<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"PKO Bank Polski Rg";
panose-1:2 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Tekst dymka Znak";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
span.Stylwiadomocie-mail17
{mso-style-type:personal-compose;
font-family:"PKO Bank Polski Rg";
color:black;
font-weight:normal;
font-style:normal;}
span.TekstdymkaZnak
{mso-style-name:"Tekst dymka Znak";
mso-style-priority:99;
mso-style-link:"Tekst dymka";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:39400892;
mso-list-type:hybrid;
mso-list-template-ids:-1757107880 68485137 68485145 68485147 68485135 68485145 68485147 68485135 68485145 68485147;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="PL" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">Hi,<br>
I’ve been searching for Audit documentation and stumbled upon following conversation:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><a href="http://www.redhat.com/archives/linux-audit/2006-September/msg00081.html">http://www.redhat.com/archives/linux-audit/2006-September/msg00081.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">Has anything changed since 2006?
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">I need to write set of rules to correlate audit events from many systems. Following information would be very useful:<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><![if !supportLists]><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><span style="mso-list:Ignore">1)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">Event formats - What fields will be generated for particular event type? Which fields are common to all event types? What type of data will
be in those fields (binary/encoded/ASCII/UNICODE)? What do those fields describe?<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><![if !supportLists]><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><span style="mso-list:Ignore">2)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">For all event types - description when (in what circumstances) are generated events of this type<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><![if !supportLists]><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><span style="mso-list:Ignore">3)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">How do DAC event types relate to AVC (which fields are common, which are not)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">Arkadiusz Wojtczak<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">Ekspert<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black;mso-fareast-language:PL"><img border="0" width="290" height="62" id="Obraz_x0020_1" src="cid:image001.png@01CFFF52.E9321B50"></span><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">PKO Bank Polski<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">Departament Bezpieczeństwa<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">Biuro Bezpieczeństwa Informatycznego<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">02-515 Warszawa, ul. Puławska 15<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">t: 22 521 68 80<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black">k: 666 824 168<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"PKO Bank Polski Rg";color:#329632">Nie drukuj tej wiadomości, ani innych dokumentów, jeśli nie jest to konieczne.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"PKO Bank Polski Rg";color:#5A5A5A">Powszechna Kasa Oszczędności Bank Polski Spółka Akcyjna z siedzibą w Warszawie przy ul. Puławskiej 15, 02-515 Warszawa, zarejestrowana w Sądzie Rejonowym dla m.st.
Warszawy w Warszawie, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego pod nr KRS 0000026438; NIP: 525-000-77-38 REGON: 016298263; kapitał zakładowy (kapitał wpłacony) 1 250 000 000 PLN /</span><span style="font-size:8.0pt;font-family:"PKO Bank Polski Rg";color:#969696">
Powszechna Kasa Oszczędności Bank Polski S.A. registered in the District Court for the Capital City of Warsaw, 13th Commercial Division of the National Court Register under KRS number 0000026438, Tax Identification Number (NIP): 525-000-77-38, REGON: 016298263,
share capital 1,250,000,000 PLN.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"PKO Bank Polski Rg";color:#5A5A5A">Niniejsza wiadomość może zawierać poufną i prawnie zastrzeżoną korespondencję między naszą Firmą i Klientem. Jeżeli nie jesteście Państwo jej adresatem informujemy,
że otrzymali ją Państwo omyłkowo oraz, że przeglądanie, rozpowszechnianie lub kopiowanie jest zabronione. W przypadku omyłkowego otrzymania niniejszej wiadomości, prosimy o niezwłoczne powiadomienie o tym nadawcy i wykasowanie oryginału. /</span><span style="font-size:8.0pt;font-family:"PKO Bank Polski Rg";color:#969696">
This message may contain a confidential and privileged our Company and Client communication. If you are not the intended recipient, you are hereby notified that you have received this message in error - any review, distribution or copying of this message is
strictly prohibited. If you have received this message in error, please notify the sender immediately and delete the original.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"PKO Bank Polski Rg";color:black"><o:p> </o:p></span></p>
</div>
</body>
</html>