From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: New draft standards
Date: Tue, 08 Dec 2015 14:22:05 -0500
Message-ID: <3616972.XJnAnOOqWb@x2>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from x2.localnet (vpn-58-33.rdu2.redhat.com [10.10.58.33])
	by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
	id tB8JM457000595
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <linux-audit@redhat.com>; Tue, 8 Dec 2015 14:22:05 -0500
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Hello,

I would like to point out 2 new standards that have been posted to the linux 
audit web page. The first establishes the events around system start up and 
shutdown. This is important because it sets the session boundaries for when a 
system is up or down or crashed.

http://people.redhat.com/sgrubb/audit/system-lifecycle.txt

The second standard is more of a forward looking standard. It explains how the 
audit daemon and utilities will perform event enrichment before being stored 
long term in an aggregator. The target for implementation is the 2.5 release 
of the audit daemon.

http://people.redhat.com/sgrubb/audit/event-enrichment

Let me know if anyone has feedback on these standards, especially the second 
one.

-Steve