RE: SDEE vs IDMEF ?

[Yoann Vandoorselaere <yoann () prelude-ids org>]

On Fri, 2004-03-12 at 13:41 -0800, Kohlenberg, Toby wrote:

> probably because IDMEF has been so slow in developing, it is
> XML and as such massively slow to generate and because they 
> could sit down the three of them and agree upon something and
> get it implemented quickly. 

If only SDEE was not XML (+ HTTP + SOAP)...
Maybe you claim could be valid... However, it is.

> As I recall, they are not keeping
> their format to themselves so anyone can use it and, at least
> for Snort, if people prefer IDMEF, you can still use it.

As I recall, you have to pay a big amount of buck if you want your voice
to be taken into account for developing SDEE.  Hardly open heh ?

-- 
Yoann Vandoorselaere <yoann () prelude-ids org>


---------------------------------------------------------------------------
Test your IDS

Is your IDS deployed correctly?
Find out by easily testing it with real-world attacks from CORE IMPACT.

Visit: 
www.coresecurity.com/promos/sf_eids1 to learn more.
---------------------------------------------------------------------------