RFC 7970
The Incident Object Description Exchange Format Version 2
Part 1 of 30 🎀
The Incident Object Description Exchange Format Version 2 ✨
Okay bestie, let's start with the basics 🦋 This is RFC 7970, published in November 2016 under the Internet Engineering Task Force (IETF) 👑 It's a Standards Track document, so it's the real deal, not a suggestion 💅 It was written by R. Danyliw from CERT, and its ISSN is 2070-1721 if you're collecting these 🧚
The big news is that it obsoletes RFC 5070 and RFC 6685, so those are officially retired now 💀 Periodt.
Abstract 🌸
Okay so IODEF stands for the Incident Object Description Exchange Format, and it's a data representation for security incident reports and indicators. Ops security teams swap these around for mitigation and for watch and warning 🔥 This doc describes an updated information model for IODEF and gives you a matching data model written in XML schema ✨ This new information and data model obsoletes RFCs 5070 and 6685, so it's a whole glow-up 💖
Status of This Memo 🧚
This is an Internet Standards Track document.
This doc is a product of the IETF, and it represents the consensus of the IETF community 🫶 It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 7841.
Info about the current status of this document, any errata, and how to give feedback lives here:
http://www.rfc-editor.org/info/rfc7970
Copyright Notice 🌈
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at http://trustee.ietf.org/license-info, as they were in effect on the date this document was published. Please read these carefully, because they spell out your rights and restrictions for this document 📜 Code Components extracted from this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They're provided without warranty, as described in the Simplified BSD License.
This document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. The person or people controlling the copyright in some of that material may not have granted the IETF Trust the right to allow modifications of it outside the IETF Standards Process. So unless you get an adequate license from whoever controls that copyright, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process 🙈 The exceptions are formatting it for publication as an RFC or translating it into languages other than English.
Table of Contents 📚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 6
1.2. Notations . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3. About the IODEF Data Model . . . . . . . . . . . . . . . 7
1.4. Changes from RFC 5070 . . . . . . . . . . . . . . . . . . 7
2. IODEF Data Types . . . . . . . . . . . . . . . . . . . . . . 9
2.1. Integers . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2. Real Numbers . . . . . . . . . . . . . . . . . . . . . . 9
2.3. Characters and Strings . . . . . . . . . . . . . . . . . 9
2.4. Multilingual Strings . . . . . . . . . . . . . . . . . . 9
2.5. Binary Strings . . . . . . . . . . . . . . . . . . . . . 10
2.5.1. Base64 Bytes . . . . . . . . . . . . . . . . . . . . 10
2.5.2. Hexadecimal Bytes . . . . . . . . . . . . . . . . . . 11
2.6. Enumerated Types . . . . . . . . . . . . . . . . . . . . 11
2.7. Date-Time String . . . . . . . . . . . . . . . . . . . . 11
2.8. Timezone String . . . . . . . . . . . . . . . . . . . . . 11
2.9. Port Lists . . . . . . . . . . . . . . . . . . . . . . . 11
2.10. Postal Address . . . . . . . . . . . . . . . . . . . . . 12
2.11. Telephone Number . . . . . . . . . . . . . . . . . . . . 12
2.12. Email String . . . . . . . . . . . . . . . . . . . . . . 12
2.13. Uniform Resource Locator Strings . . . . . . . . . . . . 12
2.14. Identifiers and Identifier References . . . . . . . . . . 12
2.15. Software . . . . . . . . . . . . . . . . . . . . . . . . 13
2.15.1. SoftwareReference Class . . . . . . . . . . . . . . 14
2.16. Extension . . . . . . . . . . . . . . . . . . . . . . . . 15
3. The IODEF Information Model . . . . . . . . . . . . . . . . . 18
3.1. IODEF-Document Class . . . . . . . . . . . . . . . . . . 18
3.2. Incident Class . . . . . . . . . . . . . . . . . . . . . 20
3.3. Common Attributes . . . . . . . . . . . . . . . . . . . . 23
3.3.1. restriction Attribute . . . . . . . . . . . . . . . . 23
3.3.2. observable-id Attribute . . . . . . . . . . . . . . . 25
3.4. IncidentID Class . . . . . . . . . . . . . . . . . . . . 25
3.5. AlternativeID Class . . . . . . . . . . . . . . . . . . . 26
3.6. RelatedActivity Class . . . . . . . . . . . . . . . . . . 27
3.7. ThreatActor Class . . . . . . . . . . . . . . . . . . . . 28
3.8. Campaign Class . . . . . . . . . . . . . . . . . . . . . 29
3.9. Contact Class . . . . . . . . . . . . . . . . . . . . . . 30
3.9.1. RegistryHandle Class . . . . . . . . . . . . . . . . 34
3.9.2. PostalAddress Class . . . . . . . . . . . . . . . . . 35
3.9.3. Email Class . . . . . . . . . . . . . . . . . . . . . 36
3.9.4. Telephone Class . . . . . . . . . . . . . . . . . . . 37
3.10. Discovery Class . . . . . . . . . . . . . . . . . . . . . 38
3.10.1. DetectionPattern Class . . . . . . . . . . . . . . . 40
3.11. Method Class . . . . . . . . . . . . . . . . . . . . . . 41
3.11.1. Reference Class . . . . . . . . . . . . . . . . . . 42
3.12. Assessment Class . . . . . . . . . . . . . . . . . . . . 43
3.12.1. SystemImpact Class . . . . . . . . . . . . . . . . . 45
3.12.2. BusinessImpact Class . . . . . . . . . . . . . . . . 48
3.12.3. TimeImpact Class . . . . . . . . . . . . . . . . . . 50
3.12.4. MonetaryImpact Class . . . . . . . . . . . . . . . . 52
3.12.5. Confidence Class . . . . . . . . . . . . . . . . . . 53
3.13. History Class . . . . . . . . . . . . . . . . . . . . . . 54
3.13.1. HistoryItem Class . . . . . . . . . . . . . . . . . 54
3.14. EventData Class . . . . . . . . . . . . . . . . . . . . . 57
3.14.1. Relating the Incident and EventData Classes . . . . 59
3.14.2. Recursive Definition of EventData . . . . . . . . . 59
3.15. Expectation Class . . . . . . . . . . . . . . . . . . . . 60
3.16. Flow Class . . . . . . . . . . . . . . . . . . . . . . . 63
3.17. System Class . . . . . . . . . . . . . . . . . . . . . . 64
3.18. Node Class . . . . . . . . . . . . . . . . . . . . . . . 67
3.18.1. Address Class . . . . . . . . . . . . . . . . . . . 68
3.18.2. NodeRole Class . . . . . . . . . . . . . . . . . . . 69
3.18.3. Counter Class . . . . . . . . . . . . . . . . . . . 73
3.19. DomainData Class . . . . . . . . . . . . . . . . . . . . 75
3.19.1. Nameservers Class . . . . . . . . . . . . . . . . . 77
3.19.2. DomainContacts Class . . . . . . . . . . . . . . . . 78
3.20. Service Class . . . . . . . . . . . . . . . . . . . . . . 79
3.20.1. ServiceName Class . . . . . . . . . . . . . . . . . 80
3.20.2. ApplicationHeader Class . . . . . . . . . . . . . . 81
3.21. EmailData Class . . . . . . . . . . . . . . . . . . . . . 82
3.22. Record Class . . . . . . . . . . . . . . . . . . . . . . 83
3.22.1. RecordData Class . . . . . . . . . . . . . . . . . . 84
3.22.2. RecordPattern Class . . . . . . . . . . . . . . . . 85
3.23. WindowsRegistryKeysModified Class . . . . . . . . . . . . 87
3.23.1. Key Class . . . . . . . . . . . . . . . . . . . . . 88
3.24. CertificateData Class . . . . . . . . . . . . . . . . . . 89
3.24.1. Certificate Class . . . . . . . . . . . . . . . . . 90
3.25. FileData Class . . . . . . . . . . . . . . . . . . . . . 90
3.25.1. File Class . . . . . . . . . . . . . . . . . . . . . 91
3.26. HashData Class . . . . . . . . . . . . . . . . . . . . . 92
3.26.1. Hash Class . . . . . . . . . . . . . . . . . . . . . 94
3.26.2. FuzzyHash Class . . . . . . . . . . . . . . . . . . 95
3.27. SignatureData Class . . . . . . . . . . . . . . . . . . . 95
3.28. IndicatorData Class . . . . . . . . . . . . . . . . . . . 96
3.29. Indicator Class . . . . . . . . . . . . . . . . . . . . . 96
3.29.1. IndicatorID Class . . . . . . . . . . . . . . . . . 99
3.29.2. AlternativeIndicatorID Class . . . . . . . . . . . . 100
3.29.3. Observable Class . . . . . . . . . . . . . . . . . . 101
3.29.4. IndicatorExpression Class . . . . . . . . . . . . . 106
3.29.5. Expressions with IndicatorExpression . . . . . . . . 108
3.29.6. ObservableReference Class . . . . . . . . . . . . . 110
3.29.7. IndicatorReference Class . . . . . . . . . . . . . . 110
3.29.8. AttackPhase Class . . . . . . . . . . . . . . . . . 111
4. Processing Considerations . . . . . . . . . . . . . . . . . . 112
4.1. Encoding . . . . . . . . . . . . . . . . . . . . . . . . 112
4.2. IODEF Namespace . . . . . . . . . . . . . . . . . . . . . 112
4.3. Validation . . . . . . . . . . . . . . . . . . . . . . . 112
4.4. Incompatibilities with v1 . . . . . . . . . . . . . . . . 113
5. Extending the IODEF . . . . . . . . . . . . . . . . . . . . . 114
5.1. Extending the Enumerated Values of Attributes . . . . . . 114
5.1.1. Private Extension of Enumerated Values . . . . . . . 114
5.1.2. Public Extension of Enumerated Values . . . . . . . . 115
5.2. Extending Classes . . . . . . . . . . . . . . . . . . . . 115
5.3. Deconflicting Private Extensions . . . . . . . . . . . . 117
6. Internationalization Issues . . . . . . . . . . . . . . . . . 118
7. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 119
7.1. Minimal Example . . . . . . . . . . . . . . . . . . . . . 119
7.2. Indicators from a Campaign . . . . . . . . . . . . . . . 120
8. The IODEF Data Model (XML Schema) . . . . . . . . . . . . . . 121
9. Security Considerations . . . . . . . . . . . . . . . . . . . 161
9.1. Security . . . . . . . . . . . . . . . . . . . . . . . . 161
9.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . . . 162
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 163
10.1. Namespace and Schema . . . . . . . . . . . . . . . . . . 163
10.2. Enumerated Value Registries . . . . . . . . . . . . . . 163
10.3. Expert Review of IODEF-Related XML Registry Entries . . 166
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 167
11.1. Normative References . . . . . . . . . . . . . . . . . . 167
11.2. Informative References . . . . . . . . . . . . . . . . . 170
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 171
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 172Part 2 of 30 is coming next, so stay tuned, bestie 💜
1. Introduction ✨
Okay so, organizations need help from other people to fight off malicious activity aimed at their networks and to actually understand what threats are out there. 🕵️♀️ That help can look like working with an ISP to filter attack traffic, contacting a remote site to take down a botnet, or sharing watch lists of known bad indicators within a consortium. It's giving teamwork, bestie. 🫶
The Incident Object Description Exchange Format (IODEF) is a format for representing computer security information that gets shared between Computer Security Incident Response Teams (CSIRTs) and other operational security teams. 🦋 It gives you an XML representation for conveying:
- indicators that characterize a threat;
- security incident reports that document attacks against an organization;
- response activity that was taken, or that could be taken, in response to an incident; and
- metadata, so that all of these different kinds of information can be exchanged between parties.
The whole point of the IODEF is to level up what CSIRTs can do operationally 💅. Adopting it should make it easier for a CSIRT to resolve security incidents, understand threats, and coordinate response activities and proactive mitigations, because collaborating and sharing data with partners gets so much simpler. This structured format allows for:
- machine-to-machine exchange of incident and indicator data;
- automated processing of this data, which allows for faster execution of appropriate courses of action; and
- the development of an ecosystem of interoperable tools that enable security operations.
Sharing and coordinating with other orgs is not strictly a technical problem 😭. There are plenty of procedural, cultural, legal, and trust-related barriers to get past. The IODEF does not try to address those directly, but operational implementations of the IODEF will need to think about these challenges. 🙈
Section 1 gives the background for the IODEF. Sections 3 and 8 specify the IODEF information and data model, respectively. The data types used in this document are described in Section 2. Processing considerations, extending the specification, internationalization, and security issues are covered in Sections 4, 5, 6, and 9, respectively. Examples are listed in Section 7. 🌸
1.1. Terminology
The key words "MUST," "MUST NOT," "REQUIRED," "SHALL," "SHALL NOT," "SHOULD," "SHOULD NOT," "RECOMMENDED," "MAY," and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 📌
1.2. Notations
The IODEF is specified as an Extensible Markup Language (XML) [W3C.XML] schema [W3C.SCHEMA]. The normative IODEF data model is found in the XML schema in Section 8. To help you understand the data elements, Section 3 also depicts the underlying information model using Unified Modeling Language (UML). This abstract presentation of the IODEF is not normative. 🧚
For clarity, the term "XML document" is used when we're talking generically about any instance of an XML document. The term "IODEF document" refers to an XML document that conforms to the IODEF specification. The term "schema" refers to Section 8 of this document. The terms "data model" and "schema" are used interchangeably. The terms "class" and "element" reference either the corresponding data element in the UML-based information model or the XML schema-based data model, respectively. 💜
1.3. About the IODEF Data Model
A bunch of considerations went into designing the IODEF data model, and they're honestly so iconic 👑.
- The data model in this document is an evolution of the one previously specified in [RFC5070]. New fields were added to represent additional information. [RFC5070] was developed mainly to represent incident reports. This document builds on it by adding support for indicators and revising it to reflect the current challenges CSIRTs face. An attempt was made to preserve backward compatibility, but that wasn't possible in every case. See Section 4.4. This document obsoletes [RFC5070].
- The IODEF is a transport format. Therefore, the data model may not be the optimal archival or in-memory processing format.
- The IODEF is meant to be a framework that conveys only commonly exchanged information. It makes sure there are mechanisms for extensibility to support organization-specific information, and techniques to reference information kept outside of the data model.
- Not all commonly exchanged information has a well-defined format or taxonomy. The IODEF tries to strike a balance between enforcing enough structure to allow automated processing and supporting free-form content that gives maximum flexibility. ⚖️
- The IODEF fits into a broader ecosystem of standards and conventions. An attempt was made to harmonize the data model with that context. 🌈
1.4. Changes from RFC 5070
Here's the detailed list of additions made to the data model in [RFC5070] 📝. For a list of incompatible changes, see Section 4.4.
- Updated the data types (Section 2) to improve internationalization, clarify ambiguity, and ensure consistency in extensions.
- Added the observable-id attribute (Section 3.3.2) and IndicatorData class (Section 3.28) to represent indicators.
- Added the private-enum-name and private-enum-id attributes to the IODEF-Document class (Section 3.1) to disambiguate private extensions.
- Updated the Incident class (Section 3.2) to represent additional timing and workflow information.
- Added the ThreatActor (Section 3.7) and Campaign (Section 3.8) classes to represent attack attribution information.
- Updated the Contact class (Section 3.9) and its children to improve internationalization and represent additional information about an entity.
- Updated the Method class (Section 3.11) to improve extensibility through externally referenced resources.
- Added the Discovery class (Section 3.10) to describe how an incident was discovered.
- Updated the Assessment class (Section 3.12) to enable more descriptive characterizations of the impact of an incident.
- Updated the HistoryItem (Section 3.13.1) and Expectation (Section 3.15) classes to support a reference to a course of action.
- Updated the EventData class (Section 3.14) with additional metadata added to the Incident class.
- Updated the System class (Section 3.17) with additional metadata.
- Updated the Counter class (Section 3.18.3) to support additional rate metrics.
- Added DomainData (Section 3.19), EmailData (Section 3.21), WindowsRegistryKeysModified (Section 3.23), CertificateData (Section 3.24), and FileData (Section 3.25) classes to improve the description of an incident and support this data as indicators.
- Added the SignatureData (Section 3.27) and HashData (Section 3.26) classes to represent digital signatures and hashes.
- Added support for public enumerated attribute extensions using IANA registries (Section 5.1.2).
- Updated numerous enumerated attributes for completeness.
2. IODEF Data Types 💖
The IODEF uses a bunch of simple and complex types. This section walks through them one by one 🎀.
2.1. Integers
An integer is represented in the information model by the INTEGER data type. Integer data MUST be encoded in Base 10. 🔢
The INTEGER data type is implemented in the data model as an "xs:integer" type per Section 3.3.13 of [W3C.SCHEMA.DTYPES].
2.2. Real Numbers
A real (floating-point) number is represented in the information model by the REAL data type. Real data MUST be encoded in Base 10. ✨
The REAL data type is implemented in the data model as an "xs:float" type per Section 3.2.4 of [W3C.SCHEMA.DTYPES].
2.3. Characters and Strings
A single character is represented in the information model by the CHARACTER data type. A string is represented by the STRING data type. Special characters MUST be encoded using entity references. See Section 4.1. 🧁
The CHARACTER and STRING data types are implemented in the data model as an "xs:string" type per Section 3.2.1 of [W3C.SCHEMA.DTYPES].
2.4. Multilingual Strings
A string that needs to be represented in a human-readable language that's different from the default encoding of the document is represented in the information model by the ML_STRING data type. 🌍
The ML_STRING data type is implemented in the data model as the "iodef:MLStringType" type. This type extends the "xs:string" to include two attributes.
+------------------------+
| iodef:MLStringType |
+------------------------+
| xs:string |
| |
| ENUM xml:lang |
| STRING translation-id |
+------------------------+
Figure 1: The iodef:MLStringType TypeThe content of the class is a character string of type "xs:string" whose language MAY be specified by the xml:lang attribute.
The attributes of the iodef:MLStringType type are:
xml:lang: Optional. ENUM. A language identifier per Section 2.12 of [W3C.XML] whose values and format are described in [RFC5646]. The interpretation of this code is described in Section 6.translation-id: Optional. STRING. An identifier to relate other instances of this class with the same parent as translations of this text. The scope of this identifier is limited to all of the direct, peer child classes of a given parent class.
Using this class lets you represent translations of the same text in multiple languages 🌏. Each translation is a distinct instance of this class with a common parent. A group of classes that each hold a translated instance of text is related by setting a common identifier in the translation-id attribute. The language of a given class is set by the xml:lang attribute. See Section 6 for more details on representing translations of free-form text.
2.5. Binary Strings
Binary octets can be represented with two encodings. 🦄
2.5.1. Base64 Bytes
A binary octet encoded with base64 is represented in the information model by the BYTE data type. A sequence of these octets is of the BYTE[] data type.
The BYTE and BYTE[] data types are implemented in the data model as an "xs:base64Binary" type per Section 3.2.16 of [W3C.SCHEMA.DTYPES].
2.5.2. Hexadecimal Bytes
A binary octet encoded as a character tuple consisting of two hexadecimal digits is represented in the information model by the HEXBIN data type. A sequence of these octets is of the HEXBIN[] data type.
The HEXBIN and HEXBIN[] data types are implemented in the data model as an "xs:hexBinary" type per Section 3.2.15 of [W3C.SCHEMA.DTYPES].
2.6. Enumerated Types
An enumerated type is represented in the information model by the ENUM data type. It's an ordered list of acceptable string values, and each value has a representative keyword. Within the data model, the enumerated type keywords are used as attribute values. 📋
The ENUM data type is implemented in the data model as values of an "xs:NMTOKEN" type per Section 3.3.4 of [W3C.SCHEMA.DTYPES].
2.7. Date-Time String
A date-time string that describes a particular instant in time is represented in the information model by the DATETIME data type. Ranges are not supported. ⏰
The DATETIME data type is implemented in the data model as an "xs:dateTime" type per Section 3.2.7 of [W3C.SCHEMA.DTYPES].
2.8. Timezone String 🌍
Timezone offsets from UTC get the TIMEZONE data type, and it's formatted according to this regex: "Z|[\+\-](0[0-9]|1[0-4]):[0-5][0-9]" ⏰. In the data model it's the iodef:TimezoneType type.
2.9. Port Lists 🔌
A list of network ports is the PORTLIST data type ✨. A PORTLIST is a comma-separated list of numbers and ranges, where N-M means ports N through M, inclusive. It's formatted according to the regex "\d+(\-\d+)?(,\d+(\-\d+)?)*". For example, "2,5-15,30,32,40-50,55-60" 💜. In the data model it's the iodef:PortlistType type.
2.10. Postal Address 📮
Postal addresses use the POSTAL data type. Its format is documented in Section 2.23 of [RFC4519] as a free-form multi-line string separated by the $ character 🏠. In the data model it's the iodef:MLStringType type.
2.11. Telephone Number 📞
Telephone numbers use the PHONE data type, and its format is documented in [E.164] 🌸. In the data model it's an xs:string type per Section 3.2.1 of [W3C.SCHEMA.DTYPES].
2.12. Email String 💌
Email addresses use the EMAIL data type 💅. Its format is documented in Section 3.4.1 of [RFC5322] and Section 3.3 of [RFC6531]. In the data model it's an xs:string type per Section 3.2.1 of [W3C.SCHEMA.DTYPES].
2.13. Uniform Resource Locator Strings 🔗
A uniform resource locator (URL) is represented by the URL data type, and its format is documented in [RFC3986] 🦋. In the implementation it's an xs:anyURI type per Section 3.2.17 of [W3C.SCHEMA.DTYPES].
2.14. Identifiers and Identifier References 🪪
An identifier that's unique to the IODEF document uses the ID data type. A reference back to that identifier uses the IDREF data type 🔁. In the model they're implemented as xs:ID and xs:IDREF types per Sections 3.3.8 and 3.3.9 of [W3C.SCHEMA.DTYPES].
2.15. Software 💻
A particular version of software uses the SOFTWARE data type 👑. It can be described with a reference, a URL, or free-form text. In the data model it's the iodef:SoftwareType type.
+--------------------+
| iodef:SoftwareType |
+--------------------+
| |<>--{0..1}--[ SoftwareReference ]
| |<>--{0..*}--[ URL ]
| |<>--{0..*}--[ Description ]
+--------------------+Figure 2: The SoftwareType Type
The aggregate classes of the SoftwareType type are:
SoftwareReference: Zero or one. A reference to a software application. See Section 2.15.1.URL: Zero or more. A URL. It points to a resource that describes the software.Description: Zero or more.ML_STRING. A free-form text description of the software.
At least one of these classes MUST be present. 🚨
The iodef:SoftwareType type has no attributes.
2.15.1. SoftwareReference Class 🧾
The SoftwareReference class is a reference to a particular version of software ✨.
+----------------------+
| SoftwareReference |
+----------------------+
| xs:any |
| |
| ENUM spec-name |
| STRING ext-spec-name |
| ENUM dtype |
| STRING ext-dtype |
+----------------------+Figure 3: The SoftwareReference Class
The element content changes depending on the value of the spec-name attribute 🔀. It's defined in the data model as xs:any per [W3C.SCHEMA].
The attributes of the SoftwareReference class are:
spec-name: Required. ENUM. This identifies the format and semantics of the element body of this class. Formal standards and specifications can be referenced, and so can a free-form text description with a user-provided data type. These values are maintained in the "SoftwareReference-spec-id" IANA registry per Section 10.2.custom. The element content is free-form and of the data type specified by thedtypeattribute. If this value is selected, then thedtypeattribute MUST be set.cpe. The element content describes a Common Platform Enumeration (CPE) entry per [NIST.CPE].swid. The element content describes a software identification (SWID) tag per [ISO19770].ext-value. A value that shows this attribute is extended, with the actual value given in the correspondingext-*attribute. See Section 5.1.1.
ext-spec-name: Optional. STRING. A way to extend thespec-nameattribute. See Section 5.1.1.dtype: Optional. ENUM. The data type of the element content. The permitted values are listed below, and the default value is "string". These values are maintained in the "SoftwareReference-dtype" IANA registry per Section 10.2.bytes. The element content is of type HEXBIN.integer. The element content is of type INTEGER.real. The element content is of type REAL.string. The element content is of type STRING.xml. The element content is XML. See Section 5.2.ext-value. A value that shows this attribute is extended, with the actual value given in the correspondingext-*attribute. See Section 5.1.1.
ext-dtype: Optional. STRING. A way to extend thedtypeattribute. See Section 5.1.1.
2.16. Extension 🎁
Anything that the IODEF doesn't already represent can be added with the EXTENSION data type 🌈. It's a generic extension mechanism. In the data model it's the iodef:ExtensionType type.
The data type of an EXTENSION is described by the dtype attribute 💖. For simple info, atomic data types like integers and strings are supported, and their meaning is described further by the meaning and formatid attributes. Encapsulated XML documents that follow another schema are also supported. There's a detailed discussion of extending the schema in Section 5. Extra coordination might be needed so that a recipient of a document using this type can parse and process it 🫶.
+------------------------+
| iodef:ExtensionType |
+------------------------+
| xs:any |
| |
| STRING name |
| ENUM dtype |
| STRING ext-dtype |
| STRING meaning |
| STRING formatid |
| ENUM restriction |
| STRING ext-restriction |
| ID observable-id |
+------------------------+Figure 4: The iodef:ExtensionType Type
The element content of this type is the extension being added to the data model. This content is defined in the data model as xs:any per [W3C.SCHEMA].
The attributes of the iodef:ExtensionType type are:
name: Optional. STRING. A free-form name of the field or data element.dtype: Required. ENUM. The data type of the element content. The default value is "string". These values are maintained in the "ExtensionType-dtype" IANA registry per Section 10.2.boolean. The element content is of type BOOLEAN.byte. The element content is of type BYTE.bytes. The element content is of type HEXBIN.character. The element content is of type CHARACTER.date-time. The element content is of type DATETIME.ntpstamp. Same asdate-time.integer. The element content is of type INTEGER.portlist. The element content is of type PORTLIST.real. The element content is of type REAL.string. The element content is of type STRING.file. The element content is a base64-encoded binary file, encoded as a BYTE[] type.path. The element content is a file-system path, encoded as a STRING type.frame. The element content is a Layer 2 frame, encoded as a HEXBIN type.packet. The element content is a Layer 3 packet, encoded as a HEXBIN type.ipv4-packet. The element content is an IPv4 packet, encoded as a HEXBIN type.ipv6-packet. The element content is an IPv6 packet, encoded as a HEXBIN type.url. The element content is of type URL.csv. The element content is a comma-separated value (CSV) list per Section 2 of [RFC4180], encoded as a STRING type.winreg. The element content is a Microsoft Windows registry key, encoded as a STRING type.xml. The element content is XML. See Section 5.2.ext-value. A value that shows this attribute is extended, with the actual value given in the correspondingext-*attribute. See Section 5.1.1.
ext-dtype: Optional. STRING. A way to extend thedtypeattribute. See Section 5.1.1.meaning: Optional. STRING. A free-form text description of the element content.formatid: Optional. STRING. An identifier that references the format or semantics of the element content.restriction: Optional. ENUM. See Section 3.3.1.ext-restriction: Optional. STRING. A way to extend therestrictionattribute. See Section 5.1.1.observable-id: Optional. ID. See Section 3.3.2.
