Confidence is a complex item-how do we come to agreement. Given vendor differences, can we come up with a single measure to suite all applications. Vendors give different confidences on different alerts. Needs further discussion on the mailing list. Impact there is concern as to the enumeration-ordering of attacks under Impact.
Impact seems to deal with both the type of event and severity of event.
We cannot identify all events. Editorial issue between XML and Data Model. Scales need to be consistent between the DTD and Data model. This item needs to be discussed further on the mailing list. He included a quick overview of the data model and the concepts behind generating and delivering an alert.