Subject: Cisco, ISS, Sourcefire agree to alert standard.

From: Greg Shipley <[email-masked]>
Date: Tue, 9 Mar 2004 13:45:11 -0600 (CST)

Thought some of you might find this interesting.

Hope everyone is well,

-Greg

http://www.trusecure.com/company/press/pr_20040223.shtml

ICSA Labs IDS Consortium Announces Network Intrusion Detection System
Alert Specification Format

Industry Experts from Cisco, Internet Security Systems and Sourcefire Join
Forces to Develop the Security Device Event Exchange Transport Protocol
Specification

Mechanicsburg, PA.February 23, 2004.ICSA Labs®, an independent division of
TruSecure® Corporation, today announced the development of the Security
Device Event Exchange (SDEE), an intrusion detection system (IDS) alert
format and transport protocol specification. SDEE is an XML-based alert
format adopted by the members of the ICSA Labs Intrusion Detection
Consortia and created by Cisco Systems and other leading IDS vendors
including Internet Security Systems, Inc. (ISS) and Sourcefire.

IDSC members Jeff Platzer and Mike Hall of Cisco Systems, Robert Graham of
ISS, Marty Roesch of Sourcefire and Marcus Ranum of TruSecure Corporation
co-developed the SDEE transport protocol specification format; this team
will manage future revisions to the specification.

"Cisco is pleased to have participated in the development of this
specification, and help address the industry-wide challenge of normalizing
event messages in a common format," said Mike Fuhrman, director of
engineering at Cisco Systems. "This industry collaboration underscores the
advancement of IDS technology adoption today."

SDEE specifies the format of the IDS alerts as well as the protocol used
to communicate events generated by security devices. SDEE is flexible and
extensible so vendors can utilize product specific extensions in a way
that maintains messaging compatibility. In addition, SDEE will provide
corporations and security vendors better management of multiple vendor
environments by having all alerts communicated in the same format. SDEE
builds upon the XML, HTTP and SSL/TLS industry standards to facilitate
adoption by vendors and users by allowing them to use existing software
that implements these standard interfaces. For more information about
SDEE, please visit http://www.icsalabs.com/html/communities/ids/sdee/ or
contact Scott Markle at [email-masked].

"This spirit of cooperation is what the Internet was based upon. Rather
than a complicated standard that was hard to implement, we simply sat down
together and solved the basic problem of getting our products talking to
each other," said Robert Graham, chief scientist, Internet Security
Systems, Inc.

"Consensus standards like this are an important indicator that a
technology has matured and become mainstream. This effort is proof that
meaningful and useful standards can be agreed-upon quickly and
effectively, providing a great benefit for customers as well as IDS
vendors and third parties," said Marcus Ranum of TruSecure Corporation.

About IDSC
ICSA Labs formed the IDSC consortium in 1998 to provide product developers
an open forum within which they could work towards common goals. These
goals include educating end-users, influencing industry standards and
maintaining product and marketing integrity. Members meet on a quarterly
basis and participate in ongoing discussions and cooperative projects such
as certification criteria development, buyer's guides and white papers.
Membership is open to any developer of intrusion detection and intrusion
prevention systems.

Current members include: Cisco Systems, Inc., Fortinet, Internet Security
Systems, Inc. (ISS), SecureWorks, Sourcefire, Inc., Symantec Corp. and
Tripwire, Inc. A complete list of current IDSC Members can be found at:
http://www.icsalabs.com/html/communities/ids/membership/index.shtml

For more information about the IDSC or the SDEE, please visit
http://www.icsalabs.com.

About ICSA Labs
ICSA Labs, an independent division of TruSecure Corporation, offers
vendor-agnostic testing and certification of security products. Hundreds
of the world's top security vendors submit their products for testing and
certification at ICSA Labs. The end-users of security technologies rely on
ICSA Labs to authoritatively set and apply objective testing and
certification criteria for measuring product compliance and reliability.
The organization tests products in key technology categories such as
anti-virus, firewall, IPSec VPN, cryptography, intrusion detection, PC
firewall, content security, SSL-VPN and Wireless LAN.