3. The IODEF Information Model 🧠
Time to dig into the specifics of the IODEF information model 🦋. Each class and how it relates to the other classes gets described here. Where needed, this section clarifies how to translate this information model into the schema in Section 8 💜.
3.1. IODEF-Document Class 💖
Okay bestie, the IODEF-Document class is the top level class in the whole IODEF data model 👑. Every single IODEF document is an instance of this class 🫶.
+--------------------------+
| IODEF-Document |
+--------------------------+
| STRING version |<>--{1..*}--[ Incident ]
| ENUM xml:lang |<>--{0..*}--[ AdditionalData ]
| STRING format-id |
| STRING private-enum-name |
| STRING private-enum-id |
+--------------------------+Figure 5: The IODEF-Document Class
So here's what hangs off of it 🧚
Incident: One or more. The info about a single incident. See Section 3.2.AdditionalData: Zero or more. EXTENSION. This is the way you extend the data model, so it's giving customization 🌈
And the attributes 💅
version: Required. STRING. This is the IODEF spec version the document follows. The value of this attribute MUST be "2.00" 🎀xml:lang: Optional. ENUM. A language identifier per Section 2.12 of [W3C.XML], and its values and form are described in [RFC5646]. How this code gets interpreted is covered in Section 6 🌸format-id: Optional. STRING. A free-form string that carries processing instructions for whoever receives the document. Its semantics must be negotiated out of band 🦋private-enum-name: Optional. STRING. A globally unique identifier for the CSIRT that made the document, so private extensions don't clash. The fully qualified domain name (FQDN) of the CSIRT MUST be used as the identifier. See Section 5.3 💜private-enum-id: Optional. STRING. An organizationally unique identifier for an extension used in the document. If this attribute is set, theprivate-enum-nameMUST also be set. See Section 5.3 🔥
3.2. Incident Class ✨
The Incident class is where the tea lives 🍓 It holds the commonly shared info when you're reporting or sharing derived analysis from security incidents.
+-------------------------+
| Incident |
+-------------------------+
| ENUM purpose |<>----------[ IncidentID ]
| STRING ext-purpose |<>--{0..1}--[ AlternativeID ]
| ENUM status |<>--{0..*}--[ RelatedActivity ]
| STRING ext-status |<>--{0..1}--[ DetectTime ]
| ENUM xml:lang |<>--{0..1}--[ StartTime ]
| ENUM restriction |<>--{0..1}--[ EndTime ]
| STRING ext-restriction |<>--{0..1}--{ RecoveryTime ]
| ID observable-id |<>--{0..1}--[ ReportTime ]
| |<>----------[ GenerationTime ]
| |<>--{0..*}--[ Description ]
| |<>--{0..*} [ Discovery ]
| |<>--{0..*}--[ Assessment ]
| |<>--{0..*}--[ Method ]
| |<>--{1..*}--[ Contact ]
| |<>--{0..*}--[ EventData ]
| |<>--{0..1}--[ IndicatorData ]
| |<>--{0..1}--[ History ]
| |<>--{0..*}--[ AdditionalData ]
+-------------------------+Figure 6: The Incident Class
Here are the aggregate classes, the things it's made of 🧁
IncidentID: One. An incident tracking number given to this incident by the CSIRT that generated the IODEF document. See Section 3.4.AlternativeID: Zero or one. The tracking numbers other CSIRTs use to refer to the same incident. See Section 3.5.RelatedActivity: Zero or more. Related activity and attribution of that activity. See Section 3.6.DetectTime: Zero or one. DATETIME. When the incident was first detected.StartTime: Zero or one. DATETIME. When the incident started.EndTime: Zero or one. DATETIME. When the incident ended.RecoveryTime: Zero or one. DATETIME. When the site recovered from the incident.ReportTime: Zero or one. DATETIME. When the incident was reported.GenerationTime: One. DATETIME. When the content in this Incident class was generated.Description: Zero or more. ML_STRING. A free-form text description of the incident.Discovery: Zero or more. How this incident got detected. See Section 3.10.Assessment: Zero or more. A characterization of the impact of the incident. See Section 3.12.Method: Zero or more. The techniques the threat actor used in the incident. See Section 3.11.Contact: One or more. Contact info for the parties involved. See Section 3.9.EventData: Zero or more. A description of the events that make up the incident. See Section 3.14.IndicatorData: Zero or one. Indicators from the analysis of an incident. See Section 3.28.History: Zero or one. A log of significant events or actions that happened while handling the incident. See Section 3.13.AdditionalData: Zero or more. EXTENSION. The way to extend the data model 🌟
And now the attributes, the main character details 🎀
purpose: Required. ENUM. This tells you the reason the info in this class was documented. It's closely related to the Expectation class (Section 3.15). These values are maintained in the "Incident-purpose" IANA registry per Section 10.2. It's an enumerated list:traceback. The incident was sent for trace-back purposes.mitigation. The incident was sent to request aid in mitigating the described activity.reporting. The incident was sent to comply with reporting requirements.watch. The incident was sent to convey indicators that should be monitored.other. The incident was sent for purposes specified in the Expectation class.ext-value. A value that shows this attribute is extended, with the actual value given in the matchingext-*attribute. See Section 5.1.1.
ext-purpose: Optional. STRING. A way to extend thepurposeattribute. See Section 5.1.1.status: Optional. ENUM. This shows the workflow state the incident is currently in. These values are maintained in the "Incident-status" IANA registry per Section 10.2. It's an enumerated list:new. The incident is newly reported, and no action has been taken.in-progress. The incident is under investigation.forwarded. The incident has been forwarded to another party for handling.resolved. The investigation into the activity in this incident has concluded.future. The described activity has not yet been detected.ext-value. A value that shows this attribute is extended, with the actual value given in the matchingext-*attribute. See Section 5.1.1.
ext-status: Optional. STRING. A way to extend thestatusattribute. See Section 5.1.1.xml:lang: Optional. ENUM. A language identifier per Section 2.12 of [W3C.XML], and its values and form are described in [RFC5646]. How this code gets interpreted is covered in Section 6.restriction: Optional. ENUM. See Section 3.3.1. The default value is "private".ext-restriction: Optional. STRING. A way to extend therestrictionattribute. See Section 5.1.1.observable-id: Optional. ID. See Section 3.3.2.
3.3. Common Attributes 🦋
There are a bunch of attributes that keep showing up across the information model, so they get their own section here 🌸
3.3.1. restriction Attribute 🔒
The restriction attribute tells the recipient what disclosure guidelines the sender expects them to follow for the info in this class and its children. Lowkey, this guideline provides no security, since there are no technical means to make sure the recipient handles the info the way the sender asked 💀
The value of this attribute is logically inherited by the children of this class. That is to say, the disclosure rules for this class also apply to its children 🫶
You can set a granular disclosure policy, since all of the high-level classes (the children of the Incident class) have a restriction attribute. So a child can override its parent's guidelines, either to restrict them or relax them. For example, a child could have a weaker policy than an ancestor, or an ancestor could have a weak policy while the children selectively apply stricter controls 👑 The implicit value of restriction for a class that didn't specify one can be found in the closest ancestor that did specify a value.
This attribute is an enumerated value with a default of "private". The default is only defined in the context of the Incident class. In other classes where this attribute is used, no default is specified 🧚
These values are maintained in the "Restriction" IANA registry per Section 10.2.
public. The information can be freely distributed without restriction.partner. The information may be shared within a closed community of peers, partners, or affected parties, but cannot be openly published.need-to-know. The information may be shared only within the organization, with individuals that have a need to know.private. The information may not be shared.default. The information can be shared according to an information disclosure policy pre-arranged by the communicating parties.white. Same as 'public'.green. Same as 'partner'.amber. Same as 'need-to-know'.red. Same as 'private'.ext-value. A value that shows this attribute is extended, with the actual value given in the matchingext-*attribute. See Section 5.1.1.
3.3.2. observable-id Attribute 🍓
The observable-id attribute tags info in the document as an observable, so it can be referenced later when describing an indicator. Its value is a unique identifier within the scope of the document. The ObservableReference class uses it to enumerate observables when an indicator is defined with the IndicatorData class 🔥
3.4. IncidentID Class 🎀
okay so the IncidentID class is basically a tracking number that's unique within a CSIRT 🔍 It can identify an incident, or act as a document identifier when you're sharing indicators. Think of it as an index key into a CSIRT's incident handling or knowledge management system 🗂️✨
The name attribute plus the string in the element content MUST be a globally unique identifier describing the activity 💖 And documents from a given CSIRT MUST NOT reuse the same value unless they're referencing the same incident. no double-booking, bestie 💅
+------------------------+
| IncidentID |
+------------------------+
| STRING |
| |
| STRING name |
| STRING instance |
| ENUM restriction |
| STRING ext-restriction |
+------------------------+Figure 7: The IncidentID Class
The content of the class is an incident identifier of type STRING 🧚
The attributes of the IncidentID class are:
name: Required.STRING. An identifier describing the CSIRT that created the document. To get a globally unique CSIRT name, the fully qualified domain name associated with the CSIRT MUST be used 🌐👑instance: Optional.STRING. An identifier referencing a subset of the named incident 🌸restriction: Optional.ENUM. See Section 3.3.1 🔒ext-restriction: Optional.STRING. A means by which to extend the restriction attribute. See Section 5.1.1 🦋
3.5. AlternativeID Class 🌈
the AlternativeID class is where you list the tracking numbers other CSIRTs use for the exact same activity described in the IODEF document 🤝 so if a tracking number is listed here, it's referencing the same incident that another CSIRT detected. and the tracking numbers of the CSIRT that generated the IODEF document must never be considered an AlternativeID. that one's a hard no 🙅♀️
+------------------------+
| AlternativeID |
+------------------------+
| ENUM restriction |<>--{1..*}--[ IncidentID ]
| STRING ext-restriction |
+------------------------+Figure 8: The AlternativeID Class
The aggregate class of the AlternativeID class is:
IncidentID: One or more. The tracking number of another CSIRT. See Section 3.4 🧁
The attributes of the AlternativeID class are:
restriction: Optional.ENUM. See Section 3.3.1 🔐ext-restriction: Optional.STRING. A means by which to extend the restriction attribute. See Section 5.1.1 ✨
3.6. RelatedActivity Class 👑
the RelatedActivity class is the connect-the-dots class 🕸️ It links everything in the rest of the document to previously observed incidents or activity, and lets you attribute stuff to a specific actor or campaign. main character energy, honestly 💜
+------------------------+
| RelatedActivity |
+------------------------+
| ENUM restriction |<>--{0..*}--[ IncidentID ]
| STRING ext-restriction |<>--{0..*}--[ URL ]
| |<>--{0..*}--[ ThreatActor ]
| |<>--{0..*}--[ Campaign ]
| |<>--{0..*}--[ IndicatorID ]
| |<>--{0..1}--[ Confidence ]
| |<>--{0..*}--[ Description ]
| |<>--{0..*}--[ AdditionalData ]
+------------------------+Figure 9: The RelatedActivity Class
The aggregate classes of the RelatedActivity class are:
IncidentID: Zero or more. The tracking number of a related incident. See Section 3.4 🔗URL: Zero or more.URL. A URL to activity related to this incident 🌍ThreatActor: Zero or more. The threat actor to whom the incident activity is attributed. See Section 3.7 😈Campaign: Zero or more. The campaign of a given threat actor to whom the described activity is attributed. See Section 3.8 🎯IndicatorID: Zero or more. A reference to a related indicator. See Section 3.4 🪪Confidence: Zero or one. An estimate of the confidence in attributing this RelatedActivity to the events described in the document. See Section 3.12.5 📊Description: Zero or more.ML_STRING. A description of how these relationships were derived 📝AdditionalData: Zero or more.EXTENSION. A mechanism by which to extend the data model 🧩
The RelatedActivity class MUST have at least one instance of any of the following child classes: IncidentID, URL, ThreatActor, Campaign, Description, or AdditionalData. no empty shells allowed, periodt 🙅♀️💅
The attributes of the RelatedActivity class are:
restriction: Optional.ENUM. See Section 3.3.1 🔒ext-restriction: Optional.STRING. A means by which to extend the restriction attribute. See Section 5.1.1 🦋
3.7. ThreatActor Class 😈
the ThreatActor class describes a threat actor. that's it, that's the whole vibe 🫶
+------------------------+
| ThreatActor |
+------------------------+
| ENUM restriction |<>--{0..*}--[ ThreatActorID ]
| STRING ext-restriction |<>--{0..*}--[ URL ]
| |<>--{0..*}--[ Description ]
| |<>--{0..*}--[ AdditionalData ]
+------------------------+Figure 10: The ThreatActor Class
The aggregate classes of the ThreatActor class are:
ThreatActorID: Zero or more.STRING. An identifier for the threat actor 🆔URL: Zero or more.URL. A URL to a reference describing the threat actor 🌐Description: Zero or more.ML_STRING. A description of the threat actor 📝AdditionalData: Zero or more.EXTENSION. A mechanism by which to extend the data model 🧩
The ThreatActor class MUST have at least one instance of a child class. 🌸
The attributes of the ThreatActor class are:
restriction: Optional.ENUM. See Section 3.3.1 🔒ext-restriction: Optional.STRING. A means by which to extend the restriction attribute. See Section 5.1.1 ✨
3.8. Campaign Class 🎯
the Campaign class describes a campaign of attacks run by a threat actor 💥 it's the "what were they up to over time" part of the story 📖
+------------------------+
| Campaign |
+------------------------+
| ENUM restriction |<>--{0..*}--[ CampaignID ]
| STRING ext-restriction |<>--{0..*}--[ URL ]
| |<>--{0..*}--[ Description ]
| |<>--{0..*}--[ AdditionalData ]
+------------------------+Figure 11: The Campaign Class
The aggregate classes of the Campaign class are:
CampaignID: Zero or more.STRING. An identifier for the campaign 🪪URL: Zero or more.URL. A URL to a reference describing the campaign 🌍Description: Zero or more.ML_STRING. A description of the campaign 📝AdditionalData: Zero or more.EXTENSION. A mechanism by which to extend the data model 🧩
The Campaign class MUST have at least one instance of a child class. 💜
The attributes of the Campaign class are:
restriction: Optional.ENUM. See Section 3.3.1 🔒ext-restriction: Optional.STRING. A means by which to extend the restriction attribute. See Section 5.1.1 🦋
3.9. Contact Class 💌✨
okay so the Contact class is where we tell people WHO is involved in the incident and how to reach them 📞 it lets us name the party, give their contact info, and say what role they play in the whole thing 🎀
people and organizations are treated the same way here, bestie 🫶 you can link one to the other because the Contact class is aggregated into the Contact class (yes, it contains itself, iconic 🔁). the type attribute tells you which kind of contact you're looking at
the recursive setup is lowkey genius 🧠 it means you don't have to use explicit identifiers or copy the same data over and over. a complete point of contact comes from walking down a path from the root Contact class to a leaf Contact class, and each child logically inherits the contact info from its ancestors 🌳💅
+------------------------+
| Contact |
+------------------------+
| ENUM role |<>--{0..*}--[ ContactName ]
| STRING ext-role |<>--{0..*}--[ ContactTitle ]
| ENUM type |<>--{0..*}--[ Description ]
| STRING ext-type |<>--{0..*}--[ RegistryHandle ]
| ENUM restriction |<>--{0..*}--[ PostalAddress ]
| STRING ext-restriction |<>--{0..*}--[ Email ]
| |<>--{0..*}--[ Telephone ]
| |<>--{0..1}--[ Timezone ]
| |<>--{0..*}--[ Contact ]
| |<>--{0..*}--[ AdditionalData ]
+------------------------+
Figure 12: The Contact Classthese are the aggregate classes that live inside a Contact 🎁
- ContactName: Zero or more. ML_STRING. The name of the contact. It can be an organization or a person, and the
typeattribute is what tells them apart 👀 - ContactTitle: Zero or more. ML_STRING. The title of the individual named in the ContactName 💼
- Description: Zero or more. ML_STRING. A free-form text description of the contact 📝
- RegistryHandle: Zero or more. A handle name into the registry of the contact. See Section 3.9.1 🗂️
- PostalAddress: Zero or more. The postal address of the contact. See Section 3.9.2 🏡
- Email: Zero or more. The email address of the contact. See Section 3.9.3 📧
- Telephone: Zero or more. The telephone number of the contact. See Section 3.9.4 ☎️
- Timezone: Zero or one. TIMEZONE. The timezone where the contact lives 🌍
- Contact: Zero or more. A recursive definition of the Contact class. You can use it to group shared data for multiple points of contact, and it's especially handy when you're listing several contacts at the same organization 🏢🫶
- AdditionalData: Zero or more. EXTENSION. A way to extend the data model 🧩
at least one of those aggregate classes MUST be present in an instance of the Contact class. no empty contacts allowed, bestie 🙅♀️
these are the attributes of the Contact class 💅
- role: Required. ENUM. Says what role the contact plays. These values are maintained in the "Contact-role" IANA registry per Section 10.2 👑
creator. The entity that generates the document.reporter. The entity that reported the information.admin. An administrative contact or business owner for an asset or organization.tech. An entity responsible for the day-to-day management of technical issues for an asset or organization.provider. An external hosting provider for an asset.user. An end-user of an asset or part of an organization.billing. An entity responsible for billing issues for an asset or organization.legal. An entity responsible for legal issues related to an asset or organization.irt. An entity responsible for handling security issues for an asset or organization.abuse. An entity responsible for handling abuse originating from an asset or organization.cc. An entity that is to be kept informed about the events related to an asset or organization.cc-irt. A CSIRT or information-sharing organization coordinating activity related to an asset or organization.leo. A law enforcement organization supporting the investigation of activity affecting an asset or organization.vendor. The vendor that produces an asset.vendor-support. A vendor that provides services.victim. A victim in the incident.victim-notified. A victim in the incident who has been notified.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
- ext-role: Optional. STRING. A way to extend the role attribute. See Section 5.1.1 🦋
- type: Required. ENUM. Says what kind of contact is being described. It's an enumerated list, and the values are maintained in the "Contact-type" IANA registry per Section 10.2 🎀
person. The information for this contact references an individual.organization. The information for this contact references an organization.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
- ext-type: Optional. STRING. A way to extend the type attribute. See Section 5.1.1 🌸
- restriction: Optional. ENUM. See Section 3.3.1 🔒
- ext-restriction: Optional. STRING. A way to extend the restriction attribute. See Section 5.1.1 ✨
3.9.1. RegistryHandle Class 🗂️
the RegistryHandle class is a handle into an Internet registry or a community-specific database. it's basically a little pointer to where you can look someone up 🔍
+---------------------+
| RegistryHandle |
+---------------------+
| STRING |
| |
| ENUM registry |
| STRING ext-registry |
+---------------------+
Figure 13: The RegistryHandle Classthe content of the class is a handle into a registry, and it's a STRING 🧾
these are the attributes of the RegistryHandle class 💜
- registry: Required. ENUM. The database the handle belongs to. These values are maintained in the "RegistryHandle-registry" IANA registry per Section 10.2. The possible values are:
internic. Internet Network Information Centerapnic. Asia Pacific Network Information Centerarin. American Registry for Internet Numberslacnic. Latin American and Caribbean Internet Addresses Registryripe. Reseaux IP Europeensafrinic. African Network Information Centerlocal. A database local to the CSIRText-value. A value used to indicate that this attribute is extended and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
- ext-registry: Optional. STRING. A way to extend the registry attribute. See Section 5.1.1 🌈
3.9.2. PostalAddress Class 🏡
the PostalAddress class specifies a postal address plus some annotation about it 📮
+--------------------+
| PostalAddress |
+--------------------+
| ENUM type |<>----------[ PAddress ]
| STRING ext-type |<>--{0..*}--[ Description ]
+--------------------+
Figure 14: The PostalAddress Classthese are the aggregate classes of the PostalAddress class 🎁
- PAddress: One. POSTAL. A postal address.
- Description: Zero or more. ML_STRING. A free-form text description of the address 📝
these are the attributes of the PostalAddress class 💅
- type: Optional. ENUM. Categorizes the type of address described in the PAddress class. These values are maintained in the "PostalAddress-type" IANA registry per Section 10.2.
street. An address describing a physical location.mailing. An address to which correspondence should be sent.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
- ext-type: Optional. STRING. A way to extend the type attribute. See Section 5.1.1 🦋
3.9.3. Email Class 📧
the Email class specifies an email address plus its annotation 💌
+--------------------+
| Email |
+--------------------+
| ENUM type |<>----------[ EmailTo ]
| STRING ext-type |<>--{0..*}--[ Description ]
+--------------------+
Figure 15: The Email Classthese are the aggregate classes of the Email class 🎀
- EmailTo: One. EMAIL. An email address.
- Description: Zero or more. ML_STRING. A free-form text description of the email address 📝
these are the attributes of the Email class 💜
- type: Optional. ENUM. Categorizes the type of email address described in the EmailTo class. These values are maintained in the "Email-type" IANA registry per Section 10.2.
direct. An email address of an individual.hotline. An email address regularly monitored for operational purposes.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
- ext-type: Optional. STRING. A way to extend the type attribute. See Section 5.1.1 🌸
3.9.4. Telephone Class ☎️
the Telephone class describes a phone number plus its annotation 📞
+--------------------+
| Telephone |
+--------------------+
| ENUM type |<>----------[ TelephoneNumber ]
| STRING ext-type |<>--{0..*}--[ Description ]
+--------------------+
Figure 16: The Telephone Classthese are the aggregate classes of the Telephone class 🎁
- TelephoneNumber: One. PHONE. A telephone number.
- Description: Zero or more. ML_STRING. A free-form text description of the phone number 📝
these are the attributes of the Telephone class 🌷
- type: Optional. ENUM. Categorizes the type of telephone number described in the TelephoneNumber class. These values are maintained in the "Telephone-type" IANA registry per Section 10.2.
