Canonical Event Log Format

This specification for the Canonical Event Log covers three layers: a single top-level Information Model, possibly multiple encoding layers, and multiple content layers. This specification provides a single information model for representing a Canonical Event Log Record that can encapsulate native Event Log Records from various sources. This specification also provides a simple Type-Length-Value (TLV) encoding, a Concise Binary Object Representation (CBOR) encoding, and a JSON encoding. This specification covers encapsulation of some content layers, including CEL Management, PCCLIENT [2] and IMA [5] content. While a content layer implementation may choose to create an exact binary mapping to this information model as its native Event Log Record, other implementations may choose to bind this information model to other formats, such as TLV or CBOR.