Alert Format-approved with no addition discussion. This item resulted in a great deal of discussion. The level of interest in this group, however, suggests it may be a topic for a BOF at a future date. Following this discussion Stuart summed up the determinations that Alert Format and Communications Protocol were the only two products which met the scope of this working group. Others, specifically semi-automatic tracing and attack signatures may be taken up under a separate effort.
Cisco believes in and supports intrusion detection standardization.
Cisco does not want a standard that forces vendors to rebuild existing Intrusion Detection Systems. Cisco believes IDSs should be network, Host, and applications based. One for intrusion detection and an ther for vulnerability assessment. Mike opened the meeting with comments to summarize events of last night's meeting. The scope was pretty much decided during the previous meeting.