Logblog: A New Logging Standard Effort Started: Common Event Expression (CEE)

« Log Management Time | Main | Logging The Threat From Within »

A New Logging Standard Effort Started: Common Event Expression (CEE)

After long months of undercover work by a small team, CEE effort is ready to be open for broader involvement. Just what is CEE? Below is an excerpt from a brochure, to be published at MITRE's site soon. I do think that the world is ready for another battle for the establishment of a logging standard, after a long string of miserable failures (see IDMEF, etc).

"Common Event Expression (CEE™): A standard log language for event interoperability in electronic systems.

CEE standardizes the way computer events are described, logged, and exchanged. By utilizing a common language and syntax, CEE takes the guesswork out of even the most menial of event- or log-related tasks. Tasks including log correlation and aggregation, enterprise-wide log management, auditing, and incident handling which once required expensive, specialized analysts or equipment can now be performed more efficiently and produce better results.

Why CEE?

If multiple systems observe the same occurrence, it should be expected that their description of that event is identical. When combined with relevant event details (time, source, destination), a computer should be able to immediately determine whether two or more logs, data logs, audit logs, alerts, alarms, or audit trails refer to the same event. In order to make this happen, there needs to be a scalable, well-defined way to express events."

We will post more details when they are ready for a public release. For now, watch an ongoing discussion about the upcoming CEE standard on the loganalysis mailing list. The thing to remember is that the standard effort is just starting up and broader industry involvement will be required. Given MITRE track record with standards such as CVE, OVAL and others, this effort has a good chance of becoming real.

Technorati tags: chuvakin, CEE, log management, logging standards

Posted April 20, 2007 in | Permalink