In May of 2011, some of my standards work on normalizing how systems generate security events and alarms was adopted into MITRE’s Common Event Expression Architecture Overview.