wired. A number of a wire-line (land-line) phone.mobile. A number of a mobile phone.fax. A number to a fax machine.hotline. A number to a regularly monitored operational hotline.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
- ext-type: Optional. STRING. A way to extend the type attribute. See Section 5.1.1 ✨
3.10. Discovery Class ✨
okay so the Discovery class is all about how an incident got detected 🕵️♀️🔍 bestie, it's giving detective era 💅
+------------------------+
| Discovery |
+------------------------+
| ENUM source |<>--{0..*}--[ Description ]
| STRING ext-source |<>--{0..*}--[ Contact ]
| ENUM restriction |<>--{0..*}--[ DetectionPattern ]
| STRING ext-restriction |
+------------------------+
Figure 17: The Discovery Classthe aggregate classes that live inside Discovery are:
Description zero or more 💬. ML_STRING. a free-form text description of how this incident was detected. the story of the catch, basically 🧚
Contact zero or more 📇. contact info for the party that discovered the incident. see Section 3.9 🎀
DetectionPattern zero or more 🧩. describes an application-specific configuration that detected the incident. see Section 3.10.1 💖
and the attributes of Discovery are:
source optional 🌸. ENUM. categorizes the techniques used to discover the incident. these values are partially derived from Table 3-1 of [NIST800.61rev2] 📚. they're maintained in the "Discovery-source" IANA registry per Section 10.2 🫶
- nidps. Network Intrusion Detection or Prevention System 🛡️
- hips. Host-based Intrusion Prevention System 💻
- siem. Security Information and Event Management System 📊
- av. Antivirus or antispam software 🦠
- third-party-monitoring. Contracted third-party monitoring service 🤝
- incident. The activity was discovered while investigating an unrelated incident 🔎
- os-log. Operating system logs 🖥️
- application-log. Application logs 📝
- device-log. Network device logs 🔌
- network-flow. Network flow analysis 🌊
- passive-dns. Passive DNS analysis 🌐
- investigation. Manual investigation initiated based on notification of a new vulnerability or exploit 🧐
- audit. Security audit 📋
- internal-notification. A party within the organization reported the activity 🏠
- external-notification. A party outside of the organization reported the activity 🌍
- leo. A law enforcement organization notified the victim organization 👮♀️
- partner. A customer or business partner reported the activity to the victim organization 🤝✨
- actor. The threat actor directly or indirectly reported this activity to the victim organization 😈
- unknown. Unknown detection approach 🫥
- ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1 🧩
ext-source optional 🌈. STRING. a means by which to extend the source attribute. see Section 5.1.1 ✨
restriction optional 🔒. ENUM. see Section 3.3.1 💜
ext-restriction optional 🎀. STRING. a means by which to extend the restriction attribute. see Section 5.1.1 🦋
3.10.1. DetectionPattern Class 🧩
the DetectionPattern class describes a configuration or signature that can be used by an Intrusion Detection System (IDS) / Intrusion Prevention System (IPS), SIEM, antivirus, endpoint protection, network analysis, malware analysis, or host forensics tool to identify a particular phenomenon 🔍💖. this class requires the identification of the target application and allows the configuration to be described in either free form or machine-readable form 🫶
+------------------------+
| DetectionPattern |
+------------------------+
| ENUM restriction |<>----------[ Application ]
| STRING ext-restriction |<>--{0..*}--[ Description ]
| ID observable-id |<>--{0..*}--[ DetectionConfiguration ]
+------------------------+
Figure 18: The DetectionPattern Classthe aggregate classes of DetectionPattern are:
Application one 🎯. SOFTWARE. the application for which the DetectionConfiguration or Description is being provided 💻
Description zero or more 💬. ML_STRING. a free-form text description of how to use the information provided in the Application or DetectionConfiguration classes 📖
DetectionConfiguration zero or more ⚙️. STRING. a machine-consumable configuration to find a pattern of activity 🤖
ok this next part is the big rule 🚨: an instance of either the Description or DetectionConfiguration class MUST be present 💅
and the attributes of DetectionPattern are:
restriction optional 🔒. ENUM. see Section 3.3.1 💜
ext-restriction optional 🎀. STRING. a means by which to extend the restriction attribute. see Section 5.1.1 🦋
observable-id optional 🆔. ID. see Section 3.3.2 ✨
3.11. Method Class 🗝️
the Method class describes the tactics, techniques, procedures, or weakness used by the threat actor in an incident 😈🌸. this class is made of both a list of references describing the attack methods and weaknesses and a free-form text description 📚
+------------------------+
| Method |
+------------------------+
| ENUM restriction |<>--{0..*}--[ Reference ]
| STRING ext-restriction |<>--{0..*}--[ Description ]
| |<>--{0..*}--[ sci:AttackPattern ]
| |<>--{0..*}--[ sci:Vulnerability ]
| |<>--{0..*}--[ sci:Weakness ]
| |<>--{0..*}--[ AdditionalData ]
+------------------------+
Figure 19: The Method Classthe aggregate classes of Method are:
Reference zero or more 🔗. a reference to a vulnerability, malware sample, advisory, or analysis of an attack technique. see Section 3.11.1 📎
Description zero or more 💬. ML_STRING. a free-form text description of techniques, tactics, or procedures used by the threat actor 🕸️
sci:AttackPattern zero or more 🗡️. a reference to a pattern of attack or exploitation per [RFC7203] 💥
sci:Vulnerability zero or more 🐛. a reference to a vulnerability per [RFC7203] 🔓
sci:Weakness zero or more 🪤. a reference to the exploited weakness per [RFC7203] 🕳️
AdditionalData zero or more ➕. EXTENSION. a mechanism by which to extend the data model 🧩
ok the rule here 🚨: an instance of one of these children MUST be present 💖
and the attributes of Method are:
restriction optional 🔒. ENUM. see Section 3.3.1 💜
ext-restriction optional 🎀. STRING. a means by which to extend the restriction attribute. see Section 5.1.1 🦋
3.11.1. Reference Class 📎
the Reference class is an external reference to relevant information such as a vulnerability, IDS alert, malware sample, advisory, or attack technique 🔗✨
+-------------------------+
| Reference |
+-------------------------+
| ID observable-id |<>--{0..1}--[ enum:ReferenceName ]
| |<>--{0..*}--[ URL ]
| |<>--{0..*}--[ Description ]
+-------------------------+
Figure 20: The Reference Classthe aggregate classes of Reference are:
enum:ReferenceName zero or one 🏷️. reference identifier per [RFC7495] 🪪
URL zero or more 🌐. URL. a URL to a reference 🔗
Description zero or more 💬. ML_STRING. a free-form text description of this reference 📖
at least one of these classes MUST be present 💅
the attribute of Reference is:
observable-id optional 🆔. ID. see Section 3.3.2 ✨
3.12. Assessment Class 📊
the Assessment class describes the repercussions of the incident to the victim 💀🫶
+-------------------------+
| Assessment |
+-------------------------+
| ENUM occurrence |<>--{0..*}--[ IncidentCategory ]
| ENUM restriction |<>--{0..*}--[ SystemImpact ]
| STRING ext-restriction |<>--{0..*}--[ BusinessImpact ]
| ID observable-id |<>--{0..*}--[ TimeImpact ]
| |<>--{0..*}--[ MonetaryImpact ]
| |<>--{0..*}--[ IntendedImpact ]
| |<>--{0..*}--[ Counter ]
| |<>--{0..*}--[ MitigatingFactor ]
| |<>--{0..*}--[ Cause ]
| |<>--{0..1}--[ Confidence ]
| |<>--{0..*}--[ AdditionalData ]
+-------------------------+
Figure 21: The Assessment Classthe aggregate classes of Assessment are:
IncidentCategory zero or more 🗂️. ML_STRING. a free-form text description categorizing the type of incident 🏷️
SystemImpact zero or more 💻. a technical characterization of the impact of the incident activity on the victim's enterprise. see Section 3.12.1 ⚡
BusinessImpact zero or more 🏢. impact of the incident activity on the business functions of the victim organization. see Section 3.12.2 💼
TimeImpact zero or more ⏰. a characterization of the victim organization due to the incident activity as a function of time. see Section 3.12.3 🕰️
MonetaryImpact zero or more 💸. the financial loss due to the incident activity. see Section 3.12.4 💰
IntendedImpact zero or more 🎯. the intended outcome to the victim sought by the threat actor. defined identically to the BusinessImpact defined in Section 3.12.2 but describes intent rather than the realized impact 🧠
Counter zero or more 🔢. a counter with which to summarize the magnitude of the activity. see Section 3.18.3 📈
MitigatingFactor zero or more 🛟. ML_STRING. a description of a mitigating factor relative to the impact on the victim organization 🌷
Cause zero or more 🔍. ML_STRING. a description of an underlying cause of the impact 🧐
Confidence zero or one 💯. an estimate of confidence in the impact assessment. see Section 3.12.5 ✨
AdditionalData zero or more ➕. EXTENSION. a mechanism by which to extend the data model 🧩
ok this one's a big deal 🚨: at least one instance of the possible five impact classes (i.e., SystemImpact, BusinessImpact, TimeImpact, MonetaryImpact, or IntendedImpact) MUST be present 😭💖
and the attributes of Assessment are:
occurrence optional 🌙. ENUM. specifies whether the assessment is describing actual or potential outcomes 🔮
- actual. this assessment describes activity that has occurred 📍
- potential. this assessment describes potential activity that might occur 🌤️
restriction optional 🔒. ENUM. see Section 3.3.1 💜
ext-restriction optional 🎀. STRING. a means by which to extend the restriction attribute. see Section 5.1.1 🦋
observable-id optional 🆔. ID. see Section 3.3.2 ✨
that's the Discovery, Method, and Assessment classes done, bestie 🌈💅
3.12.1. SystemImpact Class ✨
okay so the SystemImpact class is where we describe what the incident actually did to the systems on the network 💻🔥
+-----------------------+
| SystemImpact |
+-----------------------+
| ENUM severity |<>--{0..*}--[ Description ]
| ENUM completion |
| ENUM type |
| STRING ext-type |
+-----------------------+Figure 22: The SystemImpact Class 🎀
bestie, here's the aggregate class of SystemImpact:
Description Zero or more. ML_STRING. A free-form text description of the impact to the system. 📝
and the attributes of SystemImpact are:
severity Optional. ENUM. This is an estimate of how severe the activity was, relative to other activity. The permitted values are below, and there's no default value 🌸
low. Low severitymedium. Medium severityhigh. High severity
completion Optional. ENUM. This tells you whether the described activity worked. The permitted values are below, and there's no default value ✨
failed. The attempted activity was not successful.succeeded. The attempted activity succeeded.
type Required. ENUM. This one classifies the impact, and it's giving main character energy 👑 The permitted values are below. The default value is "unknown". These values are maintained in the "SystemImpact-type" IANA registry per Section 10.2. 🦋
takeover-account. Control was taken of a given account.takeover-service. Control was taken of a given service.takeover-system. Control was taken of a given system.cps-manipulation. A cyber-physical system was manipulated.cps-damage. A cyber-physical system was damaged.availability-data. Access to particular data was degraded or denied.availability-account. Access to an account was degraded or denied.availability-service. Access to a service was degraded or denied.availability-system. Access to a system was degraded or denied.damaged-system. Hardware on a system was irreparably damaged.damaged-data. Data on a system was deleted.breach-proprietary. Sensitive or proprietary information was accessed or exfiltrated.breach-privacy. Personally identifiable information was accessed or exfiltrated.breach-credential. Credential information was accessed or exfiltrated.breach-configuration. System configuration or data inventory was accessed or exfiltrated.integrity-data. Data on the system was modified.integrity-configuration. Application or system configuration was modified.integrity-hardware. Firmware of a hardware component was modified.traffic-redirection. Network traffic on the system was redirected.monitoring-traffic. Network traffic emerging from a host or enclave was monitored.monitoring-host. System activity (e.g., running processes, keystrokes) was monitored.policy. Activity violated the system owner's acceptable use policy.unknown. The impact is unknown.ext-value. A value used to indicate that this attribute is extended, and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1. 🧩
ext-type Optional. STRING. This is the way you extend the type attribute when none of the values above fit. See Section 5.1.1. 💅
3.12.2. BusinessImpact Class
the BusinessImpact class is the "how bad did this hurt the org as a whole" one 🏢💔 It describes and characterizes how far the incident knocked out the organization's functions.
+-------------------------+
| BusinessImpact |
+-------------------------+
| ENUM severity |<>--{0..*}--[ Description ]
| STRING ext-severity |
| ENUM type |
| STRING ext-type |
+-------------------------+Figure 23: The BusinessImpact Class 🌈
the aggregate class of BusinessImpact:
Description Zero or more. ML_STRING. A free-form text description of the impact to the organization. 📝
and the attributes:
severity Optional. ENUM. This characterizes how severe the incident was for business functions. The permitted values are below. They were derived from Table 3-2 of [NIST800.61rev2]. The default value is "unknown". These values are maintained in the "BusinessImpact-severity" IANA registry per Section 10.2. 📊
none. No effect to the organization's ability to provide all services to all users.low. Minimal effect, as the organization can still provide all critical services to all users but has lost efficiency.medium. The organization has lost the ability to provide a critical service to a subset of system users.high. The organization is no longer able to provide some critical services to any users.unknown. The impact is not known.ext-value. A value used to indicate that this attribute is extended, and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
ext-severity Optional. STRING. This is how you extend the severity attribute. See Section 5.1.1. ✨
type Required. ENUM. This characterizes the effect the incident had on the business. The permitted values are below. The default value is "unknown". These values are maintained in the "BusinessImpact-type" IANA registry per Section 10.2. 💼
breach-proprietary. Sensitive or proprietary information was accessed or exfiltrated.breach-privacy. Personally identifiable information was accessed or exfiltrated.breach-credential. Credential information was accessed or exfiltrated.loss-of-integrity. Sensitive or proprietary information was changed or deleted.loss-of-service. Service delivery was disrupted.theft-financial. Money was stolen.theft-service. Services were misappropriated.degraded-reputation. The reputation of the organization's brand was diminished.asset-damage. A cyber-physical system was damaged.asset-manipulation. A cyber-physical system was manipulated.legal. The incident resulted in legal or regulatory action.extortion. The incident resulted in actors extorting the victim organization.unknown. The impact is unknown.ext-value. A value used to indicate that this attribute is extended, and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
ext-type Optional. STRING. This is how you extend the type attribute. See Section 5.1.1. 🎀
3.12.3. TimeImpact Class
the TimeImpact class is the clock check ⏰😭 It describes the impact of the incident on an organization as a function of time, so it's the spot for conveying down time and recovery time.
+---------------------+
| TimeImpact |
+---------------------+
| REAL |
| |
| ENUM severity |
| ENUM metric |
| STRING ext-metric |
| ENUM duration |
| STRING ext-duration |
+---------------------+Figure 24: The TimeImpact Class 🦋
the content of this class is of type REAL and specifies an amount of time. The duration attribute gives the units for that content, and the metric attribute explains what the content is measuring. so the number alone isn't enough, you need both of those to make sense of it 🧠✨
the attributes of TimeImpact are:
severity Optional. ENUM. An estimate of how severe the activity was, relative to other activity. The permitted values are below, and there's no default value. 🌸
low. Low severitymedium. Medium severityhigh. High severity
metric Required. ENUM. This defines the meaning of the value in the element content. These values are maintained in the "TimeImpact-metric" IANA registry per Section 10.2. 📏
labor. Total staff time to recovery from the activity (e.g., 2 employees working 4 hours each would be 8 hours).elapsed. Elapsed time from the beginning of the recovery to its completion (i.e., wall-clock time).downtime. Duration of time for which some provided service(s) was not available.ext-value. A value used to indicate that this attribute is extended, and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
ext-metric Optional. STRING. This is how you extend the metric attribute. See Section 5.1.1. 💖
duration Optional. ENUM. This defines the unit of time for the value in the element content. The default value is "hour". These values are maintained in the "TimeImpact-duration" IANA registry per Section 10.2. ⏳
second. The unit of the element content is seconds.minute. The unit of the element content is minutes.hour. The unit of the element content is hours.day. The unit of the element content is days.month. The unit of the element content is months.quarter. The unit of the element content is quarters.year. The unit of the element content is years.ext-value. A value used to indicate that this attribute is extended, and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
ext-duration Optional. STRING. This is how you extend the duration attribute. See Section 5.1.1. 🫶
3.12.4. MonetaryImpact Class
the MonetaryImpact class is all about the 💸 money 💸 side of things. It describes the financial impact of the activity on an organization. For example, this impact might count losses from the cost of the investigation or recovery, diminished staff productivity, or a tarnished reputation that makes future opportunities harder to get. ugh, the reputation hit is so real 😭
+------------------+
| MonetaryImpact |
+------------------+
| REAL |
| |
| ENUM severity |
| STRING currency |
+------------------+Figure 25: The MonetaryImpact Class 💜
the content of this class is of type REAL and specifies a quantity of money. The currency attribute defines which currency that value is in 💵
the attributes of MonetaryImpact are:
severity Optional. ENUM. An estimate of how severe the activity was, relative to other activity. The permitted values are below, and there's no default value. 🌈
low. Low severitymedium. Medium severityhigh. High severity
currency Optional. STRING. This defines the currency the value in the element content is expressed in. The permitted values are defined in "Codes for the representation of currencies" [ISO4217]. There's no default value. 🍓
3.12.5. Confidence Class 💖
okay so the Confidence class is how we say how much we trust the data in the document 🥺 and it's giving two options: a category, or an actual number ✨
+-------------------+
| Confidence |
+-------------------+
| REAL |
| |
| ENUM rating |
| STRING ext-rating |
+-------------------+
Figure 26: The Confidence Classthe content is a REAL that holds a numerical score, but only when rating is "numeric" 🔢. otherwise this element MUST be empty 🙅♀️
the attributes of Confidence are:
rating: Required. ENUM. a qualitative take on confidence 🎀. these values live in the "Confidence-rating" IANA registry, per Section 10.2- low. Low confidence.
- medium. Medium confidence.
- high. High confidence.
- numeric. The element content contains a number that conveys the confidence of the data. The semantics of this number is outside the scope of this specification.
- unknown. The confidence rating value is not known.
- ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
ext-rating: Optional. STRING. a way to extend theratingattribute 🦋. See Section 5.1.1.
3.13. History Class 📜
the History class is basically a log of the big moments and actions the people involved took while handling the incident 👀
how detailed the log gets is totally up to whoever is handling the incident 💅
+------------------------+
| History |
+------------------------+
| ENUM restriction |<>--{1..*}--[ HistoryItem ]
| STRING ext-restriction |
+------------------------+
Figure 27: The History Classthe aggregate classes of History are:
- HistoryItem: One or more. An entry in the history log of significant events or actions performed by the involved parties. See Section 3.13.1.
the attributes of History are:
restriction: Optional. ENUM. See Section 3.3.1.ext-restriction: Optional. STRING. A way to extend therestrictionattribute. See Section 5.1.1.
3.13.1. HistoryItem Class 🧚
a HistoryItem is one entry in that History (Section 3.13) log 📝. it records one action or event that happened while the incident was being handled. the details are free-form text, but you can tag each one with its type attribute 🏷️
+-------------------------+
| HistoryItem |
+-------------------------+
| ENUM action |<>----------[ DateTime ]
| STRING ext-action |<>--{0..1}--[ IncidentID ]
| ENUM restriction |<>--{0..1}--[ Contact ]
| STRING ext-restriction |<>--{0..*}--[ Description ]
| ID observable-id |<>--{0..*}--[ DefinedCOA ]
| |<>--{0..*}--[ AdditionalData ]
+-------------------------+
Figure 28: The HistoryItem Classthe aggregate classes of HistoryItem are:
- DateTime: One. DATETIME. A timestamp of this entry in the history log.
- IncidentID: Zero or one. In a history log created by multiple parties, the IncidentID provides a mechanism to specify which CSIRT created a particular entry and references this organization's tracking number. When a single organization is maintaining the log, this class can be ignored. See Section 3.4.
- Contact: Zero or one. Provides contact information for the entity that performed the action documented in this class. See Section 3.9.
- Description: Zero or more. ML_STRING. A free-form text description of the action or event.
- DefinedCOA: Zero or more. STRING. An identifier meaningful to the sender and recipient of this document that references a course of action (COA). This class MUST be present if the
actionattribute is set to"defined-coa"🚨. - AdditionalData: Zero or more. EXTENSION. A mechanism by which to extend the data model.
the attributes of HistoryItem are:
action: Required. ENUM. Classifies a performed action or occurrence documented in this history log entry. Activity usually gets kicked off either by a previously conveyed expectation or by an internal investigation, so this attribute is identical to theactionattribute of the Expectation class. The only difference is tense 🕰️. When an action is in this class, it has been completed. See Section 3.15.ext-action: Optional. STRING. A way to extend theactionattribute. See Section 5.1.1.restriction: Optional. ENUM. See Section 3.3.1.ext-restriction: Optional. STRING. A way to extend therestrictionattribute. See Section 5.1.1.observable-id: Optional. ID. See Section 3.3.2.
3.14. EventData Class 🌸
EventData is a container class 🧺. it groups up all the data about the events that happened during an incident.
+-------------------------+
| EventData |
+-------------------------+
| ENUM restriction |<>--{0..*}--[ Description ]
| STRING ext-restriction |<>--{0..1}--[ DetectTime ]
| ID observable-id |<>--{0..1}--[ StartTime ]
| |<>--{0..1}--[ EndTime ]
| |<>--{0..1}--[ RecoveryTime ]
| |<>--{0..1}--[ ReportTime ]
| |<>--{0..*}--[ Contact ]
| |<>--{0..*}--[ Discovery ]
| |<>--{0..1}--[ Assessment ]
| |<>--{0..*}--[ Method ]
| |<>--{0..*}--[ Flow ]
| |<>--{0..*}--[ Expectation ]
| |<>--{0..1}--[ Record ]
| |<>--{0..*}--[ EventData ]
| |<>--{0..*}--[ AdditionalData ]
+-------------------------+
Figure 29: The EventData Classthe aggregate classes of EventData are:
- Description: Zero or more. ML_STRING. A free-form text description of the event.
- DetectTime: Zero or one. DATETIME. The time the event was detected.
- StartTime: Zero or one. DATETIME. The time the event started.
- EndTime: Zero or one. DATETIME. The time the event ended.
- RecoveryTime: Zero or one. DATETIME. The time the site recovered from the event.
- ReportTime: Zero or one. DATETIME. The time the event was reported.
- Contact: Zero or more. Contact information for the parties involved in the event. See Section 3.9.
- Discovery: Zero or more. The means by which the event was detected. See Section 3.10.
- Assessment: Zero or one. The impact of the event on the victim and the actions taken. See Section 3.12.
- Method: Zero or more. The technique used by the threat actor in the event. See Section 3.11.
- Flow: Zero or more. A description of the systems or networks involved. See Section 3.16.
- Expectation: Zero or more. The expected action to be performed by the recipient for the described event. See Section 3.15.
- Record: Zero or one. Supportive data (e.g., log files) that provides additional information about the event. See Section 3.22.
- EventData: Zero or more. A recursive definition of the EventData class. See Section 3.14.2 for an explanation on using this class.
- AdditionalData: Zero or more. EXTENSION. An extension mechanism for data not explicitly represented in the data model.
At least one of the aggregate classes MUST be present in an instance of the EventData class 🫶.
the attributes of EventData are:
restriction: Optional. ENUM. See Section 3.3.1. The default value is"default".ext-restriction: Optional. STRING. A way to extend therestrictionattribute. See Section 5.1.1.observable-id: Optional. ID. See Section 3.3.2.
3.14.1. Relating the Incident and EventData Classes 👯
there's a lot of overlap between the child classes aggregated in Incident and EventData 🙈. but the meanings are super different, honestly. Incident gives the summary for the whole incident, and EventData gives the details for each individual event that makes up the incident 🔍. usually EventData is just the more specific version of what Incident said generally. but if the summary in Incident ever disagrees with the detail in an EventData, the more specific EventData MUST supersede the more generic information in Incident 👑.
3.14.2. Recursive Definition of EventData 🪆
EventData is a container for the properties of an event in an incident 🧃. those properties include things like the hosts involved, the impact the incident activity had on those hosts, forensic logs, and so on. the recursive definition lets you group related information that shares properties 💜. this means you don't need explicit identifiers to link things together, and you don't have to copy anything twice. instead, the relative depth (nesting) of a class does the grouping (relating) for you ✨.
for example, imagine two hosts that had different impacts during an incident, but they share the same contact info 🤝. Figure 30 shows how that gets represented. EventData (2) and (3) each pair one of the hosts with its own impact, and EventData (1) describes the Contact class those two hosts share 🎀.
+------------------+
| EventData (1) |
+------------------+
| |<>----[ Contact ]
| |
| |<>----[ EventData (2) ]<>----[ Flow ]
| | [ ]<>----[ Assessment ]
| |
| |<>----[ EventData (3) ]<>----[ Flow ]
| | [ ]<>----[ Assessment ]
+------------------+
Figure 30: Recursion in the EventData Class3.15. Expectation Class 💌
okay so the Expectation class is basically the sender saying "hey bestie, here's what I'd LOVE you to do about this" 🫶 It tells the recipient which actions the sender is requesting. Main character energy, honestly 💅
+-------------------------+
| Expectation |
+-------------------------+
| ENUM action |<>--{0..*}--[ Description ]
| STRING ext-action |<>--{0..*}--[ DefinedCOA ]
| ENUM severity |<>--{0..1}--[ StartTime ]
| ENUM restriction |<>--{0..1}--[ EndTime ]
| STRING ext-restriction |<>--{0..1}--[ Contact ]
| ID observable-id |
+-------------------------+Figure 31: The Expectation Class 🎀
The aggregate classes of the Expectation class are:
- Description 📝 Zero or more. ML_STRING. A free-form text description of the desired action(s).
- DefinedCOA 🗂️ Zero or more. STRING. A unique identifier meaningful to the sender and recipient of this document that references a course of action. This class MUST be present if the action attribute is set to
defined-coa. - StartTime ⏰ Zero or one. DATETIME. The time at which the sender would like the action performed. A timestamp that is earlier than the ReportTime specified in the Incident class denotes that the sender would like the action performed as soon as possible. The absence of this element indicates no expectations of when the recipient would like the action performed.
- EndTime 🏁 Zero or one. DATETIME. The time by which the sender expects the recipient to complete the action. If the recipient cannot complete the action before EndTime, the recipient MUST NOT carry out the action. Because of transit delays and clock drift, the sender MUST be prepared for the recipient to have carried out the action, even if it completes past EndTime. 😭
- Contact 🧑💻 Zero or one. The entity expected to perform the action. See Section 3.9.
The attributes of the Expectation class are:
- action 🎯 Optional. ENUM. Classifies the type of action requested. The default value of
other. These values are maintained in theExpectation-actionIANA registry per Section 10.2.nothing. No action is requested. Do nothing with the information.contact-source-site. Contact the site(s) identified as the source of the activity.contact-target-site. Contact the site(s) identified as the target of the activity.contact-sender. Contact the originator of the document.investigate. Investigate the system(s) listed in the event.block-host. Block traffic from the machine(s) listed as sources in the event.block-network. Block traffic from the network(s) lists as sources in the event.block-port. Block the port listed as sources in the event.rate-limit-host. Rate-limit the traffic from the machine(s) listed as sources in the event.rate-limit-network. Rate-limit the traffic from the network(s) lists as sources in the event.rate-limit-port. Rate-limit the port(s) listed as sources in the event.redirect-traffic. Redirect traffic from the intended recipient for further analysis.honeypot. Redirect traffic from systems listed in the event to a honeypot for further analysis.upgrade-software. Upgrade or patch the software or firmware on an asset listed in the event.rebuild-asset. Reinstall the operating system or applications on an asset listed in the event.harden-asset. Change the configuration of an asset listed in the event to reduce the attack surface.remediate-other. Remediate the activity in a way other than by rate-limiting or blocking.status-triage. Confirm receipt and begin triaging the incident.status-new-info. Notify the sender when new information is received for this incident.watch-and-report. Watch for the described activity or indicators, and notify the sender when seen.training. Train user to identify or mitigate the described threat.defined-coa. Perform a predefined course of action (COA). The COA is named in the DefinedCOA class.other. Perform a custom action described in the Description class.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
- ext-action 🧩 Optional. STRING. A means by which to extend the action attribute. See Section 5.1.1.
- severity 🚦 Optional. ENUM. Indicates the desired priority of the action. This attribute is an enumerated list with no default value, and the semantics of these relative measures are context dependent.
low. Low prioritymedium. Medium priorityhigh. High priority
- restriction 🔒 Optional. ENUM. See Section 3.3.1. The default value is
default. - ext-restriction 🧩 Optional. STRING. A means by which to extend the restriction attribute. See Section 5.1.1.
- observable-id 🔎 Optional. ID. See Section 3.3.2.
3.16. Flow Class 🌊
The Flow class describes the systems and networks involved in the incident and the relationships between them. It's giving "who's in the group chat" energy 👑
+------------------+
| Flow |
+------------------+
| |<>--{1..*}--[ System ]
+------------------+Figure 32: The Flow Class 🦋
The aggregate class of the Flow class is:
- System 🖥️ One or More. A host or network involved in an event. See Section 3.17.
The Flow class has no attributes. Nothing to customise here, it just is 💜
3.17. System Class 💻
The System class describes a system or network involved in an event. This is the main character of the whole Flow 🌸
+------------------------+
| System |
+------------------------+
| ENUM category |<>----------[ Node ]
| STRING ext-category |<>--{0..*}--[ NodeRole ]
| STRING interface |<>--{0..*}--[ Service ]
| ENUM spoofed |<>--{0..*}--[ OperatingSystem ]
| ENUM virtual |<>--{0..*}--[ Counter ]
| ENUM ownership |<>--{0..*}--[ AssetID ]
| STRING ext-ownership |<>--{0..*}--[ Description ]
| ENUM restriction |<>--{0..*}--[ AdditionalData ]
| STRING ext-restriction |
| ID observable-id |
+------------------------+Figure 33: The System Class ✨
The aggregate classes of the System class are:
- Node 📍 One. A host or network involved in the incident. See Section 3.18.
- NodeRole 🎭 Zero or more. The intended purpose of the system. See Section 3.18.2.
- Service 🛎️ Zero or more. A network service running on the system. See Section 3.20.
- OperatingSystem 💿 Zero or more. SOFTWARE. The operating system running on the system.
- Counter 🔢 Zero or more. A counter with which to summarize properties of this host or network. See Section 3.18.3.
- AssetID 🏷️ Zero or more. STRING. An asset identifier for the System.
- Description 📝 Zero or more. ML_STRING. A free-form text description of the System.
- AdditionalData 🧁 Zero or more. EXTENSION. A mechanism by which to extend the data model.
