Common Event Expression: CEE, A Standard Log Language for Event Interoperability in Electronic Systems

Downloads	Documents	News — May 11, 2012	Search

Architecture Overview

CEE Log Syntax (CLS)

CEE Log Transport (CLT)

Discussion List

Discussion Archive

Free Newsletter

Search the Site

Latest News
Registration now open for MITRE’s Security Automation Developer Days 2012 on July 9-13 CEE Main Topic of Article on NetworkWorld CEE/Making Security Measurable booth at InfoSec World 2012 New Open-Source "LumberJack" Project to Improve Creation and Standardize Content of Event Logs by Implementing CEE 4 CEE Language Specifications Updated to Version 1.0-alpha: CEE Architecture Overview, CEE Profile, CEE Log Syntax, and CEE Log Transport More News »
Upcoming Events
MITRE’s Security Automation Developer Days 2012, July 9-13 CEE/Making Security Measurable booth at Black Hat Briefings 2012, July 25-26 More Events »
Status Report
Version 1.0-alpha CEE Specification documents now available: CEE Architecture Overview CEE Profiles CEE Log Syntax (CLS) CEE Log Transport (CLT) More Information cee@mitre.org

Unifying the Audit & Event Lifecycle for Electronic Systems

CEE Event Lifecycle

Users:

Find events quickly using common fields and classification tags
Easy to understand, easy to use
Compatible with existing processes and products
Simplifies event handling and audit compliance

Developers:

Unifies event structures and content
Interoperable with most platforms, event syntaxes, and APIs
Easy to use, simple XML structure
Extensible event architecture

Unified	Agile	Open	Compatible
CEE unifies event representation and classification by combining support for multiple event syntaxes and log protocols in a single event standard.	The future is difficult to predict. That’s why CEE defines a base set of event record requirements and allows event authors to create their own custom event and event field definitions.	CEE is an open, community-driven effort built on open standards. Interested parties are invited to contribute. All CEE components are freely licensed at no cost.	CEE is capable of representing any observable computer or network event and has been developed to be compatible with existing event management products and processes.

corner

corner

corner

corner

Related Efforts
Cyber Observables (CybOX) Vulnerabilities (CVE) Configurations (CCE) Software Weakness Types (CWE) Platforms (CPE)	Attack Patterns (CAPEC) Assessment Language (OVAL) Malware (MAEC) Making Security Measurable

corner

corner

corner

corner

Page Last Updated: May 09, 2012