AW: Status of IDMEF support?

["Poppi, Sandro" <Sandro.Poppi () wacker com>]

Hi Joshua,

Just as Joe said the sourceforge project is the successor of silicon
defense's and Joe's work of snort's IDMEF plugin. It's actively developed.

Regarding to IDMEF draft development there is a discussion going on to
include some more information as well as changing from DTD to an XML schema.
There is now release date available yet for the new draft.

HTH,
Sandro
> Hi Joshua,
>
> Sandro will probably provide you with a more concise answer, but in a 
> nutshell...  The projects at Sourceforge are the most recent and 
> official.  Both libidmef and the IDMEF xml plugin have been picked up 
> by Sandro Poppi.  He's made quite a few changes recently (I believe 
> there's a few messages in the recent archives of this list).
>
> Hope this helps,
>
> -Joe M
>
> On Tuesday, January 27, 2004, at 12:31 PM, Joshua Wright wrote:
>
> > I'm trying to determine what the status of IDMEF support is with 
> > Snort.  The last entry in the ChangeLog for integrated 
> IDMEF code with 
> > Snort was from 2002-05-15, indicating that the 
> output-plugin for IDMEF 
> > was removed because it was broken.
> >
> > The last activity from the Silicon Defense page on IDMEF 
> > (http://www.silicondefense.com/idwg/snort-idmef/) was from 
> 2003-1-15, 
> > but there has been activity on the SourceForge project for 
> the "Snort 
> > IDMEF Plugin" as recent as a few weeks ago.
> >
> > What's the status of using IDMEF with Snort?  Any sanctioned advice 
> > from the wise people at snort.org?  Any other comments on 
> where IDMEF 
> > is with vendor implementations or standard approval are welcome as 
> > well.
> >
> > Thanks.
> >
> > -Joshua Wright
> > jwright () hasborg com
> >
> >
> > -------------------------------------------------------
> > The SF.Net email is sponsored by EclipseCon 2004
> > Premiere Conference on Open Tools Development and Integration
> > See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
> > http://www.eclipsecon.org/osdn
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> -------------------------------------------------------
> The SF.Net email is sponsored by EclipseCon 2004
> Premiere Conference on Open Tools Development and Integration
> See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
> http://www.eclipsecon.org/osdn
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users