The attributes of the System class are:
- category 🏷️ Optional. ENUM. Classifies the role the host or network played in the incident. These values are maintained in the
System-categoryIANA registry per Section 10.2.source. The System was the source of the event.target. The System was the target of the event.intermediate. The System was an intermediary in the event.sensor. The System was a sensor monitoring the event.infrastructure. The System was an infrastructure node of the IODEF document exchange.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
- ext-category 🧩 Optional. STRING. A means by which to extend the category attribute. See Section 5.1.1.
- interface 🔌 Optional. STRING. Specifies the interface on which the event(s) on this System originated. If the Node class specifies a network rather than a host, this attribute has no meaning.
- spoofed 🎭 Optional. ENUM. An indication of confidence in whether this System was the true target or attacking host. The permitted values for this attribute are shown below. The default value is
unknown.unknown. The accuracy of the category attribute value is unknown.yes. The category attribute value is likely incorrect. In the case of a source, the System is likely a decoy; with a target, the System was likely not the intended victim. 🙈no. The category attribute value is believed to be correct.
- virtual ☁️ Optional. ENUM. Indicates whether this System is a virtual or physical device. The default value is
unknown.yes. The System is a virtual device.no. The System is a physical device.unknown. It is not known if the System is virtual.
- ownership 🏠 Optional. ENUM. Describes the ownership of this System relative to the victim in the incident. These values are maintained in the
System-ownershipIANA registry per Section 10.2.organization. Corporate or enterprise owned.personal. Personally owned by an employee or affiliate of the corporation or enterprise.partner. Owned by a partner of the corporation or enterprise.customer. Owned by a customer of the corporation or enterprise.no-relationship. Owned by an entity that has no known relationship with the victim organization.unknown. Ownership is unknown.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
- ext-ownership 🧩 Optional. STRING. A means by which to extend the ownership attribute. See Section 5.1.1.
- restriction 🔒 Optional. ENUM. See Section 3.3.1.
- ext-restriction 🧩 Optional. STRING. A means by which to extend the restriction attribute. See Section 5.1.1.
- observable-id 🔎 Optional. ID. See Section 3.3.2.
3.18. Node Class ✨
okay bestie, the Node class is where we get to say where something lives and what it is 🗺️ it's basically the identity card for a system, asset, or network 🪪 it tells you its location too!!
+---------------+
| Node |
+---------------+
| |<>--{0..*}--[ DomainData ]
| |<>--{0..1}--[ PostalAddress ]
| |<>--{0..*}--[ Address ]
| |<>--{0..*}--[ Location ]
| |<>--{0..*}--[ Counter ]
+---------------+
Figure 34: The Node ClassOkay so the Node class has five aggregate classes hanging off it, and each one is its own little bestie 💅
DomainData Zero or more. This is the domain (DNS) info tied to this node. If an Address is not provided, at least one DomainData MUST be specified. See Section 3.19.
Address Zero or more. The hardware, network, or application address of the node. If a DomainData is not provided, at least one Address MUST be specified. See Section 3.18.1.
PostalAddress Zero or one. POSTAL. The postal address of the node. 📮
Location Zero or more. ML_STRING. A free-form text description of the physical location of the node. This description may provide a more detailed description of where at the address specified by the PostalAddress class this node is found (e.g., room number, rack number, or slot number in a chassis). 🚪🗄️
Counter Zero or more. A counter with which to summarize properties of this host or network. See Section 3.18.3. 🔢
The Node class has no attributes. Simple and iconic 💜
3.18.1. Address Class
The Address class is the one for a hardware (Layer 2), network (Layer 3), or application (Layer 7) address 🧩
+-------------------------+
| Address |
+-------------------------+
| STRING |
| |
| ENUM category |
| STRING ext-category |
| STRING vlan-name |
| INTEGER vlan-num |
| ID observable-id |
+-------------------------+
Figure 35: The Address ClassThe content is an address of type STRING, and its semantics are determined by the category attribute. So the category is the thing that tells you how to read the string 👀
The attributes of the Address class are:
category Required. ENUM. The type of address represented. The default value is ipv6-addr. These values are maintained in the "Address-category" IANA registry per Section 10.2.
asn. Autonomous System Number.atm. Asynchronous Transfer Mode (ATM) address.e-mail. Email address, per the EMAIL data type. 📧ipv4-addr. IPv4 host address in dotted-decimal notation (i.e.,a.b.c.d).ipv4-net. IPv4 network address in dotted-decimal notation, slash, significant bits (i.e.,a.b.c.d/nn).ipv4-net-masked. A sanitized IPv4 address with significant bits per "ipv4-net" but with the character'x'replacing any digit(s) in the address or prefix. 🙈ipv4-net-mask. IPv4 network address in dotted-decimal notation, slash, network mask in dotted-decimal notation (i.e.,a.b.c.d/w.x.y.z).ipv6-addr. IPv6 host address per Section 4 of [RFC5952].ipv6-net. IPv6 network address, slash, prefix per Section 2.3 of [RFC4291].ipv6-net-masked. A sanitized IPv6 address and prefix per "ipv6-net" but with the character'x'replacing any hexadecimal digit(s) in the address or digit(s) in the prefix. 🫣mac. Media Access Control (MAC) address (i.e.,aa:bb:cc:dd:ee:ff).site-uri. A URL or URI for a resource, per the URL data type. 🔗ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
ext-category Optional. STRING. A means by which to extend the category attribute. See Section 5.1.1.
vlan-name Optional. STRING. The name of the Virtual LAN to which the address belongs.
vlan-num Optional. INTEGER. The number of the Virtual LAN to which the address belongs.
observable-id Optional. ID. See Section 3.3.2.
3.18.2. NodeRole Class
The NodeRole class describes the function performed by, or role of, a particular system, asset, or network. It's the job title of the node 💼✨
+-----------------------+
| NodeRole |
+-----------------------+
| ENUM category |<>--{0..*}--[ Description ]
| STRING ext-category |
+-----------------------+
Figure 36: The NodeRole ClassThe aggregate class of the NodeRole class is:
Description Zero or more. ML_STRING. A free-form text description of the role of the system.
The attributes of the NodeRole class are:
category Required. ENUM. Function or role of a node. These values are maintained in the "NodeRole-category" IANA registry per Section 10.2.
client. Client computer.client-enterprise. Client computer on the enterprise network.client-partner. Client computer on network of a partner.client-remote. Client computer remotely connected to the enterprise network.client-kiosk. Client computer serving as a kiosk.client-mobile. Mobile device. 📱server-internal. Server with internal services.server-public. Server with public services.www. WWW server. 🌐mail. Mail server. 📬webmail. Web mail server.messaging. Messaging server (e.g., NNTP, IRC, IM).streaming. Streaming-media server. 🎬voice. Voice server (e.g., SIP, H.323).file. File server. 🗂️ftp. FTP server.p2p. Peer-to-peer node.name. Name server (e.g., DNS, WINS).directory. Directory server (e.g., LDAP, finger, whois).credential. Credential server (e.g., domain controller, Kerberos). 🔑print. Print server. 🖨️application. Application server.database. Database server. 🗄️backup. Backup server.dhcp. DHCP server.assessment. Assessment server (e.g., vulnerability scanner, endpoint assessment).source-control. Source code control server.config-management. Configuration management server.monitoring. Security monitoring server (e.g., IDS). 👀infra. Infrastructure server (e.g., router, firewall, DHCP).infra-firewall. Firewall. 🧱infra-router. Router.infra-switch. Switch.camera. Camera and video system. 📷proxy. Proxy server.remote-access. Remote access server.log. Log server (e.g., syslog). 📝virtualization. Server running virtual machines.pos. Point-of-sale device. 🛒scada. Supervisory control and data acquisition (SCADA) system.scada-supervisory. Supervisory system for a SCADA.sinkhole. Traffic sinkhole destination.honeypot. Honeypot server. 🍯anonymization. Anonymization server (e.g., Tor node). 🧅c2-server. Malicious command and control server. 💀malware-distribution. Server that distributes malwaredrop-server. Server to which exfiltrated content is uploaded.hop-point. Intermediary server used to get to a victim.reflector. A system used in a reflector attack.phishing-site. Site hosting phishing content. 🎣spear-phishing-site. Site hosting spear-phishing content.recruiting-site. Site to recruit.fraudulent-site. Fraudulent site.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
ext-category Optional. STRING. A means by which to extend the category attribute. See Section 5.1.1.
3.18.3. Counter Class
The Counter class summarizes multiple occurrences of an event, or conveys counts or rates of various features. 📊
The complete semantics of this class depend on the class it's aggregated in. Context is everything, periodt 💅
+---------------------+
| Counter |
+---------------------+
| REAL |
| |
| ENUM type |
| STRING ext-type |
| ENUM unit |
| STRING ext-unit |
| STRING meaning |
| ENUM duration |
| STRING ext-duration |
+---------------------+
Figure 37: The Counter ClassThe content is a value of type REAL. Its meaning and units are set by the type and duration attributes, respectively. If the duration attribute is present, the element content is a rate. Otherwise, it's a simple counter. 🔢
The attributes of the Counter class are:
type Required. ENUM. Specifies the type of counter specified in the element content. These values are maintained in the "Counter-type" IANA registry per Section 10.2.
count. The Counter class value is a counter.peak. The Counter class value is a peak value. ⛰️average. The Counter class value is an average.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
ext-type Optional. STRING. A means by which to extend the type attribute. See Section 5.1.1.
unit Required. ENUM. Specifies the units of the element content. These values are maintained in the "Counter-unit" IANA registry per Section 10.2.
byte. Bytes transferred.mbit. Megabits (Mbits) transferred.packet. Packets. 📦flow. Network flow records.session. Sessions.alert. Notifications generated by another system (e.g., IDS or SIEM system). 🚨message. Messages (e.g., mail messages). 💌event. Events. ✨host. Hosts.site. Site.organization. Organizations.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
ext-unit Optional. STRING. A means by which to extend the unit attribute. See Section 5.1.1.
meaning Optional. STRING. A free-form text description of the metric represented by the Counter.
duration Optional. ENUM. If present, the Counter class represents a rate. This attribute specifies a unit of time over which the rate, whose units are specified in the unit attribute, is being conveyed. This attribute is the denominator of the rate (where the unit attribute specified the nominator). The possible values of this attribute are defined in the duration attribute of Section 3.12.3 ⏱️
ext-duration Optional. STRING. A means by which to extend the duration attribute. See Section 5.1.1.
3.19. DomainData Class ✨
okay so the DomainData class is where we describe a domain name and all the juicy metadata that comes with it 🌐💖 think of it as the domain's whole profile card
+--------------------------+
| DomainData |
+--------------------------+
| ENUM system-status |<>----------[ Name ]
| STRING ext-system-status |<>--{0..1}--[ DateDomainWasChecked ]
| ENUM domain-status |<>--{0..1}--[ RegistrationDate ]
| STRING ext-domain-status |<>--{0..1}--[ ExpirationDate ]
| ID observable-id |<>--{0..*}--[ RelatedDNS ]
| |<>--{0..*}--[ Nameservers ]
| |<>--{0..1}--[ DomainContacts ]
+--------------------------+
Figure 38: The DomainData ClassHere's what hangs off the DomainData class 🎀
Name: One.STRING. The domain name of a system.DateDomainWasChecked: Zero or one.DATETIME. A timestamp of when the domain listed in theNameclass was resolved.RegistrationDate: Zero or one.DATETIME. A timestamp of when the domain listed in theNameclass was registered.ExpirationDate: Zero or one.DATETIME. A timestamp of when the domain listed in theNameclass is set to expire.RelatedDNS: Zero or more.EXTENSION. Additional DNS records associated with this domain.Nameservers: Zero or more. The nameservers identified for the domain listed in theNameclass. See Section 3.19.1.DomainContacts: Zero or one. Contact information for the domain listed in theNameclass, supplied by the registrar or through a whois query.
And these are the attributes of DomainData 💅
system-status: Required.ENUM. Assesses the domain's involvement in the event. These values are maintained in the "DomainData-system-status" IANA registry per Section 10.2.spoofed. This domain was spoofed.fraudulent. This domain was operated with fraudulent intentions.innocent-hacked. This domain was compromised by a third party.innocent-hijacked. This domain was deliberately hijacked.unknown. No categorization for this domain known.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
ext-system-status: Optional.STRING. A means by which to extend thesystem-statusattribute. See Section 5.1.1.domain-status: Required.ENUM. Categorizes the registry status of the domain at the time the document was generated. These values and their associated descriptions are derived from Section 3.2.2 of [RFC3982]. These values are maintained in the "DomainData-domain-status" IANA registry per Section 10.2.reservedDelegation. The domain is permanently inactive.assignedAndActive. The domain is in a normal state.assignedAndInactive. The domain has an assigned registration, but the delegation is inactive.assignedAndOnHold. The domain is in dispute.revoked. The domain is in the process of being purged from the database.transferPending. The domain is pending a change in authority.registryLock. The domain is on hold by the registry.registrarLock. Same as "registryLock".other. The domain has a known status, but it is not one of the redefined enumerated values.unknown. The domain has an unknown status.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the correspondingext-*attribute. See Section 5.1.1.
ext-domain-status: Optional.STRING. A means by which to extend thedomain-statusattribute. See Section 5.1.1.observable-id: Optional.ID. See Section 3.3.2.
3.19.1. Nameservers Class
the Nameservers class is all about the nameservers tied to a given domain 🏠
+--------------------+
| Nameservers |
+--------------------+
| |<>----------[ Server ]
| |<>--{1..*}--[ Address ]
+--------------------+
Figure 39: The Nameservers ClassThese are the aggregate classes of Nameservers ✨
Server: One.STRING. The domain name of the nameserver.Address: One or more. The address of the nameserver. The value of thecategoryattribute MUST be either"ipv4-addr"or"ipv6-addr". See Section 3.18.1.
The Nameservers class has no attributes, so there's nothing extra to fuss over 🌸
3.19.2. DomainContacts Class
the DomainContacts class covers the contact info for a given domain, whether the registrar handed it over or it came from a whois query 📇
this contact info can be spelled out explicitly through a Contact class, or you can point to a domain that has identical contact information 👯 Either a single SameDomainContact or one or more Contact classes MUST be present.
+--------------------+
| DomainContacts |
+--------------------+
| |<>--{0..1}--[ SameDomainContact ]
| |<>--{1..*}--[ Contact ]
+--------------------+
Figure 40: The DomainContacts ClassThe aggregate classes of DomainContacts are 🎀
SameDomainContact: Zero or one.STRING. A domain name already cited in this document or through previous exchange that contains the identical contact information as the domain name in question. The domain contact information associated with this domain should be used instead of an explicit definition with the Contact class.Contact: One or more. Contact information for the domain. See Section 3.9.
The DomainContacts class has no attributes 💜
3.20. Service Class
the Service class describes a network service, and it's described by a protocol, a port, a protocol header field, and the application providing or using the service 🦋
+-------------------------+
| Service |
+-------------------------+
| INTEGER ip-protocol |<>--{0..1}--[ ServiceName ]
| ID observable-id |<>--{0..1}--[ Port ]
| |<>--{0..1}--[ Portlist ]
| |<>--{0..1}--[ ProtoCode ]
| |<>--{0..1}--[ ProtoType ]
| |<>--{0..1}--[ ProtoField ]
| |<>--{0..1}--[ ApplicationHeader ]
| |<>--{0..1}--[ EmailData ]
| |<>--{0..1}--[ Application ]
+-------------------------+
Figure 41: The Service ClassThe aggregate classes of Service are 🌈
ServiceName: Zero or one. A protocol name.Port: Zero or one.INTEGER. A port number.Portlist: Zero or one.PORTLIST. A list of port numbers.ProtoCode: Zero or one.INTEGER. A transport-layer (Layer 4) protocol-specific code field (e.g., ICMP code field).ProtoType: Zero or one.INTEGER. A transport-layer (Layer 4) protocol-specific type field (e.g., ICMP type field).ProtoField: Zero or one.INTEGER. A transport-layer (Layer 4) protocol-specific flag field (e.g., TCP flag field).ApplicationHeader: Zero or one. A protocol header. See Section 3.20.2.EmailData: Zero or one. Headers associated with an email message. See Section 3.21.Application: Zero or one.SOFTWARE. The application acting as either the client or the server for the service.
At least one of these classes MUST be present 🙌
Now the Portlist drama 👀 When a given System class with category="source" and another with category="target" are aggregated into a single Flow class, and each of these System classes has a Service and Portlist class, there's an implicit relationship between those Portlists. If N ports are listed for a System@category="source", and M ports are listed for System@category="target", the number of ports in N must be equal to M. Likewise, the ports MUST be listed in an identical sequence, so the n-th port in the source corresponds to the n-th port of the target. If N is greater than 1, a given instance of a Flow class MUST only have a single instance of a System@category="source" and System@category="target".
The attributes of Service are ✨
ip-protocol: Optional.INTEGER. The IANA-assigned IP protocol number per [IANA.Protocols]. The attribute MUST be set if a Port, Portlist, ProtoCode, ProtoType, or ProtoField class is present.observable-id: Optional.ID. See Section 3.3.2.
3.20.1. ServiceName Class
the ServiceName class identifies an application protocol, and you can describe it by referencing an IANA-registered protocol, by referencing a URL, or with free-form text 📝
+--------------------+
| ServiceName |
+--------------------+
| |<>--{0..1}--[ IANAService ]
| |<>--{0..*}--[ URL ]
| |<>--{0..*}--[ Description ]
+--------------------+
Figure 42: The ServiceName ClassThe aggregate classes of ServiceName are 💅
IANAService: Zero or one.STRING. The name of the service per the "Service Name" field of the registry [IANA.Ports].URL: Zero or more.URL. A URL to a resource describing the service.Description: Zero or more.ML_STRING. A free-form text description of the service.
At least one of these classes MUST be present.
The ServiceName class has no attributes 🎀
3.20.2. ApplicationHeader Class
the ApplicationHeader class describes arbitrary fields from a protocol header, plus the value that goes with each one 🧚
+--------------------------+
| ApplicationHeader |
+--------------------------+
| |<>--{1..*}--[ ApplicationHeaderField ]
+--------------------------+
Figure 43: The ApplicationHeader ClassThe aggregate class of ApplicationHeader is 🌸
ApplicationHeaderField: One or more.EXTENSION. A field name and value in a protocol header. Thenameattribute MUST be set to the field name. The field value MUST be set in the element content.
The ApplicationHeader class has no attributes, so we're all set 💖
3.21. EmailData Class ✨
okay so the EmailData class is all about the headers from an email message, plus any cryptographic hashes and signatures that got applied to it. bestie it's giving forensic detective 🕵️♀️💅
+-------------------------+
| EmailData |
+-------------------------+
| ID observable-id |<>--{0..*}--[ EmailTo ]
| |<>--{0..1}--[ EmailFrom ]
| |<>--{0..1}--[ EmailSubject ]
| |<>--{0..1}--[ EmailX-Mailer ]
| |<>--{0..*}--[ EmailHeaderField ]
| |<>--{0..1}--[ EmailHeaders ]
| |<>--{0..1}--[ EmailBody ]
| |<>--{0..1}--[ EmailMessage ]
| |<>--{0..*}--[ HashData ]
| |<>--{0..*}--[ SignatureData ]
+-------------------------+Figure 44: EmailData Class
The aggregate classes of the EmailData class are:
EmailTo 💌 Zero or more. EMAIL. The value of the "To:" header field (Section 3.6.3 of [RFC5322]) in an email.
EmailFrom 📤 Zero or one. EMAIL. The value of the "From:" header field (Section 3.6.2 of [RFC5322]) in an email.
EmailSubject 🧾 Zero or one. STRING. The value of the "Subject:" header field in an email. See Section 3.6.5 of [RFC5322].
EmailX-Mailer 🖥️ Zero or one. STRING. The value of the "X-Mailer:" header field in an email.
EmailHeaderField 🎀 Zero or more. EXTENSION. The header name and value of an arbitrary header field of the email message. The name attribute MUST be set to the header name. The header value MUST be set in the element body. The dtype attribute MUST be set to "string".
EmailHeaders 📋 Zero or one. STRING. The headers of an email message.
EmailBody 🌸 Zero or one. STRING. The body of an email message.
EmailMessage 💜 Zero or one. STRING. The headers and body of an email message.
HashData 🔐 Zero or more. Hash(es) associated with this email message. See Section 3.26.
SignatureData ✍️ Zero or more. Signature(s) associated with this email message. See Section 3.27.
The attribute of the EmailData class is:
observable-id Optional. ID. See Section 3.3.2.
3.22. Record Class 🗂️
the Record class is the container class for log and audit data. it gives supportive info about the events in an incident, and the data usually comes out of monitoring tools. these logs basically receipt-check the activity the document describes 🧾✨
+------------------------+
| Record |
+------------------------+
| ENUM restriction |<>--{1..*}--[ RecordData ]
| STRING ext-restriction |
+------------------------+Figure 45: The Record Class
The aggregate classes of the Record class are:
RecordData One or more. Log or audit data generated by a particular tool. Separate instances of the RecordData class SHOULD be used for each type of log. See Section 3.22.1.
The attributes of the Record class are:
restriction Optional. ENUM. See Section 3.3.1.
ext-restriction Optional. STRING. A means by which to extend the restriction attribute. See Section 5.1.1.
3.22.1. RecordData Class 🧃
the RecordData class describes or points to log or audit data from one type of tool, and gives you a way to annotate the output. it's the main character of the record era 👑
+------------------------+
| RecordData |
+------------------------+
| ENUM restriction |<>--{0..1}--[ DateTime ]
| STRING ext-restriction |<>--{0..*}--[ Description ]
| ID observable-id |<>--{0..1}--[ Application ]
| |<>--{0..*}--[ RecordPattern ]
| |<>--{0..*}--[ RecordItem ]
| |<>--{0..*}--[ URL ]
| |<>--{0..*}--[ FileData ]
| |<>--{0..*}--
| | [ WindowsRegistryKeysModified ]
| |<>--{0..*}--[ CertificateData ]
| |<>--{0..*}--[ AdditionalData ]
+------------------------+Figure 46: The RecordData Class
The aggregate classes of the RecordData class are:
DateTime Zero or one. DATETIME. A timestamp of the data found in the RecordItem or URL classes.
Description Zero or more. ML_STRING. A free-form text description of the data provided in the RecordItem or URL classes.
Application Zero or one. SOFTWARE. Identifies the tool used to generate the data in the RecordItem or URL classes.
RecordPattern Zero or more. A search string to precisely find the relevant data in the RecordItem or URL classes. See Section 3.22.2.
RecordItem Zero or more. EXTENSION. Log, audit, or forensic data to support the conclusions made during the course of analyzing the incident.
URL Zero or more. URL. A URL reference to a log or audit data.
FileData Zero or one. The files involved in the incident. See Section 3.25.
WindowsRegistryKeysModified Zero or more. The registry keys that were involved in the incident. See Section 3.23.
CertificateData Zero or more. The certificates that were involved in the incident. See Section 3.24.
AdditionalData Zero or more. EXTENSION. An extension mechanism for data not explicitly represented in the data model.
At least one of the following classes MUST be present: RecordItem, URL, FileData, WindowsRegistryKeysModified, CertificateData, or AdditionalData.
The attributes of the RecordData class are:
restriction Optional. ENUM. See Section 3.3.1.
ext-restriction Optional. STRING. A means by which to extend the restriction attribute. See Section 5.1.1.
observable-id Optional. ID. See Section 3.3.2.
3.22.2. RecordPattern Class 🔍
the RecordPattern class tells you where in the log data the relevant info is hiding. think of it as a search pattern that finds subsets of info in a huge log file, audit trail, or forensic data. the vibe is "find me the tea without reading all 10,000 lines" 🫖💅
+-----------------------+
| RecordPattern |
+-----------------------+
| STRING |
| |
| ENUM type |
| STRING ext-type |
| INTEGER offset |
| ENUM offsetunit |
| STRING ext-offsetunit |
| INTEGER instance |
+-----------------------+Figure 47: The RecordPattern Class
The content of the class is of type STRING and specifies a search pattern.
The attributes of the RecordPattern class are:
type Required. ENUM. Describes the type of pattern being specified in the element content. The default is "regex". These values are maintained in the "RecordPattern-type" IANA registry per Section 10.2.
- regex. Regular expression as defined by POSIX Extended Regular Expressions (ERE) in Chapter 9 of [IEEE.POSIX].
- binary. Binhex-encoded binary pattern, per the HEXBIN data type.
- xpath. XML Path (XPath) [W3C.XPATH].
- ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
ext-type Optional. STRING. A means by which to extend the type attribute. See Section 5.1.1.
offset Optional. INTEGER. Amount of units (determined by the offsetunit attribute) to seek into the RecordItem data before matching the pattern.
offsetunit Optional. ENUM. Describes the units of the offset attribute. The default is "line". These values are maintained in the "RecordPattern-offsetunit" IANA registry per Section 10.2.
- line. Offset is a count of lines.
- byte. Offset is a count of bytes.
- ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
ext-offsetunit Optional. STRING. A means by which to extend the offsetunit attribute. See Section 5.1.1.
instance Optional. INTEGER. Number of times to apply the specified pattern.
3.23. WindowsRegistryKeysModified Class 🪟
this class describes Windows registry keys and the operations that were performed on them. it was derived from [RFC5901], so it's got good bloodlines 🧬✨
+-----------------------------+
| WindowsRegistryKeysModified |
+-----------------------------+
| ID observable-id |<>--{1..*}--[ Key ]
+-----------------------------+Figure 48: The WindowsRegistryKeysModified Class
The aggregate classes of the WindowsRegistryKeysModified class are:
Key One or more. The Windows registry key. See Section 3.23.1.
The attribute of the WindowsRegistryKeysModified class is:
observable-id Optional. ID. See Section 3.3.2.
3.23.1. Key Class 🔑
the Key class is a Windows registry key name and value pair, plus the operation that got performed on it. it's giving "who touched my registry" energy 👀
+---------------------------+
| Key |
+---------------------------+
| ENUM registryaction |<>----------[ KeyName ]
| STRING ext-registryaction |<>--{0..1}--[ KeyValue ]
| ID observable-id |
+---------------------------+Figure 49: The Key Class
The aggregate classes of the Key class are:
KeyName One. STRING. The name of a Windows operating system registry key (e.g., [HKEY_LOCAL_MACHINE\Software\Test\KeyName]).
KeyValue Zero or one. STRING. The value of the registry key identified in the KeyName class encoded per the .reg file format [KB310516].
The attributes of the Key class are:
registryaction Optional. ENUM. The type of action taken on the registry key. These values are maintained in the "Key-registryaction" IANA registry per Section 10.2.
