MITRE has this thing called "CEE" - Common Event Expression.
CEE is a failure because, while claiming to be a standards effort, it maximizes incompatibility between implementations by doing the following:
- poorly describes multiple serialization formats, requires none of them. This ensures maximum incompatibility in event serialization
- defines requirements for log transport protocols, but does not describe an actual protocol. This ensures maximum protocol incompatibility
- naming style inconsistencies This ensures confusion