Agenda for Misuse Detection Project Meeting
Thursday 28-August-97, 10am - 12pm

Review agenda. Select a timekeeper.
Adage & Pledge (0:30) Chris
  available here: Adage

Prepare for Susan's visit on Sep 9 (0:20) Chris
    statement of work

Countermeasures update (0:10) Scott

Policy specfications (0:30) Chris
    a quick review and wrap up of last week's meeting

Topics for next agenda (0:10)
    Susan's visit
    any deliverables left to discuss

28-August-97 Meeting Notes, 10:00am - 12:00pm

Attendees: Chris, Kathy, Brant, Scott

Adage & Pledge (0:30) Chris
    will discuss next week, perhaps

Prepare for Susan's visit on Sep 9 (0:20) Chris
    Susan will arrive on Sept 8th.
    Meeting will commence on Sept 9th.

Countermeasures update (1:15) Scott
    -Several reviews of experiments were discussed, as was the plans for 
     new experiments.
    -Possible new tool to develop or research: prefilter auditing system 
     for users/etc... (stuff not included with NT)
    -Hashii Marks strives to answer these questions:
     What impact does NT auditing have on the system?
     How much CPU is used for each type of audit class logged?
     What is the size of different stored audit events? 
     (a structure is composed of many length fields) 
    -To audit a system: we'd like to find out the events and types of 
     applications that are commonly used.
Policy specfications (0:30) Chris
    not discussed.

Topics for next agenda (0:10)
    Karl's presentation of Cuppen's paper?