About TruSecure Corporation
TruSecure is the leading provider of intelligent risk management products
and services. TruSecure dramatically improves security and reduces risk by
helping organizations make better security decisions and maximize the
effectiveness of existing security people, processes, and products.
Leveraging TruSecure's vast security knowledge and intelligence gathering
resources.including ICSA® Labs, the global leader in information security
product certification.as well as innovative technology and time-tested
processes, our customers can predict which vulnerabilities present real
risk, quickly adapt to changes in the security threatscape, prioritize
remediation efforts, and prove compliance with applicable security
policies, standards and regulations.

Headquartered in Herndon, VA, TruSecure's customer-proven solutions are
used by more than 700 customers worldwide, with operations in North
America, Central America, Europe and Asia Pacific. For more information
about TruSecure Corporation, visit www.TruSecure.com.

Media Contacts
Cynthia Shaw
TruSecure
703-480-8509
[email-masked]

ICSA, ICSA Labs and TruSecure are registered trademarks of TruSecure
Corporation. All other trademarks and service marks mentioned herein are
property of their respective owners.

---

From: Herve Debar <[email-masked]>
Date: Thu, 11 Mar 2004 20:16:46 +0100

> Thought some of you might find this interesting.

Well, obviously the specification is less open than the press release 
:-). If anybody got access, please post the document to the list or send 
it to me privately.

On a related topic, I think we are getting close to a -12rc1 version 
candidate that could be discussed on the list. I hope to post it either 
tomorrow or monday.

Hervé
-- 
Hervé Debar             <mailto:[email-masked]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France Télécom R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4

---

From: "Klee Michaelis \(kleem\)" <[email-masked]>
Date: Thu, 11 Mar 2004 13:52:58 -0600

http://www.icsalabs.com/html/communities/ids/sdee/

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Herve Debar
> Sent: Thursday, March 11, 2004 1:17 PM
> To: Greg Shipley
> Cc: intrusion detection wg
> Subject: Re: Cisco, ISS, Sourcefire agree to alert standard.
> 
> 
> Greg Shipley wrote:

---

From: Yoann Vandoorselaere <[email-masked]>
Date: Thu, 11 Mar 2004 21:03:10 +0000

> http://www.icsalabs.com/html/communities/ids/sdee/

I think we all know about this URL. Unfortunally, the mechanism used for
accessing the SDEE specification does not work at all. I do not know
about a single person who succeed in gathering the draft.

This lead to questions concerning the openess of this doubtful standard.

-- 
Yoann Vandoorselaere <[email-masked]>

---

From: "Klee Michaelis \(kleem\)" <[email-masked]>
Date: Thu, 11 Mar 2004 15:26:41 -0600

As per the text on the page, I think that you'll need to send an email
to [email-masked].

From the bottom of the page:

Receive more information on the SDEE Alert Specification AND join our
listserv for continuous updates:

Option 1 
To sign up for the ICSA Labs SDEE listserv & receive the SDEE
specification file, simply send an email to
[email-masked] with "SUBSCRIBE" in the subject
line.

Option 2 
To receive the SDEE specification file only, simply send an email to
[email-masked] with "FILE" in the subject line.

> Behalf Of Yoann Vandoorselaere
> Sent: Thursday, March 11, 2004 3:03 PM
> To: [email-masked]
> Cc: 'Herve Debar'; 'Greg Shipley'; 'intrusion detection wg'
> Subject: RE: Cisco, ISS, Sourcefire agree to alert standard.
> 
> 
> I think we all know about this URL. Unfortunally, the 
> mechanism used for accessing the SDEE specification does not 
> work at all. I do not know about a single person who succeed 
> in gathering the draft.
>

---

From: Ben Feinstein <[email-masked]>
Date: Thu, 11 Mar 2004 16:26:02 -0500

I did get a response to my "Subject: FILE" email to 
<[email-masked]>.  Scott Markle <[email-masked]> 
promptly sent me the file.

Unfortunately, the email containing the SDEE draft and schema also contained 
the following notice, which I think means I can't it to this list :(

This message is intended only for the use of the intended recipient and
may contain information that is PRIVILEGED and/or CONFIDENTIAL.  If you
are not the intended recipient, you are hereby notified that any use,
dissemination, disclosure or copying of this communication is strictly
prohibited.  If you have received this communication in error, please
destroy all copies of this message and its attachments and notify us
immediately.

