Certainly true, CADF is a good format for auditing events, but in implementation the several I've used seen, support most of it, and make some subtle changes. T

Certainly true, CADF is a good format for auditing events, but in implementation the several I've used seen, support most of it, and make some subtle changes. That divergence causes it to be a mostly standardized format which might as well be a non-standradized format, involving mappings, etc.