<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Dear allies,</p>
<p>The discussion around the IEP04 proposal, adding meta-information
to IntelMQ messages, has stalled over the last months - first
because of the time-intensive IntelMQ 3.0 release preparations and
then because of the vacation season.</p>
<p>Here is the current proposal:
<a class="moz-txt-link-freetext" href="https://github.com/certtools/ieps/tree/main/004#readme">https://github.com/certtools/ieps/tree/main/004#readme</a></p>
<p>Aaron, Sebastian Waldbauer and myself worked on it over the
summer and also identified two open issues to be discussed:<br>
1. The exact format of the meta-information and how to name and
structure the fields. AIL made the first move and now uses a
format similar to the previously proposed Variant "A". The IEP04
document contains the current proposal which is in line with the
AIL format:
<a class="moz-txt-link-freetext" href="https://github.com/certtools/ieps/tree/main/004#user-content-variant-ail">https://github.com/certtools/ieps/tree/main/004#user-content-variant-ail</a>
If there are no other proposals, this will most probably the way
to go.<br>
2. The format of the UUID format which we want to uniquely
identify IntelMQ events. We don't necessarily need to use the
UUIDv4 format which represents pure randomness, but also other
options which include the time and are even <i>time-sortable</i>.
Sebastian Waldbauer analysed a couple of options and summarised
his results in this document:<br>
</p>
<p><a class="moz-txt-link-freetext" href="https://github.com/certtools/ieps/blob/main/004/UUID.md">https://github.com/certtools/ieps/blob/main/004/UUID.md</a></p>
<p>Please let us know your opinion on the different UUID options.</p>
<p>cheers<br>
Sebastian<br>
</p>
<pre class="moz-signature" cols="72">--
// Sebastian Wagner <a class="moz-txt-link-rfc2396E" href="mailto:wagner@cert.at"><wagner@cert.at></a> - T: +43 676 898 298 7201
// CERT Austria - <a class="moz-txt-link-freetext" href="https://www.cert.at/">https://www.cert.at/</a>
// Eine Initiative der nic.at GmbH - <a class="moz-txt-link-freetext" href="https://www.nic.at/">https://www.nic.at/</a>
// Firmenbuchnummer 172568b, LG Salzburg</pre>
</body>
</html>