---

From: Yoann Vandoorselaere <[email-masked]>
Date: Thu, 11 Mar 2004 21:25:17 +0000

> [email-masked] with "FILE" in the subject line.

Already done this: got no answer. I think Herve is hit by the same
problem...

---

From: "David A. Curry" <[email-masked]>
Date: Thu, 11 Mar 2004 16:27:54 -0500

>>>>> On Thu, 11 Mar 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> Well, obviously the specification is less open than the press release
  Herve> :-). If anybody got access, please post the document to the list or
  Herve> send it to me privately.

I clicked on the "send me a copy without subscribing me to the forum" link
yesterday.... I have not received anything yet (two business days later).

Oh well.

--Dave

---

From: "S. Felix Wu" <[email-masked]>
Date: Thu, 11 Mar 2004 13:32:38 -0800

I followed the direction on the link and send an email with "FILE"
in the subject line. And, I did receive the SDEE spec (in html format).

The document I received was written by Jeff Platzer from Cisco on August
20, 2003 with the following abstract:

Network and host-based security devices may generate various types of
events that include alert, policy violation and audit events. The
security Device Event Exchange (SDEE) is a standard that specifies the
format of the messages as well as the protocol used to communicate the
events generated by security devices. The current version of SDEE only
specifies the messaging for the Intrusion Detection System (IDS) Alert
Event. While SDEE communications may consist of bindings to multiple
transport protocols, the current version of SDEE specifies only the
binding to HTTP.

I am pretty sure that I am not allowed to send/post the spec openly...
-Felix

-- 
----------------------------------------------------------------------
Dr. S. (Shyhtsun) Felix Wu                           [email-masked]
Associate Professor                      http://www.cs.ucdavis.edu/~wu
Computer Science Department                     office: 1-530-754-7070
University of California at Davis               fax:    1-530-752-4767
----------------------------------------------------------------------

---

From: Gene Jarboe <[email-masked]>
Date: Thu, 11 Mar 2004 17:26:34 -0500

Klee Michaelis,

      Why doesn't Cisco submit the SDEE Alert Specification to the IETF's 
IDWG so that it will become
a truly "open" international standard as opposed to a standard agreed upon 
by so few organizations?

Gene Jarboe, Promia, Inc.

---

From: [email-masked]
Date: Thu, 11 Mar 2004 14:32:54 -0800

I was able to receive it with this generic address I use for mailing 
lists.  It was sent immediately.  This may just be coincidence.

-Joe McAlerney

---

From: Yoann Vandoorselaere <[email-masked]>
Date: Thu, 11 Mar 2004 22:49:12 +0000

> a truly "open" international standard as opposed to a standard agreed upon 

isn't it the purpose of IDMEF ? Thanks but no thanks, I'd like to avoid
another alert description standard.

---

From: Fyodor <[email-masked]>
Date: Fri, 12 Mar 2004 10:06:12 +0800

> a truly "open" international standard as opposed to a standard agreed upon 

I would think the icsalab is behind the whole thing, and their SDEE spec is
one of their "marketting strategies". Their "Security vendor forum" and
membership requires at least 10k US to participate, which probably explains
alot.

---

From: Herve Debar <[email-masked]>
Date: Fri, 12 Mar 2004 08:33:36 +0100

Well, thanks to all for showing me that the list is read :-)

I finally got the spec as well. Apparently I imagined an automated 
response and it seems to be a manual one.

Hervé

---

From: "David A. Curry" <[email-masked]>
Date: Fri, 12 Mar 2004 09:29:36 -0500

>>>>> On Fri, 12 Mar 2004, Herve Debar, identified as "Herve" below, wrote:

  Herve> I finally got the spec as well. Apparently I imagined an automated
  Herve> response and it seems to be a manual one.

I got mine as well.  I asked Scott Markle if it was okay to send the files
to the list, and he responded that yes it was, but that he had sent them
to the list yesterday.

As of 9:30am Eastern time Friday, I have not seen them on the list.  Anyone
else seen them?  Or at least, does everyone who wants a copy have a copy?

--Dave