Dear allies,
The discussion around the IEP04 proposal, adding meta-information to IntelMQ messages, has stalled over the last months - first because of the time-intensive IntelMQ 3.0 release preparations and then because of the vacation season.
Here is the current proposal: https://github.com/certtools/ieps/tree/main/004#readme
Aaron, Sebastian Waldbauer and myself worked on it over the summer and also identified two open issues to be discussed: 1. The exact format of the meta-information and how to name and structure the fields. AIL made the first move and now uses a format similar to the previously proposed Variant "A". The IEP04 document contains the current proposal which is in line with the AIL format: https://github.com/certtools/ieps/tree/main/004#user-content-variant-ail If there are no other proposals, this will most probably the way to go. 2. The format of the UUID format which we want to uniquely identify IntelMQ events. We don't necessarily need to use the UUIDv4 format which represents pure randomness, but also other options which include the time and are even /time-sortable/. Sebastian Waldbauer analysed a couple of options and summarised his results in this document:
https://github.com/certtools/ieps/blob/main/004/UUID.md
Please let us know your opinion on the different UUID options.
cheers Sebastian
Dear Sebastian and all,
Thank you for your effort to provide better IntelMQ. I am trying to catch up the discussion (but still behind a lot...)
Regarding IEP004, I'd second the current proposal and Variant AIL. That is natural and easy to understand.
But don't we need to have a timestamp in the meta-data ? I mean something like this;
{ "format": "intelmq", "version": 1, "type": "event", "meta": { "intelmq:uuid": "<event-uuid-1>", "intelmq:uuid_org": "<org-uuid-1>", "intelmq:timestamp": "<creation time of this message>", <== here :
With this timestamp, we don't need to consider a time-sortable UUID but just use UUID-whatever.
If you've already discussed and decided not to have it, please ignore and receive my apology to rehash old discussion.
Thank you very much.
Best Regards,