- add-key. Registry key added.
- add-value. Value added to a registry key.
- delete-key. Registry key deleted.
- delete-value. Value deleted from a registry key.
- modify-key. Registry key modified.
- modify-value. Value modified in a registry key.
- ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
ext-registryaction Optional. STRING. A means by which to extend the registryaction attribute. See Section 5.1.1.
observable-id Optional. ID. See Section 3.3.2.
3.24. CertificateData Class ✨
okay so the CertificateData class is basically where we describe X.509 certificates 🎀 it's giving certificate central, bestie 🔐
+------------------------+
| CertificateData |
+------------------------+
| ENUM restriction |<>--{1..*}--[ Certificate ]
| STRING ext-restriction |
| ID observable-id |
+------------------------+Figure 50: The CertificateData Class 💜
the aggregate classes of CertificateData are:
Certificate One or more. 🦋 a description of an X.509 certificate or certificate chain. see Section 3.24.1.
the attributes of CertificateData are:
restriction Optional. ENUM. see Section 3.3.1. 💅
ext-restriction Optional. STRING. a means by which to extend the restriction attribute. see Section 5.1.1. 🌸
observable-id Optional. ID. see Section 3.3.2. ✨
3.24.1. Certificate Class 🔐
the Certificate class describes a given X.509 certificate or certificate chain. literally the main character of this whole section 👑
+--------------------------+
| Certificate |
+--------------------------+
| ID observable-id |<>----------[ ds:X509Data ]
| |<>--{0..*}--[ Description ]
+--------------------------+Figure 51: The Certificate Class 💜
the aggregate classes of Certificate are:
ds:X509Data One. a given X.509 certificate or chain. see Section 4.4.4 of [W3C.XMLSIG]. 🧚
Description Zero or more. ML_STRING. a free-form text description explaining the context of this certificate. 📝
the attributes of Certificate are:
observable-id Optional. ID. see Section 3.3.2. 🦋
3.25. FileData Class 📁
the FileData class describes a file or set of files. it's giving file folder energy 🍓
+------------------------+
| FileData |
+------------------------+
| ENUM restriction |<>--{1..*}--[ File ]
| STRING ext-restriction |
| ID observable-id |
+------------------------+Figure 52: The FileData Class 💜
the aggregate classes of FileData are:
File One or more. 🎀 a description of a file. see Section 3.25.1.
the attributes of FileData are:
restriction Optional. ENUM. see Section 3.3.1. 💅
ext-restriction Optional. STRING. a means by which to extend the restriction attribute. see Section 5.1.1. 🌸
observable-id Optional. ID. see Section 3.3.2. ✨
3.25.1. File Class 📄
the File class describes a file; its associated metadata; and cryptographic hashes and signatures applied to it. okay this class is a whole vibe 🫶
+-----------------------+
| File |
+-----------------------+
| ID observable-id |<>--{0..1}--[ FileName ]
| |<>--{0..1}--[ FileSize ]
| |<>--{0..1}--[ FileType ]
| |<>--{0..*}--[ URL ]
| |<>--{0..1}--[ HashData ]
| |<>--{0..1}--[ SignatureData ]
| |<>--{0..1}--[ AssociatedSoftware ]
| |<>--{0..*}--[ FileProperties ]
+-----------------------+Figure 53: The File Class 💜
the aggregate classes of File are:
FileName Zero or one. STRING. the name of the file. 🌷
FileSize Zero or one. INTEGER. the size of the file in bytes. 📏
FileType Zero or one. STRING. the type of file per the IANA "Media Types" registry [IANA.Media]. valid values correspond to the text in the "Template" column (e.g., "application/pdf"). 🧾
URL Zero or more. URL. a URL reference to the file. 🔗
HashData Zero or one. Hash(es) associated with this file. see Section 3.26. 🔢
SignatureData Zero or one. Signature(s) associated with this file. see Section 3.27. ✍️
AssociatedSoftware Zero or one. SOFTWARE. the software application or operating system to which this file belongs or by which it can be processed. 💻
FileProperties Zero or more. EXTENSION. mechanism by which to extend the data model to describe properties of the file. 🧩
the attributes of File are:
observable-id Optional. ID. see Section 3.3.2. 🦋
3.26. HashData Class 🔢
the HashData class describes different types of hashes on a given object (e.g., file, part of a file, email). hashes are literally the fingerprints of the internet ✨
+--------------------------+
| HashData |
+--------------------------+
| ENUM scope |<>--{0..1}--[ HashTargetID ]
| |<>--{0..*}--[ Hash ]
| |<>--{0..*}--[ FuzzyHash ]
+--------------------------+Figure 54: The HashData Class 💜
the aggregate classes of HashData are:
HashTargetID Zero or one. STRING. an identifier that references a subset of the object being hashed. the semantics of this identifier are specified by the scope attribute. 🎯
Hash Zero or more. the hash of an object. see Section 3.26.1. 💎
FuzzyHash Zero or more. the fuzzy hash of an object. see Section 3.26.2. 🌀
at least one instance of either Hash or FuzzyHash MUST be present. this is a hard rule, no exceptions, periodt 🚨
the attribute of HashData is:
scope Required. ENUM. describes on which part of the object the hash should be applied. these values are maintained in the "HashData-scope" IANA registry per Section 10.2. 🗂️
- file-contents. a hash computed over the entire contents of a file. 📂
- file-pe-section. a hash computed on a given section of a Windows Portable Executable (PE) file. if set to this value, the HashTargetID class MUST identify the section being hashed. a section is identified by an ordinal number (starting at 1) corresponding to the order in which the given section header was defined in the Section Table of the PE file header. 🪟
- file-pe-iat. a hash computed on the Import Address Table (IAT) of a PE file. as IAT hashes are often tool dependent, if this value is set, the Application class of either the Hash or FuzzyHash classes MUST specify the tool used to generate the hash. 🛠️
- file-pe-resource. a hash computed on a given resource in a PE file. if set to this value, the HashTargetID class MUST identify the resource being hashed. a resource is identified by an ordinal number (starting at 1) corresponding to the order in which the given resource is declared in the Resource Directory of the Data Dictionary in the PE file header. 🎨
- file-pdf-object. a hash computed on a given object in a Portable Document Format (PDF) file. if set to this value, the HashTargetID class MUST identify the object being hashed. this object is identified by its offset in the PDF file. 📑
- email-hash. a hash computed over the headers and body of an email message. 📧
- email-headers-hash. a hash computed over all of the headers of an email message. 📮
- email-body-hash. a hash computed over the body of an email message. 💌
- ext-value. a value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. see Section 5.1.1. 🧩
ext-scope Optional. STRING. a means by which to extend the scope attribute. see Section 5.1.1. 🌸
3.26.1. Hash Class 💎
the Hash class describes a cryptographic hash value; the algorithm and application used to generate it; and the canonicalization method applied to the object being hashed. it's giving cryptography core 🔐
+----------------+
| Hash |
+----------------+
| |<>----------[ ds:DigestMethod ]
| |<>----------[ ds:DigestValue ]
| |<>--{0..1}--[ ds:CanonicalizationMethod ]
| |<>--{0..1}--[ Application ]
+----------------+Figure 55: The Hash Class 💜
the aggregate classes of Hash are:
ds:DigestMethod One. the hash algorithm used to generate the hash. see Section 4.3.3.5 of [W3C.XMLSIG]. 🧮
ds:DigestValue One. the computed hash value. see Section 4.3.3.6 of [W3C.XMLSIG]. 🎯
ds:CanonicalizationMethod Zero or one. the canonicalization method used on the object being hashed. see Section 4.3.1 of [W3C.XMLSIG]. 🪄
Application Zero or one. SOFTWARE. the application used to calculate the hash. 🖥️
the HashData class has no attributes. 🙈
3.26.2. FuzzyHash Class 🌀
the FuzzyHash class describes a fuzzy hash and the application used to generate it. 🦋
+--------------------------+
| FuzzyHash |
+--------------------------+
| |<>--{1..*}--[ FuzzyHashValue ]
| |<>--{0..1}--[ Application ]
| |<>--{0..*}--[ AdditionalData ]
+--------------------------+Figure 56: The FuzzyHash Class 💜
the aggregate classes of FuzzyHash are:
FuzzyHashValue One or more. EXTENSION. the computed fuzzy hash value. 🌈
Application Zero or one. SOFTWARE. the application used to calculate the hash. 🖥️
AdditionalData Zero or more. EXTENSION. mechanism by which to extend the data model. 🧩
the FuzzyData class has no attributes. 🙈
3.27. SignatureData Class ✍️
the SignatureData class describes different types of digital signatures on an object. signatures are the receipts of the internet, bestie 🧾💅
+--------------------------+
| SignatureData |
+--------------------------+
| |<>--{1..*}--[ ds:Signature ]
+--------------------------+Figure 57: The SignatureData Class 💜
the aggregate class of SignatureData is:
Signature One or more. A given signature. see Section 4.2 of [W3C.XMLSIG]. 🖊️
the SignatureData class has no attributes. 🙈
3.28. IndicatorData Class 🚩
the IndicatorData class describes indicators and metadata associated with them. indicators are the little red flags that tell us something's up 👀
+--------------------------+
| IndicatorData |
+--------------------------+
| |<>--{1..*}--[ Indicator ]
+--------------------------+Figure 58: The IndicatorData Class 💜
the aggregate class of IndicatorData is:
Indicator One or more. A description of an indicator. see Section 3.29. 🎀
the IndicatorData class has no attributes. 🙈
3.29. Indicator Class 🦋
okay bestie, this one is the big boss of the section 😭✨ An Indicator is basically a detective kit: observable features and phenomena that help with forensic or proactive detection of malicious activity, plus all the metadata that comes with them. You can describe one outright, build it by referencing or composing indicators that were already defined, or point at observables from the incident report in this document. 💅
+------------------------+
| Indicator |
+------------------------+
| ENUM restriction |<>----------[ IndicatorID ]
| STRING ext-restriction |<>--{0..*}--[ AlternativeIndicatorID ]
| |<>--{0..*}--[ Description ]
| |<>--{0..1}--[ StartTime ]
| |<>--{0..1}--[ EndTime ]
| |<>--{0..1}--[ Confidence ]
| |<>--{0..*}--[ Contact ]
| |<>--{0..1}--[ Observable ]
| |<>--{0..1}--[ ObservableReference ]
| |<>--{0..1}--[ IndicatorExpression ]
| |<>--{0..1}--[ IndicatorReference ]
| |<>--{0..*}--[ NodeRole ]
| |<>--{0..*}--[ AttackPhase ]
| |<>--{0..*}--[ Reference ]
| |<>--{0..*}--[ AdditionalData ]
+------------------------+Figure 59: The Indicator Class
The aggregate classes of the Indicator class are:
- IndicatorID: One. An identifier for this indicator. See Section 3.29.1.
- AlternativeIndicatorID: Zero or more. An alternative identifier for this indicator. See Section 3.29.2.
- Description: Zero or more. ML_STRING. A free-form text description of the indicator.
- StartTime: Zero or one. DATETIME. A timestamp of the start of the time period during which this indicator is valid.
- EndTime: Zero or one. DATETIME. A timestamp of the end of the time period during which this indicator is valid.
- Confidence: Zero or one. An estimate of the confidence in the quality of the indicator. See Section 3.12.5.
- Contact: Zero or more. Contact information for this indicator. See Section 3.9.
- Observable: Zero or one. An observable feature or phenomenon of this indicator. See Section 3.29.3.
- ObservableReference: Zero or one. A reference to an observable feature or phenomenon defined elsewhere in the document. See Section 3.29.6.
- IndicatorExpression: Zero or one. A composition of observables. See Section 3.29.4.
- IndicatorReference: Zero or one. A reference to an indicator. See Section 3.29.7.
- NodeRole: Zero or more. The role of the system in the attack should this indicator be matched to it. See Section 3.18.2.
- AttackPhase: Zero or more. The phase in an attack life cycle during which this indicator might be seen. See Section 3.29.8.
- Reference: Zero or more. A reference to additional information relevant to this indicator. See Section 3.11.1.
- AdditionalData: Zero or more. EXTENSION. Mechanism by which to extend the data model.
The Indicator class MUST have exactly one instance of an Observable, IndicatorExpression, ObservableReference, or IndicatorReference class.
The StartTime and EndTime classes can be used to define an interval during which the indicator is valid. If both classes are present, the indicator is considered valid only during the described interval. If neither class is provided, the indicator is considered valid during any time interval. If only a StartTime is provided, the indicator is valid anytime after this timestamp. If only an EndTime is provided, the indicator is valid anytime prior to this timestamp. ⏰
The attributes of the Indicator class are:
- restriction: Optional. ENUM. See Section 3.3.1.
- ext-restriction: Optional. STRING. A means by which to extend the restriction attribute. See Section 5.1.1.
3.29.1. IndicatorID Class 🆔
The IndicatorID class identifies an indicator with a globally unique identifier. The combination of the name and version attributes and the element content form this identifier. Indicators generated by given CSIRT MUST NOT reuse the same value unless they are referencing the same indicator. No copy-pasting IDs, bestie 🙅♀️
+------------------+
| IndicatorID |
+------------------+
| ID |
| |
| STRING name |
| STRING version |
+------------------+Figure 60: The IndicatorID Class
The content of the class is of type ID and specifies an identifier for an indicator.
The attributes of the IndicatorID class are:
- name: Required. STRING. An identifier describing the CSIRT that created the indicator. In order to have a globally unique CSIRT name, the fully qualified domain name associated with the CSIRT MUST be used. This format is identical to the IncidentID@name attribute in Section 3.4.
- version: Required. STRING. A version number of an indicator.
3.29.2. AlternativeIndicatorID Class 🎀
The AlternativeIndicatorID class lists alternative identifiers for an indicator.
+-------------------------+
| AlternativeIndicatorID |
+-------------------------+
| ENUM restriction |<>--{1..*}--[ IndicatorReference ]
| STRING ext-restriction |
+-------------------------+Figure 61: The AlternativeIndicatorID Class
The aggregate class of the AlternativeIndicatorID class is:
- IndicatorReference: One or more. A reference to an indicator. See Section 3.29.7.
The attributes of the AlternativeIndicatorID class are:
- restriction: Optional. ENUM. See Section 3.3.1.
- ext-restriction: Optional. STRING. A means by which to extend the restriction attribute. See Section 5.1.1.
3.29.3. Observable Class 👀
The Observable class describes a feature and phenomenon that can be observed or measured for the purposes of detecting malicious behavior. This is where the actual "what to look for" lives 🔍
+------------------------+
| Observable |
+------------------------+
| ENUM restriction |<>--{0..1}--[ System ]
| STRING ext-restriction |<>--{0..1}--[ Address ]
| |<>--{0..1}--[ DomainData ]
| |<>--{0..1}--[ Service ]
| |<>--{0..1}--[ EmailData ]
| |<>--{0..1}--[ WindowsRegistryKeysModified ]
| |<>--{0..1}--[ FileData ]
| |<>--{0..1}--[ CertificateData ]
| |<>--{0..1]--[ RegistryHandle ]
| |<>--{0..1}--[ RecordData ]
| |<>--{0..1}--[ EventData ]
| |<>--{0..1}--[ Incident ]
| |<>--{0..1}--[ Expectation ]
| |<>--{0..1}--[ Reference ]
| |<>--{0..1}--[ Assessment ]
| |<>--{0..1}--[ DetectionPattern ]
| |<>--{0..1}--[ HistoryItem ]
| |<>--{0..1}--[ BulkObservable ]
| |<>--{0..*}--[ AdditionalData ]
+------------------------+Figure 62: The Observable Class
The aggregate classes of the Observable class are:
- System: Zero or one. A System observable. See Section 3.17.
- Address: Zero or one. An Address observable. See Section 3.18.1.
- DomainData: Zero or one. A DomainData observable. See Section 3.19.
- Service: Zero or one. A Service observable. See Section 3.20.
- EmailData: Zero or one. An EmailData observable. See Section 3.21.
- WindowsRegistryKeysModified: Zero or one. A WindowsRegistryKeysModified observable. See Section 3.23.
- FileData: Zero or one. A FileData observable. See Section 3.25.
- CertificateData: Zero or one. A CertificateData observable. See Section 3.24.
- RegistryHandle: Zero or one. A RegistryHandle observable. See Section 3.9.1.
- RecordData: Zero or one. A RecordData observable. See Section 3.22.1.
- EventData: Zero or one. An EventData observable. See Section 3.14.
- Incident: Zero or one. An Incident observable. See Section 3.2.
- Expectation: Zero or one. An Expectation observable. See Section 3.15.
- Reference: Zero or one. A Reference observable. See Section 3.11.1.
- Assessment: Zero or one. An Assessment observable. See Section 3.12.
- DetectionPattern: Zero or one. A DetectionPattern observable. See Section 3.10.1.
- HistoryItem: Zero or one. A HistoryItem observable. See Section 3.13.1.
- BulkObservable: Zero or one. A bulk list of observables. See Section 3.29.3.1.
- AdditionalData: Zero or more. EXTENSION. Mechanism by which to extend the data model.
The Observable class MUST have exactly one of the possible child classes.
The attributes of the Observable class are:
- restriction: Optional. ENUM. See Section 3.3.1.
- ext-restriction: Optional. STRING. A means by which to extend the restriction attribute. See Section 5.1.1.
3.29.3.1. BulkObservable Class 🧺
okay so the BulkObservable class is the bulk-listing queen 👑 It lets you list a whole pile of observables of one type without wrapping every single one in its own instance of the same class. no cap, way less copy-paste 💅
The type attribute says what kind of observable is listed in the child BulkObservableList class. The BulkObservableFormat class can optionally add extra metadata 🎀
+---------------------------+
| BulkObservable |
+---------------------------+
| ENUM type |<>--{0..1}--[ BulkObservableFormat ]
| STRING ext-type |<>----------[ BulkObservableList ]
| |<>--{0..*}--[ AdditionalData ]
+---------------------------+Figure 63: The BulkObservable Class ✨
Here are the aggregate classes of BulkObservable, the things it's built out of 🧚
BulkObservableFormat Zero or one. Gives extra metadata about the observables listed in the BulkObservableList class. See Section 3.29.3.1.1.
BulkObservableList One. STRING. A list of observables, one per line. Each line is separated with either a LF character or CR and LF characters. The type attribute decides which observables get listed. 📝
AdditionalData Zero or more. EXTENSION. The way we extend the data model. 🌈
And here are the attributes 💖
type Optional. ENUM. The type of the observable listed in the child ObservableList class. These values live in the "BulkObservable-type" IANA registry per Section 10.2. Here's the full list, bestie:
asn. Autonomous System Number (per the Address@category attribute).atm. Asynchronous Transfer Mode (ATM) address (per the Address@category attribute).e-mail. Email address (per the Address@category attribute).ipv4-addr. IPv4 host address in dotted-decimal notation, e.g.,192.0.2.1(per the Address@category attribute).ipv4-net. IPv4 network address in dotted-decimal notation, slash, significant bits, e.g.,192.0.2.0/24(per the Address@category attribute).ipv4-net-mask. IPv4 network address in dotted-decimal notation, slash, network mask in dotted-decimal notation, i.e.,192.0.2.0/255.255.255.0(per the Address@category attribute).ipv6-addr. IPv6 host address, e.g.,2001:DB8::3(per the Address@category attribute).ipv6-net. IPv6 network address, slash, significant bits, e.g.,2001:DB8::/32(per the Address@category attribute).ipv6-net-mask. IPv6 network address, slash, network mask (per the Address@category attribute).mac. Media Access Control (MAC) address, i.e.,a:b:c:d:e:f(per the Address@category attribute).site-uri. A URL or URI for a resource (per the Address@category attribute).domain-name. A fully qualified domain name or part of a name (e.g.,fqdn.example.com,example.com).domain-to-ipv4. A mapping of FQDN to IPv4 address specified as a comma-separated list (e.g.,"fqdn.example.com, 192.0.2.1").domain-to-ipv6. A mapping of FQDN to IPv6 address specified as a comma-separated list (e.g.,"fqdn.example.com, 2001:DB8::3").domain-to-ipv4-timestamp. Same as domain-to-ipv4 but with a timestamp (in the DATETIME format) of the resolution (e.g.,"fqdn.example.com, 192.0.2.1, 2015-06-11T00:38:31-06:00").domain-to-ipv6-timestamp. Same as domain-to-ipv6 but with a timestamp (in the DATETIME format) of the resolution (e.g.,"fqdn.example.com, 2001:DB8::3, 2015-06-11T00:38:31-06:00").ipv4-port. An IPv4 address, port, and protocol tuple (e.g.,192.0.2.1, 80, TCP). The protocol name corresponds to the "Keyword" column in the "Assigned Internet Protocol Numbers" registry [IANA.Protocols].ipv6-port. An IPv6 address, port, and protocol tuple (e.g.,2001:DB8::3, 80, TCP). The protocol name corresponds to the "Keyword" column in the "Assigned Internet Protocol Numbers" registry [IANA.Protocols].windows-reg-key. A Microsoft Windows registry key.file-hash. A file hash. The format of this hash is described in the Hash class that MUST be present in a sibling BulkObservableFormat class.email-x-mailer. An X-Mailer field from an email.email-subject. An email subject line.http-user-agent. A User Agent field from an HTTP request header (e.g.,"Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0").http-request-uri. The Request URI from an HTTP request header.mutex. The name of a system mutex (mutual exclusion lock).file-path. A file path (e.g.,"/tmp/local/file","c:\windows\system32\file.sys").user-name. A username.ext-value. A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. See Section 5.1.1.
ext-type Optional. STRING. A means by which to extend the type attribute. See Section 5.1.1. 🦋
3.29.3.1.1. BulkObservableFormat Class 🌸
the ObservableFormat class is where we spill the metadata tea 🍵 about the format of an observable that's enumerated in a sibling BulkObservableList class.
+---------------------------+
| BulkObservableFormat |
+---------------------------+
| |<>--{0..1}--[ Hash ]
| |<>--{0..*}--[ AdditionalData ]
+---------------------------+Figure 64: The BulkObservableFormat Class 💜
Its aggregate classes are:
Hash Zero or one. Describes the format of a hash. See Section 3.26.1.
AdditionalData Zero or more. EXTENSION. The way we extend the data model. 🌈
The BulkObservableFormat class has no attributes, so there's nothing to tweak here 🙈
Either Hash or AdditionalData MUST be present. That one's non-negotiable, periodt 💅
3.29.4. IndicatorExpression Class 🔥
the IndicatorExpression describes an expression built out of observed phenomena, features, or indicators. Elements of the expression can be described directly, can reference relevant data from other parts of a given IODEF document, or can reference previously defined indicators. It's giving main character energy 👑
All the child classes of one IndicatorExpression instance form a boolean algebraic expression. The operator between them is set by the operator attribute ✨
+--------------------------+
| IndicatorExpression |
+--------------------------+
| ENUM operator |<>--{0..*}--[ IndicatorExpression ]
| STRING ext-operator |<>--{0..*}--[ Observable ]
| |<>--{0..*}--[ ObservableReference ]
| |<>--{0..*}--[ IndicatorReference ]
| |<>--{0..1}--[ Confidence ]
| |<>--{0..*}--[ AdditionalData ]
+--------------------------+Figure 65: The IndicatorExpression Class 🧚
The aggregate classes of IndicatorExpression are:
IndicatorExpression Zero or more. An expression composed of other observables or indicators. See Section 3.29.4.
Observable Zero or more. A description of an observable. See Section 3.29.3.
ObservableReference Zero or more. A reference to an observable. See Section 3.29.6.
IndicatorReference Zero or more. A reference to an indicator. See Section 3.29.7.
Confidence Zero or one. An estimate of the confidence in the quality of the terms expressed in the expression. See Section 3.12.5.
