Security Device Event Exchange SDEE

Last Updated on Sun, 30 Jul 2023 | Security Monitoring

SDEE is a somewhat open standard used by many IPS/IDS vendors, including Cisco, ISS, Sourcefire, and TruSecure. "Somewhat open" means that you can use it, but it is ultimately owned by the International Computer Security Association (ICSA). SDEE uses Extensible Markup Language (XML) to organize the format of IDS alerts (or events) and specifies the protocol as HTTP. SDEE was designed to be both flexible and extensible. SDEE, when used on Cisco IDS/IPS sensors, is backward compatible with Remote Data Exchange Protocol (RDEP) (a similar, but older communication protocol for Cisco IDS devices).

The original idea for SDEE was to standardize the event and alerting format among vendors so that many different vendor IPS/IDS solutions could be supported within a customer's network.

The SDEE framework is built on top of XML and uses HTTP as a transport with Secure Socket Layer/Transport Layer Security (SSL/TLS) standards for encryption and secure authentication with passwords and certificates. This is the same standard used on many shopping, banking, and other sites that require secure communication.

Besides allowing a standard, secure event-logging protocol, SDEE also guarantees delivery of log messages. SDEE uses TCP for the transport protocol. It is also a pull method, meaning that the monitoring station pulls event logs from the device, just as your web browser pulls information from a web server. Syslog and SNMP, on the other hand, are push methods, meaning that they blindly fire event logs onto the network, without knowing whether they reach their destination.

Currently, SDEE is widely used by Cisco for all network IDS and IPS logs. Other vendors have committed to using it. Contact your IDS/IPS vendor to see whether it has implemented SDEE in its devices.

Continue reading here: Rules

Was this article helpful?

+6 -1

Related Posts

Readers' Questions

  • ansegar
    What is sdee, and what do we use it for?
    4 days ago
    • SDEE stands for Security Device Event Exchange, which is a standard format used for exchanging security event information between security devices and management systems. It was defined by the Security Working Group of the Internet Engineering Task Force (IETF) in order to enable interoperability and ease of integration between various security products. SDEE provides a structured format for security devices such as firewalls, intrusion detection systems (IDS), and antivirus systems to send event notifications and log data to a central management system. The management system can use this information for activities such as real-time monitoring, analysis, reporting, and generating alerts. Some common use cases of SDEE include:
    1. Security Incident Monitoring: SDEE allows security devices to send event data to a central system where security analysts can monitor and respond to potential security incidents.
    2. Log Aggregation and Analysis: SDEE enables the collection of logs from multiple security devices into a single location, making it easier to analyze security events and perform forensic investigations.
    3. Alert Generation and Notification: Security devices can use SDEE to generate alerts based on predefined rules, and the management system can receive and notify appropriate personnel about potential threats or policy violations.
    4. Centralized Policy Management: SDEE facilitates the exchange of security policies between management systems and security devices, allowing for centralized policy management and configuration.Overall, SDEE streamlines the communication and management of security events between different security devices and management systems, enhancing the overall security posture of an organization.