## 3 Security Information and Events Management (SIEM) Systems and Data Formats  
We investigated the most interesting solutions in data representation and storage in existing SIEM systems. For these goals, we have chosen OSSIM AlienVault, Cisco AccelOps, QRadar, Prelude, ArcSight Logger, IBM Tivoli SIEM, and Novell Sentinel Log Manager. These systems are on the top in [15]. The results of this analysis lead to the following conclusions. First, all developers of SIEM systems listed above use relational databases. They implement such database management systems (DBMSs) as MySQL, PostgreSQL, and SQLlite. Some of them declare that they can use XML databases. Analysis of advanced SEIM systems allows us to identify the location of the repository in the advanced SEIM system, and to identify the main flows of data between the repository and the rest SIEM components. These data flows are depicted in Figure 1.  
Then, the analysis of advanced SEIM systems let us to conclude that the main SIEM components (Figure 1), which are sources and consumers of data stored in the repository, are:  
* Event filtering, aggregation, abstraction, and correlation;
* Reasoning and visualization;
* Decision support reaction and countermeasures;
* Attack modeling and security evaluation. Information and event management standards provide the most common rules to represent the security events and incidents. So as to be more comprehensive we investigated the following standards: Common Base Event [16], Common Event Format [17], Intrusion Detection Message Exchange Format [18], Common Information Model [19], and Security Content Automation Protocol [20]. The Common Base Event model (CBE) is a standard that defines XML event syntax. CBE is a common language to detect, log and resolve system problems. It is supported by several Tivoli products. Since the public release of the specification and IBM's partnering with Cisco in 2003, CBE has continued to be actively maintained. Common Event Format (CEF) was proposed by ArcSight. It is an open standard that contains the most relevant event information, making it easy for event consumers to parse and use them. This format integrates various approaches to represent popular logs for infrastructure providers. The format is mostly oriented to ArcSight SIEM systems. Intrusion Detection Message Exchange Format (IDMEF) is an Internet Engineering Task Force (IETF) effort. IDMEF was designed to enable the communication of intrusion events. It consists of two entities: the syntax expressed in XML and the transport protocol (Intrusion Detection Exchange Protocol, IDXP). First was proposed in 2002, with the most recent update occurring in 2004. IDMEF is supported by a limited number of intrusion detection products. Common Information Model (CIM) provides a common definition of management information for systems, networks, applications and services, and is used for vendor extensions. CIM's common definitions enable vendors to exchange semantically rich management information between systems throughout the network. CIM covers the widest possible scope among the listed standards. At the moment it is actively growing. Security Content Automation Protocol (SCAP) [20] enables to compile a list of system platforms and applications, set their configuration, specify the list of vulnerabilities to assess the adverse effects of configurations and security vulnerabilities, identify the most critical vulnerabilities. It consists of a number of standards that describe:  
Figure 1: Main data flows with repository in Security Information and Events Management (SIEM) system. * Features of software and hardware configuration (Common Platform Enumeration, CPE);
* Software and hardware configuration which adversely affects the security (Common Configuration Enumeration, CCE);
* Vulnerabilities of these products (Common Vulnerabilities and Exposures, CVE);
* Effects of configurations and security vulnerabilities, the most critical vulnerabilities, and corrections of errors (Common Vulnerabilities Scoring System, CVSS).