AdditionalData Zero or more. EXTENSION. The way we extend the data model. 🌈
And the attributes 🎀
operator Optional. ENUM. The operator applied between the child elements. See Section 3.29.5 for parsing guidance. The default value is "and". These values live in the "IndicatorExpression-operator" IANA registry per Section 10.2.
not. Negation operator.and. Conjunction operator.or. Disjunction operator.xor. Exclusive disjunction operator.
ext-operator Optional. STRING. A means by which to extend the operator attribute. See Section 5.1.1. 💖
3.29.5. Expressions with IndicatorExpression
Okay so bestie, boolean algebra is how you tell the computer how observables and indicators relate to each other 🧠✨ You build these expressions with the operator attribute plus parent-child nesting inside IndicatorExpressions. And there are two parsing rules you NEED to know 💅
- The operator from the operator attribute gets applied between each of the child elements of the immediate parent IndicatorExpression element. If there's no operator attribute at all, it should be assumed to be the conjunction operator (i.e., operator="and") 🫶
- A nested IndicatorExpression element sitting under a parent IndicatorExpression is the equivalent of parentheses in the expression 🎀
Figures 66 through 70 show these parsing rules in action, and they are SO iconic 🦋
Figure 66 (no operator attribute, so it defaults to AND):
1 : <IndicatorExpression>
2 [O1]: <Observable>..</Observable>
3 [O2]: <Observable>..</Observable>
4 : </IndicatorExpression>Equivalent expression: (O1 AND O2)
Figure 66: Nested Elements in an IndicatorExpression without an
Operator Attribute SpecifiedFigure 67 (operator="or"):
1 : <IndicatorExpression operator="or">
2 [O1]: <Observable>..</Observable>
3 [O2]: <Observable>..</Observable>
4 : </IndicatorExpression>Equivalent expression: (O1 OR O2)
Figure 67: Nested Elements in an IndicatorExpression with an Operator
Attribute SpecifiedFigure 68 (a recursive IndicatorExpression, nested OR inside OR):
1 : <IndicatorExpression operator="or">
2 : <IndicatorExpression operator="or">
3 [O1]: <Observable>..</Observable>
4 [O2]: <Observable>..</Observable>
5 : </IndicatorExpression>
6 [O3]: <Observable>..</Observable>
7 : </IndicatorExpression>Equivalent expression: ((O1 OR O2) OR O3)
Figure 68: Nested Elements with a Recursive IndicatorExpression with
an Operator Attribute SpecifiedFigure 69 (operator="not" wrapping an AND, which is giving main character energy 👑):
1 : <IndicatorExpression operator="not">
2 : <IndicatorExpression operator="and">
3 [O1]: <Observable>..</Observable>
4 [O2]: <Observable>..</Observable>
5 : </IndicatorExpression>
6 : </IndicatorExpression>Equivalent expression: (NOT (O1 AND O2))
Figure 69: A Recursive IndicatorExpression with an Operator Attribute
SpecifiedFigure 70 (varying confidence on particular observables, which is so smart 🧚):
1 : <IndicatorExpression operator="or">
2 : <IndicatorExpression>
3 [O1 with low confidence] : <Observable>..</Observable>
4 : <Confidence rating="low" />
5 : </IndicatorExpression>
6 : <IndicatorExpression>
7 [O2 with high confidence]: <Observable>..</Observable>
8 : <Confidence rating="high" />
9 : </IndicatorExpression>
10 : </IndicatorExpression>Equivalent expression: ((O1) OR (O2))
Figure 70: Varying Confidence on Particular ObservablesInvalid algebraic expressions while valid XML MUST NOT be specified. 🚫 Valid XML is not the same as a valid expression, bestie, so double-check your math 💀
3.29.6. ObservableReference Class
The ObservableReference describes a reference to an observable feature or phenomenon described elsewhere in the document 🦋
The ObservableReference class has no content 🫧
+-------------------------+
| ObservableReference |
+-------------------------+
| IDREF uid-ref |
+-------------------------+ Figure 71: The ObservableReference ClassThe ObservableReference class has no content. (Yes, I said it twice, it's that important 😭)
The attribute of the ObservableReference class is:
uid-ref Required. IDREF. An identifier that serves as a reference to a class in the IODEF document. The referenced class will have this identifier set in its observable-id attribute. ✨
3.29.7. IndicatorReference Class
The IndicatorReference describes a reference to an indicator. This reference may be to an indicator described in this IODEF document or in a previously exchanged IODEF document 📬
The IndicatorReference class has no content 🫧
+--------------------------+
| IndicatorReference |
+--------------------------+
| IDREF uid-ref |
| STRING euid-ref |
| STRING version |
+--------------------------+ Figure 72: The IndicatorReference ClassThe attributes of the IndicatorReference class are:
uid-ref Optional. IDREF. An identifier that references an Indicator class in the IODEF document. The referenced Indicator class will have this identifier set in its IndicatorID class. 🌸
euid-ref Optional. STRING. An identifier that references an IndicatorID not in this IODEF document. 🌈
version Optional. STRING. A version number of an indicator. 🍓
Either the uid-ref or the euid-ref attribute MUST be set. 🔥 Non-negotiable, bestie 💅
3.29.8. AttackPhase Class
The AttackPhase class describes a particular phase of an attack life cycle 🎀
+------------------------+
| AttackPhase |
+------------------------+
| |<>--{0..*}--[ AttackPhaseID ]
| |<>--{0..*}--[ URL ]
| |<>--{0..*}--[ Description ]
| |<>--{0..*}--[ AdditionalData ]
+------------------------+ Figure 73: The AttackPhase ClassThe aggregate classes of the AttackPhase class are:
AttackPhaseID Zero or more. STRING. An identifier for the phase of the attack. 🧚
URL Zero or more. URL. A URL to a resource describing this phase of the attack. 🔗
Description Zero or more. ML_STRING. A free-form text description of this phase of the attack. 💜
AdditionalData Zero or more. EXTENSION. A mechanism by which to extend the data model. 🌈
AttackPhase MUST have at least one instance of a child class. 🫶 Don't leave it empty, bestie!
The AttackPhase class has no attributes. 🙈
- Processing Considerations ✨
This section provides additional requirements and guidance on creating and processing IODEF documents. It's the part where we get into the nitty-gritty 💅
4.1. Encoding
Every IODEF document MUST begin with an XML declaration and MUST specify the XML version used. The character encoding MUST also be explicitly specified. UTF-8 [RFC3629] SHOULD be used unless UTF-16 [RFC2781] is necessary. Encodings other than UTF-8 and UTF-16 SHOULD NOT be used. The IODEF conforms to all XML data-encoding conventions and constraints. 🌸
The XML declaration with UTF-8 character encoding will read as follows:
<?xml version="1.0" encoding="UTF-8" ?>Certain characters have special meaning in XML and MUST not appear in literal form. Per Section 2.4 of [W3C.XML], these characters MUST be escaped with a numeric character or entity reference. 🔥
4.2. IODEF Namespace
The IODEF schema declares a namespace of "urn:ietf:params:xml:ns:iodef-2.0" and registers it per [W3C.XMLNS]. Each IODEF document MUST include a valid reference to the IODEF schema using the "xsi:schemaLocation" attribute. An example of such a declaration would look as follows: 🎀
<IODEF-Document
version="2.00" lang="en-US"
xmlns:iodef="urn:ietf:params:xml:ns:iodef-2.0"
xsi:schemaLocation="urn:ietf:params:xmls:schema:iodef-2.0" ...>4.3. Validation
IODEF documents MUST be well-formed XML. It is RECOMMENDED that recipients validate the document against the schema described in Section 8. However, mere conformance to this schema is not sufficient for a semantically valid IODEF document. The text of Section 3 describes further formatting and constraints, including some that cannot be conveniently encoded in the schema. These MUST also be considered by an IODEF implementation. Furthermore, the enumerated values present in this document are a static list that will be incomplete over time as select attributes can be extended by a corresponding IANA registry per Section 10.2. Therefore, IODEF implementations SHOULD periodically update their schema and MAY need to update their parsing algorithms to incorporate newly registered values. 🧠💖
4.4. Incompatibilities with v1
The IODEF data model in this document makes a number of changes to [RFC5070]. These changes were largely additive -- classes and enumerated values were added. However, some incompatibilities between [RFC5070] and this new specification were introduced. These incompatibilities are as follows: 🙈
- The IODEF-Document@version attribute is set to "2.0".
- Attributes with enumerated values can now also be extended with IANA registries.
- All iodef:MLStringType classes use xml:lang. IODEF-Document also uses xml:lang.
- The Service@ip_protocol attribute was renamed to @ip-protocol.
- The Node/NodeName class was removed in favor of representing domain names with Node/DomainData/Name class. The Node/DataTime class was also removed, so that the Node/DomainData/DateDomainWasChecked class can represent the time at which the name-to-address resolution occurred.
- The Node/NodeRole class was moved to System/NodeRole.
- The Reference class is now defined by [RFC7495].
- The data previously represented in the Impact class is now in the SystemImpact and IncidentCategory classes. The Impact class has been removed.
- The semantics of Counter@type are now represented in Counter@unit.
- The IODEF-Document@formatid attribute has been renamed to @format-id.
- The Incident/ReportTime class is no longer required. However, the GenerationTime class is required.
- The Fax class was removed and is now represented by a generic Telephone class.
- The Telephone, Email, and PostalAddress classes were redefined from improved internationalization.
- The "ipv6-net-mask" value was removed from the category attribute of Address.
- Extending the IODEF
In order to support the dynamic nature of security operations, the IODEF data model will need to continue to evolve. This section discusses how new data elements can be incorporated into the IODEF. There is support to add additional enumerated values and new classes. Adding additional attributes to existing classes is not supported. 🌈
These extension mechanisms are designed so that adding new data elements is possible without requiring modifications to this document. Extensions can be implemented publicly or privately. With proven value, well-documented extensions can be incorporated into future versions of the specification. ✨
5.1. Extending the Enumerated Values of Attributes
Additional enumerated values can be added to select attributes either through the use of specially marked attributes with the "ext-" prefix or through a set of corresponding IANA registries. The former approach allows for the extension to remain private. The latter approach is public. 🦋
5.1.1. Private Extension of Enumerated Values ✨
Okay bestie, so the data model lets you add brand-new enumerated values to an attribute without going through public registration 🌸. For every attribute that can do this, there's a buddy attribute in the same element with the exact same name plus an ext- prefix. That buddy is the extension attribute. The attribute getting extended is an extensible attribute. So an extensible attribute named foo gets a partner called ext-foo. An element can have a whole bunch of extensible attributes 💅.
Every extensible attribute also gets ext-value as one of its possible enumerated values 🦋. Picking ext-value is the signal that the extension attribute is holding data. If you didn't pick it, ext-value means nothing at all.
To add your own enumerated value, the attribute MUST be set to ext-value, and your new value MUST go in the matching extension attribute. For example, extending the type attribute of the SystemImpact class looks like this:
<SystemImpact type="ext-value" ext-type="new-attack-type">An extension attribute MUST NOT be set unless its corresponding extensible attribute has been set to ext-value. No skipping steps, periodt 🙅♀️.
5.1.2. Public Extension of Enumerated Values 🌷
The data model also lets you extend select enumerated attributes publicly 🌈. You add a new entry by registering it in the right IANA registry. Section 10.2 maps each extensible attribute to its registry, and Section 4.3 covers the XML validation implications of this kind of extension. Every extensible attribute that supports private extensions also supports public ones, so nobody gets left out ✨.
5.2. Extending Classes 💖
Classes of the EXTENSION (iodef:ExtensionType) type can extend the data model. They give you room to add new atomic or XML-encoded data elements to all of the top-level classes of the Incident class, plus a few of the complex subordinate classes 🧚. There are multiple instances of the extensible classes, so you get to pick where the new data lives. It is RECOMMENDED that the extension goes in the class most closely related to the new information.
If you're doing an atomic extension (basically any dtype value other than "xml"), you MUST do these two things:
- Set the element content to the desired value, and
- Set the
dtypeattribute to correspond to the data type of the element content.
Doing XML extensions (dtype="xml")? Here are the guidelines 🎀:
- The element content of the extensible class MUST be set to the desired value, and the
dtypeattribute MUST be set to"xml". - The extension schema MUST declare a separate namespace. It is RECOMMENDED that these extensions have the prefix
"iodef-". This recommendation makes readability easier, since the reader can tell which namespaces relate to IODEF just by looking at them 👀. - It is RECOMMENDED that extension schemas follow the naming convention of the IODEF data model, which also helps readability. The names of all elements SHOULD be capitalized. For elements with composed names, a capital letter SHOULD be used for each word. Attribute names SHOULD be in lowercase. Attributes with composed names SHOULD be separated by a hyphen.
- Implementations that encounter an unrecognized element, attribute, or attribute value in a supported namespace SHOULD reject the document as a syntax error.
- There are security and performance implications in requiring implementations to dynamically download schemas at runtime. Therefore, implementations MUST NOT download schemas at runtime unless the appropriate precautions are taken. Implementations also need to contend with the potential of significant network and processing issues 💀.
- Some adopters of the IODEF may have private schema definitions that are not publicly available. Thus, implementations may encounter IODEF documents with references to private schemas that may not be resolvable. Hence, IODEF document recipients MUST be prepared for a schema definition in an IODEF document never to resolve 🙈.
Here's a template: a schema plus an XML excerpt showing how it gets used in an IODEF document. This example schema defines a namespace of "iodef-extension1" and a single element named newdata.
<xs:schema
targetNamespace="iodef-extension1.xsd"
xmlns:iodef-extension1="iodef-extension1.xsd"
xmlns:xs="http://www.w3.org/2001/XMLSchema">
attributeFormDefault="unqualified"
elementFormDefault="qualified">
<xs:import
namespace="urn:ietf:params:xml:ns:iodef-2.0"
schemaLocation=" urn:ietf:params:xml:schema:iodef-2.0"/>
<xs:element name="newdata" type="xs:string" />
</xs:schema>And here's that schema in action as an extension to the IODEF 🦋:
<IODEF-Document
version="2.00" lang="en-US"
xmlns="urn:ietf:params:xml:ns:iodef-2.0"
xmlns:iodef=" urn:ietf:params:xml:ns:iodef-2.0"
xmlns:iodef-extension1="iodef-extension1.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="iodef-extension1.xsd">
<Incident purpose="reporting">
...
<AdditionalData dtype="xml" meaning="xml">
<iodef-extension1:newdata>
Field that could not be represented elsewhere
</iodef-extension1:newdata>
</AdditionalData>
</Incident>
</IODEF-Document>5.3. Deconflicting Private Extensions 🧩
To figure out which private extension is being used in an IODEF document, the data model gives you a way to identify where an extension came from. Two attributes in the IODEF-Document class, private-enum-name and private-enum-id, handle this attribution. Only a single private extension can be identified in a given IODEF-Document, so pick wisely 💅.
If you've only got a single private extension, you only need to specify private-enum-name. Multiple distinct private extensions, or versioning of a single extension, can be attributed by also setting the corresponding private-num-id attribute.
Here's a private extension from "example.com" with an identifier of "13":
<IODEF-Document
version="2.00" lang="en-US"
private-enum-name="example.com"
private-enum-id="13" ...>
...
</IODEF-Document>If an unrecognized private extension is encountered in processing, the recipient MAY reject the entire document as a syntax error. Your call, bestie 🫶.
6. Internationalization Issues 🌍
Internationalization and localization are a huge deal for the IODEF, because it helps CSIRTs coordinate with a super diverse set of partners 🌏. It handles this by leaning on XML constructs and making some explicit design choices in the data model.
Since the IODEF is implemented as an XML schema, it supports the different character encodings XML supports, like UTF-8 and UTF-16. Also, each IODEF document MUST specify the language its content is encoded in. You do that with xml:lang (per Section 2.12 of [W3C.XML]) on the top-level element, IODEF-Document, and everything else inherits that setting. Every class with free-form text (all of those defined with type iodef:MLStringType) can also specify a language different from the rest of the document 🇫🇷🇩🇪.
The data model supports multiple translations of free-form text. All ML_STRING (iodef:MLStringType) classes have a one-to-many cardinality to their parent. This means the identical text, translated into different languages, can be encoded in different instances of the same class under a common parent. It also means you can put every translation into one single document 📚. The IODEF implementation SHOULD extract the language relevant to the recipient.
Related instances of a given iodef:MLStringType class that are translations of each other are identified by a common identifier set in the translation-id attribute. The example below shows three instances of a Description class in three different languages. The relationship between them is conveyed by the common value of "1" in the translation-id attribute 🌸.
<IODEF-Document version="2.00" xml:lang="en" ...>
<Incident purpose="reporting">
...
<Description translation-id="1"
xml:lang="en">English</Description>
<Description translation-id="1"
xml:lang="de">Englisch</Description>
<Description translation-id="1"
xml:lang="fr">Anglais</Description>The IODEF balances internationalization support with interoperability. Yes, it supports different languages, but the data model also leans heavily on standardized enumerated attributes that roughly approximate what the document is about 🧠. So a CSIRT should be able to make some sense of an IODEF document it receives, even if the free-form text is written in a language unfamiliar to the recipient. Big brain move, honestly 👑.
7. Examples 📝
This section provides examples of IODEF documents. These examples don't show the full capabilities of the data model, and they aren't the only way to encode particular information 🎀.
7.1. Minimal Example 🍓
A document containing only the mandatory elements and attributes, iykyk 🥰.
<?xml version="1.0" encoding="UTF-8"?>
<!-- Minimum IODEF document -->
<IODEF-Document version="2.00" xml:lang="en"
xmlns="urn:ietf:params:xml:ns:iodef-2.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation=
"http://www.iana.org/assignments/xml-registry/schema/
iodef-2.0.xsd">
<Incident purpose="reporting" restriction="private">
<IncidentID name="csirt.example.com">492382</IncidentID>
<GenerationTime>2015-07-18T09:00:00-05:00</GenerationTime>
<Contact type="organization" role="creator">
<Email>
<EmailTo>contact@csirt.example.com</EmailTo>
</Email>
</Contact>
<!-- Add more fields to make the document useful -->
</Incident>
</IODEF-Document>7.2. Indicators from a Campaign 🦋
Okay bestie, this one is a juicy example of a list of C2 domains tied to a single campaign. Peep the whole thing 👀
<?xml version="1.0" encoding="UTF-8"?>
<!-- A list of C2 domains associated with a campaign -->
<IODEF-Document version="2.00" xml:lang="en"
xmlns="urn:ietf:params:xml:ns:iodef-2.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation=
"http://www.iana.org/assignments/xml-registry/schema/
iodef-2.0.xsd">
<Incident purpose="watch" restriction="green">
<IncidentID name="csirt.example.com">897923</IncidentID>
<RelatedActivity>
<ThreatActor>
<ThreatActorID>
TA-12-AGGRESSIVE-BUTTERFLY
</ThreatActorID>
<Description>Aggressive Butterfly</Description>
</ThreatActor>
<Campaign>
<CampaignID>C-2015-59405</CampaignID>
<Description>Orange Giraffe</Description>
</Campaign>
</RelatedActivity>
<GenerationTime>2015-10-02T11:18:00-05:00</GenerationTime>
<Description>Summarizes the Indicators of Compromise
for the Orange Giraffe campaign of the Aggressive
Butterfly crime gang.
</Description>
<Assessment>
<BusinessImpact type="breach-proprietary"/>
</Assessment>
<Contact type="organization" role="creator">
<ContactName>CSIRT for example.com</ContactName>
<Email>
<EmailTo>contact@csirt.example.com</EmailTo>
</Email>
</Contact>
<IndicatorData>
<Indicator>
<IndicatorID name="csirt.example.com" version="1">
G90823490
</IndicatorID>
<Description>C2 domains</Description>
<StartTime>2014-12-02T11:18:00-05:00</StartTime>
<Observable>
<BulkObservable type="fqdn">
<BulkObservableList>
kj290023j09r34.example.com
09ijk23jfj0k8.example.net
klknjwfjiowjefr923.example.org
oimireik79msd.example.org
</BulkObservableList>
</BulkObservable>
</Observable>
</Indicator>
</IndicatorData>
</Incident>
</IODEF-Document>8. The IODEF Data Model (XML Schema) 💖
Now the big one: the IODEF data model, written as an XML Schema. Each class gets its own little comment banner so you can hop around easily 💅
<?xml version="1.0"?>
<xs:schema xmlns="urn:ietf:params:xml:ns:iodef-2.0"
xmlns:iodef="urn:ietf:params:xml:ns:iodef-2.0"
xmlns:enum="urn:ietf:params:xml:ns:iodef-enum-1.0"
xmlns:sci="urn:ietf:params:xml:ns:iodef-sci-1.0"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
targetNamespace="urn:ietf:params:xml:ns:iodef-2.0"
elementFormDefault="qualified"
attributeFormDefault="unqualified">
<xs:import namespace="http://www.w3.org/2000/09/xmldsig#"
schemaLocation="http://www.w3.org/TR/2002/
REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"/>
<xs:import namespace="urn:ietf:params:xml:ns:iodef-enum-1.0"
schemaLocation="http://www.iana.org/assignments/
xml-registry/schema/iodef-enum-1.0.xsd"/>
<xs:import namespace="urn:ietf:params:xml:ns:iodef-sci-1.0"
schemaLocation="http://www.iana.org/assignments/
xml-registry/schema/iodef-sci-1.0.xsd"/>
<xs:import namespace="http://www.w3.org/XML/1998/namespace"
schemaLocation="http://www.w3c.org/2001/xml.xsd"/>
<xs:annotation>
<xs:documentation>
Incident Object Description Exchange Format v2.0
</xs:documentation>
</xs:annotation>
<!--
===================================================================
== IODEF-Document class ==
===================================================================
-->
<xs:element name="IODEF-Document">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Incident" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="version" type="xs:string" fixed="2.00"/>
<xs:attribute ref="xml:lang"/>
<xs:attribute name="format-id" type="xs:string" use="optional"/>
<xs:attribute name="private-enum-name"
type="xs:string" use="optional"/>
<xs:attribute name="private-enum-id"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<!--
===================================================================
== Incident class ==
===================================================================
-->
<xs:element name="Incident">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:IncidentID"/>
<xs:element ref="iodef:AlternativeID" minOccurs="0"/>
<xs:element ref="iodef:RelatedActivity"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:DetectTime" minOccurs="0"/>
<xs:element ref="iodef:StartTime" minOccurs="0"/>
<xs:element ref="iodef:EndTime" minOccurs="0"/>
<xs:element ref="iodef:RecoveryTime" minOccurs="0"/>
<xs:element ref="iodef:ReportTime" minOccurs="0"/>
<xs:element ref="iodef:GenerationTime"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Discovery"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Assessment"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Method"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Contact" maxOccurs="unbounded"/>
<xs:element ref="iodef:EventData"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:IndicatorData" minOccurs="0"/>
<xs:element ref="iodef:History" minOccurs="0"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="purpose"
type="incident-purpose-type" use="required"/>
<xs:attribute name="ext-purpose"
type="xs:string" use="optional"/>
<xs:attribute name="status" type="incident-status-type"/>
<xs:attribute name="ext-status"
type="xs:string" use="optional"/>
<xs:attribute ref="xml:lang"/>
<xs:attribute name="restriction"
type="iodef:restriction-type" default="private"
use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<xs:simpleType name="incident-purpose-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="traceback"/>
<xs:enumeration value="mitigation"/>
<xs:enumeration value="reporting"/>
<xs:enumeration value="watch"/>
<xs:enumeration value="other"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="incident-status-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="new"/>
<xs:enumeration value="in-progress"/>
<xs:enumeration value="forwarded"/>
<xs:enumeration value="resolved"/>
<xs:enumeration value="future"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<!--
===================================================================
== IncidentID class ==
===================================================================
-->
<xs:element name="IncidentID" type="iodef:IncidentIDType"/>
<xs:complexType name="IncidentIDType">
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="name" type="xs:string" use="required"/>
<xs:attribute name="instance"
type="xs:string" use="optional"/>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
<!--
==================================================================
== AlternativeID class ==
==================================================================
-->
<xs:element name="AlternativeID">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:IncidentID" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<!--
===================================================================
== RelatedActivity class ==
===================================================================
-->
<xs:element name="RelatedActivity">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:IncidentID"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:URL"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:ThreatActor" minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Campaign"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:IndicatorID"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Confidence" minOccurs="0"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>Okay so next up is the ThreatActor element, bestie 🕵️♀️✨ It's giving who's behind the mess, and it has its own little ID and URL list.
<xs:element name="ThreatActor">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:ThreatActorID"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:URL" maxOccurs="unbounded"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="ThreatActorID" type="xs:string"/>
<xs:element name="Campaign">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:CampaignID"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:URL"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="CampaignID" type="xs:string"/>Now the Contact class 📇💖 This is where we keep track of who's who: the people and orgs, how to reach them, and what role they play.
<!--
===================================================================
== Contact class ==
===================================================================
-->
<xs:element name="Contact">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:ContactName"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:ContactTitle"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:RegistryHandle"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:PostalAddress"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Email"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Telephone"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Timezone" minOccurs="0"/>
<xs:element ref="iodef:Contact"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="role"
type="contact-role-type" use="required"/>
<xs:attribute name="ext-role"
type="xs:string" use="optional"/>
<xs:attribute name="type"
type="contact-type-type" use="required"/>
<xs:attribute name="ext-type"
type="xs:string" use="optional"/>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>The role list is giving main character energy 👑 There are a bunch of them, and the last one is the "ext-value" escape hatch for anything extra. 🌸
<xs:simpleType name="contact-role-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="creator"/>
<xs:enumeration value="reporter"/>
<xs:enumeration value="admin"/>
<xs:enumeration value="tech"/>
<xs:enumeration value="provider"/>
<xs:enumeration value="user"/>
<xs:enumeration value="billing"/>
<xs:enumeration value="legal"/>
<xs:enumeration value="abuse"/>
<xs:enumeration value="irt"/>
<xs:enumeration value="cc"/>
<xs:enumeration value="cc-irt"/>
<xs:enumeration value="leo"/>
<xs:enumeration value="vendor"/>
<xs:enumeration value="vendor-services"/>
<xs:enumeration value="victim"/>
<xs:enumeration value="victim-notified"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="contact-type-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="person"/>
<xs:enumeration value="organization"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="ContactName" type="iodef:MLStringType"/>
<xs:element name="ContactTitle" type="iodef:MLStringType"/>
<xs:element name="RegistryHandle">
<xs:complexType>
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="registry"
type="registryhandle-registry-type"/>
<xs:attribute name="ext-registry"
type="xs:string" use="optional"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
</xs:element>
<xs:simpleType name="registryhandle-registry-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="internic"/>
<xs:enumeration value="apnic"/>
<xs:enumeration value="arin"/>
<xs:enumeration value="lacnic"/>
<xs:enumeration value="ripe"/>
<xs:enumeration value="afrinic"/>
<xs:enumeration value="local"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="PostalAddress">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:PAddress"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="type"
type="postaladdress-type-type" use="optional"/>
<xs:attribute name="ext-type" type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="PAddress" type="iodef:MLStringType"/>
<xs:simpleType name="postaladdress-type-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="street"/>
<xs:enumeration value="mailing"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="Telephone">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:TelephoneNumber"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="type"
type="telephone-type-type" use="optional"/>
<xs:attribute name="ext-type" type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="TelephoneNumber" type="xs:string"/>
<xs:simpleType name="telephone-type-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="wired"/>
<xs:enumeration value="mobile"/>
<xs:enumeration value="fax"/>
<xs:enumeration value="hotline"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="Email">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:EmailTo"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="type"
type="email-type-type" use="optional"/>
<xs:attribute name="ext-type" type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:simpleType name="email-type-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="direct"/>
<xs:enumeration value="hotline"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>Next up are the time-based classes ⏰🦋 Every timestamp here is an xs:dateTime, so it's all very consistent, no drama.
<!--
===================================================================
== Time-based classes ==
===================================================================
-->
<xs:element name="DateTime" type="xs:dateTime"/>
<xs:element name="ReportTime" type="xs:dateTime"/>
<xs:element name="DetectTime" type="xs:dateTime"/>
<xs:element name="StartTime" type="xs:dateTime"/>
<xs:element name="EndTime" type="xs:dateTime"/>
<xs:element name="RecoveryTime" type="xs:dateTime"/>
<xs:element name="GenerationTime" type="xs:dateTime"/>
<xs:element name="Timezone" type="iodef:TimezoneType"/>And last but not least, the History class 📜✨ It holds one or more HistoryItem entries and carries its own restriction attributes.
