alert being triggered.

 There can be only one godfather for a particular host. This avoids contention
 between godfathers in case a child is down. If more godfathers for a host, are
 required to improve security, then an appropriate protocol has to be
 implemented to handle contention.

 There can be multiple children for a godfather.

 A hierarchical arrangement of godfathers should be avoided. A hierarchical
 arrangement of godfathers would let an attack proceed in an ordered manner,
 by starting at the hierarchical top of the system and then moving down
 through the children.

 The EGIDEM architecture consists of a cell configuration file. This file

determines which hosts on the network are parts of the same cell. It also marks the host

that is the godfather of the current host, and the host(s) that are the children of the current

host.

 The message format in the original GIDEM Architecture used the carat sign for

parameter separation. The Extended Architecture message format uses spaces for the

same.

 3.4 Rule Syntax

 A rule is a mapping between the events reported by intrusion detection sensors

and actions that need to be taken when those events are reported. Actions can be as

simple as mailing the system administrator, or may be more complicated, in which

several agents are fired to further monitor the system, or launch a response. The Extended

GIDEM architecture supports dynamic rule base modifications, in which the actions can

specify updating the rule base with rules from remote hosts. The rule syntax for the

Extended GIDEM Architecture is the same as the original rule syntax described in

Gandre [10].