How about referring to an event as:

"A discrete, distinct, and discernible occurrence of interest within
an environment"

Thoughts?

On Wed, Jul 23, 2008 at 5:21 PM, Anton Chuvakin <anton (at) chuvakin (dot) org [email concealed]> wrote:
>> I'm good with the definitions, except for the concept of an "event":
>
> Same thing. Event is not necessarily "a state change." It is a
> broader thing, basically, "something that happened" (even though a
> state is the same - e.g. backup is proceeding, attack was seen, etc)
>
>
>>
>>> Event:
>>> A discrete, distinct, and discernible state change in an
>>> environment.
>>
>> In some aspects, state changes such as processes dieing or starting
>> are surely events, but I also think that some logs which don't indicate
>> a state change such as login failures, port scanning, intrusion
>> detection logs, and so on are noteworthy and worth alerting on.
>>
>> Ron
>>
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> LogAnalysis mailing list
>> LogAnalysis (at) loganalysis (dot) org [email concealed]
>> http://www.loganalysis.org/mailman/listinfo/loganalysis
>>
>
>
>
> --
> Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA
> http://www.chuvakin.org
> http://chuvakin.blogspot.com
> http://www.info-secure.org
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysis (at) loganalysis (dot) org [email concealed]
> http://www.loganalysis.org/mailman/listinfo/loganalysis
>

--
Andrew Hay
Security+, CCSE Plus, RHCE, GSEC, GCIA, GCIH, CISSP
blog: http://www.andrewhay.ca
email: andrewsmhay (at) gmail (dot) com [email concealed]
twitter: andrewsmhay
profile: http://www.linkedin.com/in/andrewhay
_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]