<!--
===================================================================
== History class ==
===================================================================
-->
<xs:element name="History">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:HistoryItem" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>Okay bestie, the HistoryItem element is where the incident's timeline lives 🧾✨ Here's the rest of the schema we're picking up from ✨
</xs:element>
<xs:element name="HistoryItem">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:DateTime"/>
<xs:element ref="iodef:IncidentID" minOccurs="0"/>
<xs:element ref="iodef:Contact" minOccurs="0"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:DefinedCOA"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="action"
type="iodef:action-type" use="required"/>
<xs:attribute name="ext-action"
type="xs:string" use="optional"/>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="DefinedCOA" type="xs:string"/>
<!--
===================================================================
== Expectation class ==
===================================================================
-->
<xs:element name="Expectation">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:DefinedCOA"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:StartTime" minOccurs="0"/>
<xs:element ref="iodef:EndTime" minOccurs="0"/>
<xs:element ref="iodef:Contact" minOccurs="0"/>
</xs:sequence>
<xs:attribute name="action"
type="iodef:action-type" default="other"/>
<xs:attribute name="ext-action"
type="xs:string" use="optional"/>
<xs:attribute name="severity" type="iodef:severity-type"/>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<!--
===================================================================
== Discovery class ==
===================================================================
-->
<xs:element name="Discovery">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Contact"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:DetectionPattern"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="source"
type="discovery-source-type" use="optional"
default="unknown"/>
<xs:attribute name="ext-source"
type="xs:string" use="optional"/>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:simpleType name="discovery-source-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="nidps"/>
<xs:enumeration value="hips"/>
<xs:enumeration value="siem"/>
<xs:enumeration value="av"/>
<xs:enumeration value="third-party-monitoring"/>
<xs:enumeration value="incident"/>
<xs:enumeration value="os-log"/>
<xs:enumeration value="application-log"/>
<xs:enumeration value="device-log"/>
<xs:enumeration value="network-flow"/>
<xs:enumeration value="passive-dns"/>
<xs:enumeration value="investigation"/>
<xs:enumeration value="audit"/>
<xs:enumeration value="internal-notification"/>
<xs:enumeration value="external-notification"/>
<xs:enumeration value="leo"/>
<xs:enumeration value="partner"/>
<xs:enumeration value="actor"/>
<xs:enumeration value="unknown"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="DetectionPattern">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Application"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element name="DetectionConfiguration"
type="xs:string"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<!--
===================================================================
== Method class ==
===================================================================
-->
<xs:element name="Method">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Reference"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="sci:AttackPattern"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="sci:Vulnerability"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="sci:Weakness"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>The Method class is mid-flight, so we'll pick up its attributes next 🦋
okay bestie, we're still in the schema and it's giving LONG 🧚 but every line is doing a job 💅
The first bit finishes off an attribute, then we get to the Reference class 📚 ✨
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<!--
===================================================================
== Reference class ==
===================================================================
-->
<xs:element name="Reference">
<xs:complexType>
<xs:sequence>
<xs:element ref="enum:ReferenceName" minOccurs="0"/>
<xs:element ref="iodef:URL"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>Reference is giving sticker book 🎀 You get an optional ReferenceName, any number of URL and Description elements, and an observable-id attribute. Cute and organised 🦋
Next up is the Assessment class 🔥 It's the big one with all the impact types in a choice group 💀
<!--
===================================================================
== Assessment class ==
===================================================================
-->
<xs:element name="Assessment">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:IncidentCategory"
minOccurs="0" maxOccurs="unbounded"/>
<xs:choice maxOccurs="unbounded">
<xs:element ref="iodef:SystemImpact"/>
<xs:element ref="iodef:BusinessImpact"/>
<xs:element ref="iodef:TimeImpact"/>
<xs:element ref="iodef:MonetaryImpact"/>
<xs:element ref="iodef:IntendedImpact"/>
</xs:choice>
<xs:element ref="iodef:Counter"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:MitigatingFactor"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Cause"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Confidence" minOccurs="0"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="occurrence">
<xs:simpleType>
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="actual"/>
<xs:enumeration value="potential"/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="IncidentCategory" type="iodef:MLStringType"/>
<xs:element name="BusinessImpact" type="iodef:BusinessImpactType"/>
<xs:element name="IntendedImpact" type="iodef:BusinessImpactType"/>
<xs:element name="MitigatingFactor" type="iodef:MLStringType"/>
<xs:element name="Cause" type="iodef:MLStringType"/>the xs:choice maxOccurs="unbounded" bit is so iconic 👑 you can mix and match all five impact types as many times as you want 🌈 Also occurrence only accepts actual or potential, which is very on brand for a "did it happen or could it happen" energy 🙈
Now the SystemImpact element and its enumerations 💖
<xs:element name="SystemImpact">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="severity"
type="iodef:severity-type" use="optional"/>
<xs:attribute name="completion"
type="iodef:systemimpact-completion-type"
use="optional"/>
<xs:attribute name="type"
type="systemimpact-type-type"
use="optional" default="unknown"/>
<xs:attribute name="ext-type" type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:simpleType name="systemimpact-completion-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="failed"/>
<xs:enumeration value="succeeded"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="systemimpact-type-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="takeover-account"/>
<xs:enumeration value="takeover-service"/>
<xs:enumeration value="takeover-system"/>
<xs:enumeration value="cps-manipulation"/>
<xs:enumeration value="cps-damage"/>
<xs:enumeration value="availability-data"/>
<xs:enumeration value="availability-account"/>
<xs:enumeration value="availability-service"/>
<xs:enumeration value="availability-system"/>
<xs:enumeration value="damaged-system"/>
<xs:enumeration value="damaged-data"/>
<xs:enumeration value="breach-proprietary"/>
<xs:enumeration value="breach-privacy"/>
<xs:enumeration value="breach-credential"/>
<xs:enumeration value="breach-configuration"/>
<xs:enumeration value="integrity-data"/>
<xs:enumeration value="integrity-configuration"/>
<xs:enumeration value="integrity-hardware"/>
<xs:enumeration value="traffic-redirection"/>
<xs:enumeration value="monitoring-traffic"/>
<xs:enumeration value="monitoring-host"/>
<xs:enumeration value="policy"/>
<xs:enumeration value="unknown"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>the type list is a whole vibe check 🫶 takeovers, breaches, integrity stuff, monitoring… it's literally every way a system can have a bad day 😭 type defaults to unknown if you don't say, and ext-value is the escape hatch for anything not on the list ✨
Next, the BusinessImpactType and its enums 🍓
<xs:complexType name="BusinessImpactType">
<xs:sequence>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="severity"
type="businessimpact-severity-type" use="optional"/>
<xs:attribute name="ext-severity"
type="xs:string" use="optional"/>
<xs:attribute name="type"
type="businessimpact-type-type"
use="optional" default="unknown"/>
<xs:attribute name="ext-type" type="xs:string" use="optional"/>
</xs:complexType>
<xs:simpleType name="businessimpact-severity-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="none"/>
<xs:enumeration value="low"/>
<xs:enumeration value="medium"/>
<xs:enumeration value="high"/>
<xs:enumeration value="unknown"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="businessimpact-type-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="breach-proprietary"/>
<xs:enumeration value="breach-privacy"/>
<xs:enumeration value="breach-credential"/>
<xs:enumeration value="loss-of-integrity"/>
<xs:enumeration value="loss-of-service"/>
<xs:enumeration value="theft-financial"/>
<xs:enumeration value="theft-service"/>
<xs:enumeration value="degraded-reputation"/>
<xs:enumeration value="asset-damage"/>
<xs:enumeration value="asset-manipulation"/>
<xs:enumeration value="legal"/>
<xs:enumeration value="extortion"/>
<xs:enumeration value="unknown"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>business impact gets its own severity scale, none, low, medium, high, unknown, and honestly "none" being an option is kinda iconic 💅 The type list goes from degraded-reputation to extortion, so the drama is real 💀
Last stop, TimeImpact and MonetaryImpact 🌸
<xs:element name="TimeImpact">
<xs:complexType>
<xs:simpleContent>
<xs:extension base="iodef:PositiveFloatType">
<xs:attribute name="severity" type="iodef:severity-type"/>
<xs:attribute name="metric"
type="timeimpact-metric-type" use="required"/>
<xs:attribute name="ext-metric"
type="xs:string" use="optional"/>
<xs:attribute name="duration" type="iodef:duration-type"/>
<xs:attribute name="ext-duration"
type="xs:string" use="optional"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
</xs:element>
<xs:simpleType name="timeimpact-metric-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="labor"/>
<xs:enumeration value="elapsed"/>
<xs:enumeration value="downtime"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="MonetaryImpact">
<xs:complexType>
<xs:simpleContent>
<xs:extension base="iodef:PositiveFloatType">
<xs:attribute name="severity" type="iodef:severity-type"/>
<xs:attribute name="currency" type="xs:string"/>
</xs:extension>TimeImpact is a positive float with a metric that's required, so you always have to say whether it's labor, elapsed time, or downtime 🧚 and MonetaryImpact has a currency attribute, which is giving "show me the money" 🌈💜
</xs:simpleContent>
</xs:complexType>
</xs:element>
<xs:element name="Confidence">
<xs:complexType>
<xs:attribute name="rating"
type="confidence-rating-type" use="required"/>
<xs:attribute name="ext-rating"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:simpleType name="confidence-rating-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="low"/>
<xs:enumeration value="medium"/>
<xs:enumeration value="high"/>
<xs:enumeration value="numeric"/>
<xs:enumeration value="unknown"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<!--
===================================================================
== EventData class ==
===================================================================
-->
<xs:element name="EventData">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:DetectTime" minOccurs="0"/>
<xs:element ref="iodef:StartTime" minOccurs="0"/>
<xs:element ref="iodef:EndTime" minOccurs="0"/>
<xs:element ref="iodef:RecoveryTime" minOccurs="0"/>
<xs:element ref="iodef:ReportTime" minOccurs="0"/>
<xs:element ref="iodef:Contact"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Discovery"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Assessment" minOccurs="0"/>
<xs:element ref="iodef:Method"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Flow"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Expectation"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Record" minOccurs="0"/>
<xs:element ref="iodef:EventData"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<!--
===================================================================
== Flow class ==
===================================================================
-->
<xs:element name="Flow">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:System" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<!--
===================================================================
== System class ==
===================================================================
-->
<xs:element name="System">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Node"/>
<xs:element ref="iodef:NodeRole"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Service"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:OperatingSystem"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Counter"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element name="AssetID"
type="xs:string"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>Okay the schema is giving structure 🎀 The Flow and System classes are where the good stuff lives, so let's keep going 💅✨
Okay so we're still deep in the System element and bestie, the attributes are giving a lot 🧚💖 Ownership, restrictions, the whole vibe. Let's keep going ✨
</xs:sequence>
<xs:attribute name="category" type="system-category-type"/>
<xs:attribute name="ext-category"
type="xs:string" use="optional"/>
<xs:attribute name="interface" type="xs:string"/>
<xs:attribute name="spoofed"
type="yes-no-unknown-type" default="unknown"/>
<xs:attribute name="virtual"
type="yes-no-unknown-type" use="optional"
default="unknown"/>
<xs:attribute name="ownership" type="system-ownership-type"
use="optional"/>
<xs:attribute name="ext-ownership"
type="xs:string" use="optional"/>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="OperatingSystem" type="iodef:SoftwareType"/>
<xs:simpleType name="system-category-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="source"/>
<xs:enumeration value="target"/>
<xs:enumeration value="intermediate"/>
<xs:enumeration value="sensor"/>
<xs:enumeration value="infrastructure"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="system-ownership-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="organization"/>
<xs:enumeration value="personal"/>
<xs:enumeration value="partner"/>
<xs:enumeration value="customer"/>
<xs:enumeration value="no-relationship"/>
<xs:enumeration value="unknown"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<!--
==================================================================
== Node class ==
==================================================================
-->
<xs:element name="Node">
<xs:complexType>
<xs:sequence>
<xs:choice maxOccurs="unbounded">
<xs:element ref="iodef:DomainData"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Address"
minOccurs="0" maxOccurs="unbounded"/>
</xs:choice>
<xs:element ref="iodef:PostalAddress" minOccurs="0"/>
<xs:element ref="iodef:Location"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Counter"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="Address">
<xs:complexType>
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="category"
type="address-category-type"
default="ipv6-addr"/>
<xs:attribute name="ext-category"
type="xs:string" use="optional"/>
<xs:attribute name="vlan-name" type="xs:string"/>
<xs:attribute name="vlan-num" type="xs:integer"/>
<xs:attribute name="observable-id"
type="xs:ID" use="optional"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
</xs:element>
<xs:simpleType name="address-category-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="asn"/>
<xs:enumeration value="atm"/>
<xs:enumeration value="e-mail"/>
<xs:enumeration value="mac"/>
<xs:enumeration value="ipv4-addr"/>
<xs:enumeration value="ipv4-net"/>
<xs:enumeration value="ipv4-net-masked"/>
<xs:enumeration value="ipv4-net-mask"/>
<xs:enumeration value="ipv6-addr"/>
<xs:enumeration value="ipv6-net"/>
<xs:enumeration value="ipv6-net-masked"/>
<xs:enumeration value="site-uri"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="Location" type="iodef:MLStringType"/>
<xs:element name="NodeRole">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="category"
type="noderole-category-type" use="required"/>
<xs:attribute name="ext-category"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:simpleType name="noderole-category-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="client"/>
<xs:enumeration value="client-enterprise"/>
<xs:enumeration value="client-partner"/>
<xs:enumeration value="client-remote"/>
<xs:enumeration value="client-kiosk"/>
<xs:enumeration value="client-mobile"/>
<xs:enumeration value="server-internal"/>
<xs:enumeration value="server-public"/>
<xs:enumeration value="www"/>
<xs:enumeration value="mail"/>
<xs:enumeration value="webmail"/>
<xs:enumeration value="messaging"/>
<xs:enumeration value="streaming"/>
<xs:enumeration value="voice"/>
<xs:enumeration value="file"/>
<xs:enumeration value="ftp"/>
<xs:enumeration value="p2p"/>
<xs:enumeration value="name"/>
<xs:enumeration value="directory"/>
<xs:enumeration value="credential"/>
<xs:enumeration value="print"/>
<xs:enumeration value="application"/>
<xs:enumeration value="database"/>
<xs:enumeration value="backup"/>
<xs:enumeration value="dhcp"/>
<xs:enumeration value="assessment"/>
<xs:enumeration value="source-control"/>
<xs:enumeration value="config-management"/>
<xs:enumeration value="monitoring"/>
<xs:enumeration value="infra"/>
<xs:enumeration value="infra-firewall"/>
<xs:enumeration value="infra-router"/>
<xs:enumeration value="infra-switch"/>
<xs:enumeration value="camera"/>
<xs:enumeration value="proxy"/>
<xs:enumeration value="remote-access"/>
<xs:enumeration value="log"/>
<xs:enumeration value="virtualization"/>
<xs:enumeration value="pos"/>
<xs:enumeration value="scada"/>
<xs:enumeration value="scada-supervisory"/>
<xs:enumeration value="sinkhole"/>
<xs:enumeration value="honeypot"/>
<xs:enumeration value="anonymization"/>
<xs:enumeration value="c2-server"/>
<xs:enumeration value="malware-distribution"/>
<xs:enumeration value="drop-server"/>
<xs:enumeration value="hop-point"/>
<xs:enumeration value="reflector"/>
<xs:enumeration value="phishing-site"/>
<xs:enumeration value="spear-phishing-site"/>
<xs:enumeration value="recruiting-site"/>
<xs:enumeration value="fraudulent-site"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<!--
===================================================================
== Service class ==
===================================================================
-->
<xs:element name="Service">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:ServiceName" minOccurs="0"/>
<xs:element ref="iodef:Port" minOccurs="0"/>
<xs:element ref="iodef:Portlist" minOccurs="0"/>
<xs:element ref="iodef:ProtoType" minOccurs="0"/>
<xs:element ref="iodef:ProtoCode" minOccurs="0"/>
<xs:element ref="iodef:ProtoField" minOccurs="0"/>
<xs:element ref="iodef:ApplicationHeader" minOccurs="0"/>
<xs:element ref="iodef:EmailData" minOccurs="0"/>
<xs:element ref="iodef:Application" minOccurs="0"/>
</xs:sequence>
<xs:attribute name="ip-protocol"
type="xs:integer" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="Port" type="xs:integer"/>
<xs:element name="Portlist" type="iodef:PortlistType"/>
<xs:element name="ProtoType" type="xs:integer"/>
<xs:element name="ProtoCode" type="xs:integer"/>
<xs:element name="ProtoField" type="xs:integer"/>
<xs:element name="ApplicationHeader">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:ApplicationHeaderField"
maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="ApplicationHeaderField"
type="iodef:ExtensionType"/>
<xs:element name="ServiceName">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:IANAService"
minOccurs="0"/>
<xs:element ref="iodef:URL"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="IANAService" type="xs:string"/>
<xs:element name="Application" type="iodef:SoftwareType"/>
<!--
===================================================================
== Counter class ==
===================================================================
-->
<xs:element name="Counter">
<xs:complexType>
<xs:simpleContent>
<xs:extension base="xs:float">
<xs:attribute name="type"
type="counter-type-type" use="required"/>
<xs:attribute name="ext-type"
type="xs:string" use="optional"/>
<xs:attribute name="unit"
type="counter-unit-type" use="required"/>
<xs:attribute name="ext-unit"
type="xs:string" use="optional"/>
<xs:attribute name="meaning"type="xs:string" use="optional"/> <xs:attribute name="duration" type="iodef:duration-type"/> <xs:attribute name="ext-duration" type="xs:string" use="optional"/> </xs:extension> </xs:simpleContent> </xs:complexType> </xs:element> <xs:simpleType name="counter-type-type"> <xs:restriction base="xs:NMTOKEN"> <xs:enumeration value="counter"/> <xs:enumeration value="rate"/> <xs:enumeration value="average"/> <xs:enumeration value="ext-value"/> </xs:restriction> </xs:simpleType> <xs:simpleType name="counter-unit-type"> <xs:restriction base="xs:NMTOKEN"> <xs:enumeration value="byte"/> <xs:enumeration value="mbit"/> <xs:enumeration value="packet"/> <xs:enumeration value="flow"/> <xs:enumeration value="session"/> <xs:enumeration value="event"/> <xs:enumeration value="alert"/> <xs:enumeration value="message"/> <xs:enumeration value="host"/> <xs:enumeration value="site"/> <xs:enumeration value="organization"/> <xs:enumeration value="ext-value"/> </xs:restriction> </xs:simpleType>
okay so the counter types are giving very strict menus 🧚 the NMTOKEN enumerations are the whole vibe, and each one is a little allowed word and nothing else 💅
<!--
===================================================================
== EmailData class ==
===================================================================
-->
<xs:element name="EmailData">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:EmailTo"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:EmailFrom" minOccurs="0"/>
<xs:element ref="iodef:EmailSubject" minOccurs="0"/>
<xs:element ref="iodef:EmailX-Mailer" minOccurs="0"/>
<xs:element ref="iodef:EmailHeaderField"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:EmailHeaders" minOccurs="0"/>
<xs:element ref="iodef:EmailBody" minOccurs="0"/>
<xs:element ref="iodef:EmailMessage" minOccurs="0"/>
<xs:element ref="iodef:HashData"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="SignatureData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="EmailTo" type="xs:string"/>
<xs:element name="EmailFrom" type="xs:string"/>
<xs:element name="EmailSubject" type="xs:string"/>
<xs:element name="EmailX-Mailer" type="xs:string"/>
<xs:element name="EmailHeaderField" type="iodef:ExtensionType"/>
<xs:element name="EmailHeaders" type="xs:string"/>
<xs:element name="EmailBody" type="xs:string"/>
<xs:element name="EmailMessage" type="xs:string"/>the EmailData class is literally a whole inbox 📬 every piece of the email gets its own little slot, and a bunch of them are optional so you only fill what you've got 🫶
<!--
===================================================================
== DomainData class ==
===================================================================
-->
<xs:element name="DomainData">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Name"/>
<xs:element ref="iodef:DateDomainWasChecked"
minOccurs="0"/>
<xs:element ref="iodef:RegistrationDate"
minOccurs="0"/>
<xs:element ref="iodef:ExpirationDate"
minOccurs="0"/>
<xs:element ref="iodef:RelatedDNS"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Nameservers"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:DomainContacts"
minOccurs="0"/>
</xs:sequence>
<xs:attribute name="system-status"
type="domaindata-system-status-type"/>
<xs:attribute name="ext-system-status"
type="xs:string" use="optional"/>
<xs:attribute name="domain-status"
type="domaindata-domain-status-type"/>
<xs:attribute name="ext-domain-status"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="Name" type="xs:string"/>
<xs:element name="DateDomainWasChecked" type="xs:dateTime"/>
<xs:element name="RegistrationDate" type="xs:dateTime"/>
<xs:element name="ExpirationDate" type="xs:dateTime"/>
<xs:simpleType name="domaindata-system-status-type">
<xs:restriction base="xs:string">
<xs:enumeration value="spoofed"/>
<xs:enumeration value="fraudulent"/>
<xs:enumeration value="innocent-hacked"/>
<xs:enumeration value="innocent-hijacked"/>
<xs:enumeration value="unknown"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="domaindata-domain-status-type">
<xs:restriction base="xs:string">
<xs:enumeration value="reservedDelegation"/>
<xs:enumeration value="assignedAndActive"/>
<xs:enumeration value="assignedAndInactive"/>
<xs:enumeration value="assignedAndOnHold"/>
<xs:enumeration value="revoked"/>
<xs:enumeration value="transferPending"/>
<xs:enumeration value="registryLock"/>
<xs:enumeration value="registrarLock"/>
<xs:enumeration value="other"/>
<xs:enumeration value="unknown"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="RelatedDNS" type="iodef:ExtensionType"/>
<xs:element name="Nameservers">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Server"/>
<xs:element ref="iodef:Address" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="Server" type="xs:string"/>
<xs:element name="DomainContacts">
<xs:complexType>
<xs:choice>
<xs:element ref="iodef:SameDomainContact"/>
<xs:element ref="iodef:Contact"
minOccurs="1" maxOccurs="unbounded"/>
</xs:choice>
</xs:complexType>
</xs:element>
<xs:element name="SameDomainContact" type="xs:string"/>the DomainData class is so dramatic 🔮 the status enums have main character energy, and DomainContacts is a choice, so it's either SameDomainContact or one-or-more Contacts, no both 💀
<!--
===================================================================
== Record class ==
===================================================================
-->
<xs:element name="Record">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:RecordData" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="RecordData">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:DateTime" minOccurs="0"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Application" minOccurs="0"/>
<xs:element ref="iodef:RecordPattern"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:RecordItem"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:URL"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:FileData"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:WindowsRegistryKeysModified"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:CertificateData"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="RecordPattern">
<xs:complexType>
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="type"
type="recordpattern-type-type"
use="required"/>
<xs:attribute name="ext-type"
type="xs:string" use="optional"/>
<xs:attribute name="offset"
type="xs:integer" use="optional"/>
<xs:attribute name="offsetunit"
type="recordpattern-offsetunit-type"
use="optional" default="line"/>
<xs:attribute name="ext-offsetunit"
type="xs:string" use="optional"/>
<xs:attribute name="instance"
type="xs:integer" use="optional"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
</xs:element>
<xs:simpleType name="recordpattern-type-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="regex"/>
<xs:enumeration value="binary"/>
<xs:enumeration value="xpath"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="recordpattern-offsetunit-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="line"/>
<xs:enumeration value="byte"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="RecordItem" type="iodef:ExtensionType"/>
<!--
===================================================================
== WindowsRegistryKeysModified class ==
===================================================================
-->
<xs:element name="WindowsRegistryKeysModified">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Key" maxOccurs="unbounded"/>the Record class is a whole scrapbook 🌈 RecordData holds the good stuff, RecordPattern gets its own offsetunit that defaults to line, and the WindowsRegistryKeysModified class is just starting to show up 🦋
</xs:sequence> <xs:attribute name="observable-id" type="xs:ID" use="optional"/> </xs:complexType> </xs:element> <xs:element name="Key"> <xs:complexType> <xs:sequence> <xs:element ref="iodef:KeyName"/> <xs:element ref="iodef:Value" minOccurs="0"/> </xs:sequence> <xs:attribute name="registryaction" type="key-registryaction-type"/> <xs:attribute name="ext-registryaction" type="xs:string" use="optional"/> <xs:attribute name="observable-id" type="xs:ID" use="optional"/> </xs:complexType> </xs:element> <xs:element name="KeyName" type="xs:string"/> <xs:element name="Value" type="xs:string"/> <xs:simpleType name="key-registryaction-type"> <xs:restriction base="xs:NMTOKEN"> <xs:enumeration value="add-key"/> <xs:enumeration value="add-value"/> <xs:enumeration value="delete-key"/> <xs:enumeration value="delete-value"/> <xs:enumeration value="modify-key"/> <xs:enumeration value="modify-value"/> <xs:enumeration value="ext-value"/> </xs:restriction> </xs:simpleType> <!-- ==================================================================== == FileData class == ==================================================================== --> <xs:element name="FileData"> <xs:complexType> <xs:sequence> <xs:element ref="iodef:File" minOccurs="1" maxOccurs="unbounded"/> </xs:sequence> <xs:attribute name="restriction" type="iodef:restriction-type" use="optional"/> <xs:attribute name="ext-restriction" type="xs:string" use="optional"/> <xs:attribute name="observable-id" type="xs:ID" use="optional"/> </xs:complexType> </xs:element> <xs:element name="File"> <xs:complexType> <xs:sequence> <xs:element ref="iodef:FileName" minOccurs="0"/> <xs:element ref="iodef:FileSize" minOccurs="0"/> <xs:element ref="FileType" minOccurs="0"/> <xs:element ref="iodef:URL" minOccurs="0" maxOccurs="unbounded"/> <xs:element ref="iodef:HashData" minOccurs="0"/> <xs:element ref="iodef:SignatureData" minOccurs="0"/> <xs:element ref="iodef:AssociatedSoftware" minOccurs="0"/> <xs:element ref="iodef:FileProperties" minOccurs="0" maxOccurs="unbounded"/> </xs:sequence> <xs:attribute name="observable-id" type="xs:ID" use="optional"/> </xs:complexType> </xs:element> <xs:element name="FileName" type="xs:string"/> <xs:element name="FileSize" type="xs:integer"/> <xs:element name="FileType" type="xs:string"/> <xs:element name="AssociatedSoftware" type="iodef:SoftwareType"/> <xs:element name="FileProperties" type="iodef:ExtensionType"/> <!-- ==================================================================== == HashData class == ==================================================================== --> <xs:element name="HashData"> <xs:complexType> <xs:sequence> <xs:element ref="iodef:HashTargetID" minOccurs="0"/> <xs:element ref="iodef:Hash" minOccurs="0" maxOccurs="unbounded"/> <xs:element ref="iodef:FuzzyHash" minOccurs="0" maxOccurs="unbounded"/> </xs:sequence> <xs:attribute name="scope" type="hashdata-scope-type" use="required"/> <xs:attribute name="ext-scope" type="xs:string" use="optional"/> </xs:complexType> </xs:element> <xs:element name="HashTargetID" type="xs:string"/> <xs:simpleType name="hashdata-scope-type"> <xs:restriction base="xs:NMTOKEN"> <xs:enumeration value="file-contents"/> <xs:enumeration value="file-pe-section"/> <xs:enumeration value="file-pe-iat"/> <xs:enumeration value="file-pe-resource"/> <xs:enumeration value="file-pdf-object"/> <xs:enumeration value="email-hash"/> <xs:enumeration value="email-headers-hash"/> <xs:enumeration value="email-body-hash"/> <xs:enumeration value="ext-value"/> </xs:restriction> </xs:simpleType> <xs:element name="Hash"> <xs:complexType> <xs:sequence> <xs:element ref="ds:DigestMethod"/> <xs:element ref="ds:DigestValue"/> <xs:element ref="ds:CanonicalizationMethod" minOccurs="0"/> <xs:element ref="iodef:Application" minOccurs="0"/> </xs:sequence> </xs:complexType> </xs:element> <xs:element name="FuzzyHash"> <xs:complexType> <xs:sequence> <xs:element ref="iodef:FuzzyHashValue" maxOccurs="unbounded"/> <xs:element ref="iodef:Application" minOccurs="0"/> <xs:element ref="iodef:AdditionalData" minOccurs="0" maxOccurs="unbounded"/> </xs:sequence> </xs:complexType> </xs:element> <xs:element name="FuzzyHashValue" type="iodef:ExtensionType"/> <!-- =================================================================== == SignatureData class == =================================================================== --> <xs:element name="SignatureData"> <xs:complexType> <xs:sequence> <xs:element ref="ds:Signature" maxOccurs="unbounded"/> </xs:sequence> </xs:complexType> </xs:element> <!-- =================================================================== == CertificateData class == =================================================================== --> <xs:element name="CertificateData">
<xs:complexType> <xs:sequence> <xs:element ref="iodef:Certificate" maxOccurs="unbounded"/> </xs:sequence> <xs:attribute name="restriction" type="iodef:restriction-type" use="optional"/> <xs:attribute name="ext-restriction" type="xs:string" use="optional"/> <xs:attribute name="observable-id" type="xs:ID" use="optional"/> </xs:complexType> </xs:element> <xs:element name="Certificate"> <xs:complexType> <xs:sequence> <xs:element ref="ds:X509Data"/> <xs:element ref="iodef:Description" minOccurs="0" maxOccurs="unbounded"/> </xs:sequence> <xs:attribute name="observable-id" type="xs:ID" use="optional"/> </xs:complexType> </xs:element> <!-- =================================================================== == IndicatorData class == =================================================================== --> <xs:element name="IndicatorData"> <xs:complexType> <xs:sequence> <xs:element ref="iodef:Indicator" minOccurs="1" maxOccurs="unbounded"/> </xs:sequence> </xs:complexType> </xs:element> <xs:element name="Indicator"> <xs:complexType> <xs:sequence> <xs:element ref="iodef:IndicatorID"/> <xs:element ref="iodef:AlternativeIndicatorID" minOccurs="0" maxOccurs="unbounded"/> <xs:element ref="iodef:Description" minOccurs="0" maxOccurs="unbounded"/> <xs:element ref="iodef:StartTime" minOccurs="0"/> <xs:element ref="iodef:EndTime" minOccurs="0"/> <xs:element ref="iodef:Confidence" minOccurs="0"/> <xs:element ref="iodef:Contact" minOccurs="0" maxOccurs="unbounded"/> <xs:choice>
okay so we're still deep in the schema, bestie 💅🫶 these elements are the building blocks for the Indicator stuff, and the way they nest is giving very strict, very organized vibes 🎀
<xs:element ref="iodef:Observable"/>
<xs:element ref="iodef:ObservableReference"/>
<xs:element ref="iodef:IndicatorExpression"/>
<xs:element ref="iodef:IndicatorReference"/>
</xs:choice>
<xs:element ref="iodef:NodeRole"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AttackPhase"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Reference"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="IndicatorID">
<xs:complexType>
<xs:simpleContent>
<xs:extension base="xs:ID">
<xs:attribute name="name" type="xs:string" use="required"/>
<xs:attribute name="version"
type="xs:string" use="required"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
</xs:element>
<xs:element name="AlternativeIndicatorID">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:IndicatorID" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="Observable">
<xs:complexType>
<xs:choice>
<xs:element ref="iodef:System" minOccurs="0"/>
<xs:element ref="iodef:Address" minOccurs="0"/>
<xs:element ref="iodef:DomainData" minOccurs="0"/>
<xs:element ref="iodef:Service" minOccurs="0"/>
<xs:element ref="iodef:EmailData" minOccurs="0"/>
<xs:element ref="iodef:WindowsRegistryKeysModified"
minOccurs="0"/>
<xs:element ref="iodef:FileData" minOccurs="0"/>
<xs:element ref="iodef:CertificateData" minOccurs="0"/>
<xs:element ref="iodef:RegistryHandle" minOccurs="0"/>
<xs:element ref="iodef:RecordData" minOccurs="0"/>
<xs:element ref="iodef:EventData" minOccurs="0"/>
<xs:element ref="iodef:Incident" minOccurs="0"/>
<xs:element ref="iodef:Expectation" minOccurs="0"/>
<xs:element ref="iodef:Reference" minOccurs="0"/>
<xs:element ref="iodef:Assessment" minOccurs="0"/>
<xs:element ref="iodef:DetectionPattern" minOccurs="0"/>
<xs:element ref="iodef:HistoryItem" minOccurs="0"/>
<xs:element ref="iodef:BulkObservable" minOccurs="0"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:choice>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="BulkObservable">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:BulkObservableFormat" minOccurs="0"/>
<xs:element name="BulkObservableList"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="type"
type="bulkobservable-type-type" use="required"/>
<xs:attribute name="ext-type" type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:simpleType name="bulkobservable-type-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="asn"/>
<xs:enumeration value="atm"/>
<xs:enumeration value="e-mail"/>
<xs:enumeration value="ipv4-addr"/>
<xs:enumeration value="ipv4-net"/>
<xs:enumeration value="ipv4-net-mask"/>
<xs:enumeration value="ipv6-addr"/>
<xs:enumeration value="ipv6-net"/>
<xs:enumeration value="ipv6-net-mask"/>
<xs:enumeration value="mac"/>
<xs:enumeration value="site-uri"/>
<xs:enumeration value="domain-name"/>
<xs:enumeration value="domain-to-ipv4"/>
<xs:enumeration value="domain-to-ipv6"/>
<xs:enumeration value="domain-to-ipv4-timestamp"/>
<xs:enumeration value="domain-to-ipv6-timestamp"/>
<xs:enumeration value="ipv4-port"/>
<xs:enumeration value="ipv6-port"/>
<xs:enumeration value="windows-reg-key"/>
<xs:enumeration value="file-hash"/>
<xs:enumeration value="email-x-mailer"/>
<xs:enumeration value="email-subject"/>
<xs:enumeration value="http-user-agent"/>
<xs:enumeration value="http-request-uri"/>
<xs:enumeration value="mutex"/>
<xs:enumeration value="file-path"/>
<xs:enumeration value="user-name"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="BulkObservableFormat">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:Hash" minOccurs="0"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="BulkObservableList" type="xs:string"/>
<xs:element name="IndicatorExpression">
<xs:complexType>
<xs:sequence maxOccurs="unbounded">
<xs:choice>
<xs:element ref="iodef:IndicatorExpression"/>
<xs:element ref="iodef:Observable"/>
<xs:element ref="iodef:ObservableReference"/>
<xs:element ref="iodef:IndicatorReference"/>
</xs:choice>
<xs:element ref="iodef:Confidence" minOccurs="0"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="operator"
type="indicatorexpression-operator-type"
use="optional" default="and"/>
<xs:attribute name="ext-operator"
type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:simpleType name="indicatorexpression-operator-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="not"/>
<xs:enumeration value="and"/>
<xs:enumeration value="or"/>
<xs:enumeration value="xor"/>
</xs:restriction>
</xs:simpleType>
<xs:element name="ObservableReference">
<xs:complexType>
<xs:attribute name="uid-ref" type="xs:IDREF" use="required"/>
</xs:complexType>
</xs:element>
<xs:element name="IndicatorReference">
<xs:complexType>
<xs:attribute name="uid-ref" type="xs:IDREF" use="optional"/>
<xs:attribute name="euid-ref" type="xs:string" use="optional"/>
<xs:attribute name="version" type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:element name="AttackPhase">
<xs:complexType>
<xs:sequence>
<xs:element ref="iodef:AttackPhaseID"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:URL" maxOccurs="unbounded"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:AdditionalData"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="AttackPhaseID" type="xs:string"/>
<!--
===================================================================
== Miscellaneous classes ==
===================================================================
-->
<xs:element name="AdditionalData" type="iodef:ExtensionType"/>
<xs:element name="Description" type="iodef:MLStringType"/>
<xs:element name="URL" type="xs:anyURI"/>
<!--
===================================================================
== IODEF data types ==
===================================================================
-->
<xs:simpleType name="PositiveFloatType">
<xs:restriction base="xs:float">
<xs:minExclusive value="0"/>
</xs:restriction>
</xs:simpleType>
<xs:complexType name="MLStringType">
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="translation-id"
type="xs:string" use="optional"/>
<xs:attribute ref="xml:lang"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
<xs:simpleType name="PortlistType">
<xs:restriction base="xs:string">
<xs:pattern value="\d+(\-\d+)?(,\d+(\-\d+)?)*"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="TimezoneType">
<xs:restriction base="xs:string">
<xs:pattern
value="Z|[\+\-](0[0-9]|1[0-4]):[0-5][0-9]"/>
</xs:restriction>
</xs:simpleType>
<xs:complexType name="ExtensionType" mixed="true">
<xs:sequence>
<xs:any namespace="##any" processContents="lax"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence> <xs:attribute name="name" type="xs:string" use="optional"/>
<xs:attribute name="dtype"
type="iodef:dtype-type" use="required"/>
<xs:attribute name="ext-dtype" type="xs:string" use="optional"/>
<xs:attribute name="meaning" type="xs:string" use="optional"/>
<xs:attribute name="formatid" type="xs:string" use="optional"/>
<xs:attribute name="restriction"
type="iodef:restriction-type" use="optional"/>
<xs:attribute name="ext-restriction"
type="xs:string" use="optional"/>
<xs:attribute name="observable-id" type="xs:ID" use="optional"/>
</xs:complexType>
<xs:complexType name="SoftwareType">
<xs:sequence>
<xs:element ref="iodef:SoftwareReference" minOccurs="0"/>
<xs:element ref="iodef:URL"
minOccurs="0" maxOccurs="unbounded"/>
<xs:element ref="iodef:Description"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
<xs:element name="SoftwareReference">
<xs:complexType>
<xs:sequence>
<xs:any namespace="##any" processContents="lax"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="spec-name"
type="softwarereference-spec-name-type"
use="required"/>
<xs:attribute name="ext-spec-name"
type="xs:string" use="optional"/>
<xs:attribute name="dtype"
type="softwarereference-dtype-type"
use="optional"/>
<xs:attribute name="ext-dtype" type="xs:string" use="optional"/>
</xs:complexType>
</xs:element>
<xs:simpleType name="softwarereference-spec-name-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="custom"/>
<xs:enumeration value="cpe"/>
<xs:enumeration value="swid"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="softwarereference-dtype-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="bytes"/>
<xs:enumeration value="integer"/>
<xs:enumeration value="real"/>
<xs:enumeration value="string"/>
<xs:enumeration value="xml"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<!--
===================================================================
== Global attribute type declarations ==
===================================================================
-->
<xs:simpleType name="yes-no-unknown-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="yes"/>
<xs:enumeration value="no"/>
<xs:enumeration value="unknown"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="restriction-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="default"/>
<xs:enumeration value="public"/>
<xs:enumeration value="partner"/>
<xs:enumeration value="need-to-know"/>
<xs:enumeration value="private"/>
<xs:enumeration value="white"/>
<xs:enumeration value="green"/>
<xs:enumeration value="amber"/>
<xs:enumeration value="red"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="severity-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="low"/>
<xs:enumeration value="medium"/>
<xs:enumeration value="high"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="duration-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="second"/>
<xs:enumeration value="minute"/>
<xs:enumeration value="hour"/>
<xs:enumeration value="day"/>
<xs:enumeration value="month"/>
<xs:enumeration value="quarter"/>
<xs:enumeration value="year"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="action-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="nothing"/>
<xs:enumeration value="contact-source-site"/>
<xs:enumeration value="contact-target-site"/>
<xs:enumeration value="contact-sender"/>
<xs:enumeration value="investigate"/>
<xs:enumeration value="block-host"/>
<xs:enumeration value="block-network"/>
<xs:enumeration value="block-port"/>
<xs:enumeration value="rate-limit-host"/>
<xs:enumeration value="rate-limit-network"/>
<xs:enumeration value="rate-limit-port"/>
<xs:enumeration value="redirect-traffic"/>
<xs:enumeration value="honeypot"/>
<xs:enumeration value="upgrade-software"/>
<xs:enumeration value="rebuild-asset"/>
<xs:enumeration value="harden-asset"/>
<xs:enumeration value="remediate-other"/>
<xs:enumeration value="status-triage"/>
<xs:enumeration value="status-new-info"/>
<xs:enumeration value="watch-and-report"/>
<xs:enumeration value="defined-coa"/>
<xs:enumeration value="other"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="dtype-type">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="boolean"/>
<xs:enumeration value="byte"/>
<xs:enumeration value="bytes"/>
<xs:enumeration value="character"/>
<xs:enumeration value="date-time"/>
<xs:enumeration value="integer"/>
<xs:enumeration value="ntpstamp"/>
<xs:enumeration value="portlist"/>
<xs:enumeration value="real"/>
<xs:enumeration value="string"/>
<xs:enumeration value="file"/>
<xs:enumeration value="path"/>
<xs:enumeration value="frame"/>
<xs:enumeration value="packet"/>
<xs:enumeration value="ipv4-packet"/>
<xs:enumeration value="ipv6-packet"/>
<xs:enumeration value="url"/>
<xs:enumeration value="csv"/>
<xs:enumeration value="winreg"/>
<xs:enumeration value="xml"/>
<xs:enumeration value="ext-value"/>
</xs:restriction>
</xs:simpleType>
</xs:schema>9. Security Considerations 🔐
okay bestie, so the IODEF data model doesn't directly bring any security or privacy issues on its own 💅 BUT the data can be super sensitive to the people sending it and the people it's about, so you have to handle it with real care while it's being built, exchanged, processed, archived, pulled back up later, and analyzed 🫶
9.1. Security 🛡️
the messaging format and protocol you use to swap IODEF documents MUST give you appropriate guarantees of confidentiality, integrity, and authenticity ✨ using a standardized security protocol is encouraged, and the Real-time Inter-network Defense (RID) protocol [RFC6545] plus its transport binding IODEF/RID over HTTP/TLS [RFC6546] totally deliver that 🎀
an IODEF implementation is allowed to act on the data in a document 🔥 those actions might be explicitly requested in the document, or they might be the result of analytical logic that got triggered by something in the document. this is why implementations have to properly authenticate the sender and receiver of the document 🙈 the sender needs confidence that sensitive info and timely action requests go to the correct recipient, and the recipient might interpret the contents differently depending on who sent them or change its actions based on the sender 👑 the sender can convey confidence in the data in a granular way using the Confidence class, but the recipient is free to ignore or refine that info and make its own assessment 💅
Ambiguous Confidence elements (where it's unclear which of a set of other elements the Confidence element relates to) in a document MUST be ignored by the recipient. no exceptions, babe 💀
some classes need out-of-band coordination to agree on what they mean (for example, Confidence@rating="low" or DefinedCOA) 🧚 this coordination MUST happen before any operational data gets exchanged, so nobody misreads these specific data elements 😭 when parsing them, implementations should validate, when possible, that they match the agreed-upon semantics 🌸 and those semantics may need to be periodically reevaluated 🦋
executable content of various forms could be embedded into an IODEF document, either directly or through an extension 💀 implementations MUST handle this content with care so it doesn't get automatically executed by accident 🙈 these classes are explicitly meant to represent content that might be executable:
- all classes of type
iodef:ExtensionTypeand theRecordPatternclass can represent arbitrary binary strings, like legit software programs or malware 💀 - the
EmailMessageandEmailBodyclasses can represent email attachments that can hold arbitrary content 📎 - the
DetectionPatternclass could specify a machine-readable configuration that directs the execution of the corresponding tool 🤖
per Section 4.3, IODEF implementations will need to periodically check the IANA registries specified in Section 10.2 to discover newly registered enumerated attribute values 🔍 these implementations MUST talk to IANA in a way that keeps the integrity of the values and the authenticity of the source locked in 🔐 HTTPS over TLS [RFC2818][RFC5246] gives you exactly that ✨
9.2. Privacy 🕵️♀️
the IODEF has loads of fields that are identifiers which could be linked back to an individual or an organization 🫣 documents can carry sensitive info about those parties, and repeated exchanges about the same (or related) parties can let someone correlate data about them 🧩 and a party might report on another one to a third party without that person ever knowing 😳
when you're creating an IODEF document, think very carefully about what info gets shared 🎀 personal identifiers and attributable sensitive info should only be shared when it's necessary 💜
when exchanging documents, transport security MUST provide document-level confidentiality 🔒 element-level confidentiality can also be added by using [W3C.XMLENC] 🧁
so the IODEF lets a document sender convey a privacy policy using the restriction attribute, which gives the sender a way to suggest data processing and handling guidelines 💅 the different instances of this attribute let different data elements in the document be covered by different policies, which is super flexible 🌈 but it has to be stressed that this only serves as a guideline from the sender, because the recipient is free to ignore it 🙃
even though it's outside the scope of an IODEF implementation, the contents of IODEF documents and any derived analysis should be archived with appropriate confidentiality controls 🗄️ and access to retrieve and analyze this data should be restricted to authorized users 🔑 main character energy in keeping secrets 🤫
10. IANA Considerations 🧚
this document registers a namespace, an XML schema, and a bunch of registries that map to the enumerated values defined in the data model 🌸 it also defines an Expert Review process for IODEF-related XML registry entries 🦋
10.1. Namespace and Schema 🎀
okay so this doc uses URNs to describe an XML namespace and schema, following a registry mechanism from [RFC3688]. let's get into it 💅
Registration for the IODEF namespace:
- URI:
urn:ietf:params:xml:ns:iodef-2.0 - Registrant Contact: See the author in the "Author's Address" section of this document.
- XML: None. Namespace URIs do not represent an XML specification.
Registration for the IODEF XML schema:
- URI:
urn:ietf:params:xml:schema:iodef-2.0 - Registrant Contact: See the first author of the "Author's Address" section of this document.
- XML: See Section 8 of this document.
10.2. Enumerated Value Registries 🌸
this document creates 34 identically structured registries for IANA to manage, and they're giving organized 🍓
- Name of the parent registry: "Incident Object Description Exchange Format v2 (IODEF)"
- URL of the registry:
http://www.iana.org/assignments/iodef2 - Namespace format: A registry entry consists of:
- Value. A value for a given IODEF attribute. It MUST conform to the formatting specified by the IODEF ENUM data type, which is implemented as an "xs:NMTOKEN" type per Section 3.3.4 of [W3C.SCHEMA.DTYPES]. The value SHOULD conform to the convention specified in Section 5.2.
- Description. A short description of the enumerated value.
- Reference. An optional list of URIs to further describe the value.
- Allocation policy: Expert Review per [RFC5226]. This reviewer will make sure the requested registry entry follows the prescribed formatting. The reviewer will also make sure the entry is an appropriate value for the attribute per the information model (Section 3). ✨
The registries are named in the "Registry Name" column of Table 1. Each one starts out populated with values and descriptions taken from an attribute in the IODEF schema (Section 8), and that attribute's description lives in a sub-section of the information model (Section 3). The starting values for the Value and Description fields are in the "IV (Value)" and "IV (Desc.)" columns. "IV (Value)" points to a schema type per Section 8, and every enumerated value in the schema gets its own entry in the matching registry. "IV (Desc.)" points to a section of this document that describes each enumerated value. The starting value of the Reference field for every registry entry described below should be this document. 🦋
+-------------------------+-----------------------------+-----------+
| Registry Name | IV (Value) | IV |
| | | (Desc.) |
+-------------------------+-----------------------------+-----------+
| Restriction | iodef-restriction-type | 3.3.1 |
| | | |
| Incident-purpose | incident-purpose-type | 3.2 |
| | | |
| Incident-status | incident-status-type | 3.2 |
| | | |
| Contact-role | contact-role-type | 3.9 |
| | | |
| Contact-type | contact-type-type | 3.9 |
| | | |
| RegistryHandle-registry | registryhandle-registry- | 3.9.1 |
| | type | |
| | | |
| PostalAddress-type | postaladdress-type-type | 3.9.2 |
| | | |
| Telephone-type | telephone-type-type | 3.9.4 |
| | | |
| Email-type | email-type-type | 3.9.3 |
| | | |
| Expectation-action | action-type | 3.15 |
| | | |
| Discovery-source | discovery-source-type | 3.10 |
| | | |
| SystemImpact-type | systemimpact-type-type | 3.12.1 |
| | | |
| BusinessImpact-severity | businessimpact-severity- | 3.12.2 |
| | type | |
| | | |
| BusinessImpact-type | businessimpact-type-type | 3.12.2 |
| | | |
| TimeImpact-metric | timeimpact-metric-type | 3.12.3 |
| | | |
| TimeImpact-duration | duration-type | 3.12.3 |
| | | |
| Confidence-rating | confidence-rating-type | 3.12.5 |
| | | |
| NodeRole-category | noderole-category-type | 3.18.2 |
| | | |
| System-category | system-category-type | 3.17 |
| | | |
| System-ownership | system-ownership-type | 3.17 |
| | | |
| Address-category | address-category-type | 3.18.1 |
| | | |
| Counter-type | counter-type-type | 3.18.3 |
| | | |
| Counter-unit | counter-unit-type | 3.18.3 |
| | | |
| DomainData-system- | domaindata-system-status- | 3.19 |
| status | type | |
| | | |
| DomainData-domain- | domaindata-domain-status- | 3.19 |
| status | type | |
| | | |
| RecordPattern-type | recordpattern-type-type | 3.22.2 |
| | | |
| RecordPattern- | recordpattern-offsetunit- | 3.22.2 |
| offsetunit | type | |
| | | |
| Key-registryaction | key-registryaction-type | 3.23.1 |
| | | |
| HashData-scope | hashdata-scope-type | 3.26 |
| | | |
| BulkObservable-type | bulkobservable-type-type | 3.29.3.1 |
| | | |
| IndicatorExpression- | indicatorexpression- | 3.29.4 |
| operator | operator-type | |
| | | |
| ExtensionType-dtype | dtype-type | 2.16 |
| | | |
| SoftwareReference-spec- | softwarereference-spec-id- | 2.15.1 |
| id | type | |
| | | |
| SoftwareReference-dtype | softwarereference-dtype- | 2.15.1 |
| | type | |
+-------------------------+-----------------------------+-----------+
Table 1: IANA Enumerated Value Registries10.3. Expert Review of IODEF-Related XML Registry Entries 🧚
IODEF class extensions, per Section 5.2, could register their namespaces and schemas with the IANA XML namespace ("ns" on http://www.iana.org/assignments/xml-registry/) and schema registries ("schema" on http://www.iana.org/assignments/xml-registry/), both described in [RFC3688]. On top of any reviews IANA requires, changes to the XML "schema" registry for schema names beginning with "urn:ietf:params:xml:schema:iodef" are subject to an additional IODEF Expert Review [RFC5226], so everything stays compatible with IODEF and the other existing IODEF extensions 🫶
The IODEF expert(s) for these reviews will be designated by the IETF Security Area Directors. 👑
This document obsoletes [RFC6685]. 💜
11. References 📚
11. References ✨
11.1. Normative References
Okay bestie, these are the normative refs, the stuff you have to read to get this stuff right 📚💖
[E.164]ITU Telecommunication Standardization Sector, "The International Public Telecommunication Numbering Plan", ITU-T Recommendation E.164, November 2010.[IANA.Media]IANA, "Media Types",<http://www.iana.org/assignments/media-types/>.[IANA.Ports]IANA, "Service Name and Transport Protocol Port Number Registry",<http://www.iana.org/assignments/service-names-port-numbers/>.[IANA.Protocols]IANA, "Assigned Internet Protocol Numbers",<http://www.iana.org/assignments/protocol-numbers/>.[IEEE.POSIX]IEEE, "Information Technology - Portable Operating System Interface (POSIX) Base Specifications, Issue 7", IEEE Std 1003.1-2001, DOI 10.1109/IEEESTD.2009.5393893, September 2009.[ISO19770]International Organization for Standardization, "Information technology -- Software asset management -- Part 2: Software identification tag", ISO Standard 19770-2:2015, October 2015.[ISO4217]International Organization for Standardization, "Codes for the representation of currencies", ISO 4217:2015, 2015.[NIST.CPE]Cheikes, B., Waltermire, D., and K. Scarfone, "Common Platform Enumeration: Naming Specification Version 2.3", NIST Interagency Report 7695, August 2011,<http://csrc.nist.gov/publications/nistir/ir7695/NISTIR-7695-CPE-Naming.pdf>.[RFC2119]Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997,<http://www.rfc-editor.org/info/rfc2119>.[RFC2781]Hoffman, P. and F. Yergeau, "UTF-16, an encoding of ISO 10646", RFC 2781, DOI 10.17487/RFC2781, February 2000,<http://www.rfc-editor.org/info/rfc2781>.[RFC3629]Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November 2003,<http://www.rfc-editor.org/info/rfc3629>.[RFC3688]Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004,<http://www.rfc-editor.org/info/rfc3688>.[RFC3986]Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005,<http://www.rfc-editor.org/info/rfc3986>.[RFC4291]Hinden, R. and S. Deering, "IP Version 6 Addressing Architecture", RFC 4291, DOI 10.17487/RFC4291, February 2006,<http://www.rfc-editor.org/info/rfc4291>.[RFC4519]Sciberras, A., Ed., "Lightweight Directory Access Protocol (LDAP): Schema for User Applications", RFC 4519, DOI 10.17487/RFC4519, June 2006,<http://www.rfc-editor.org/info/rfc4519>.[RFC5322]Resnick, P., Ed., "Internet Message Format", RFC 5322, DOI 10.17487/RFC5322, October 2008,<http://www.rfc-editor.org/info/rfc5322>.[RFC5646]Phillips, A., Ed. and M. Davis, Ed., "Tags for Identifying Languages", BCP 47, RFC 5646, DOI 10.17487/RFC5646, September 2009,<http://www.rfc-editor.org/info/rfc5646>.[RFC5952]Kawamura, S. and M. Kawashima, "A Recommendation for IPv6 Address Text Representation", RFC 5952, DOI 10.17487/RFC5952, August 2010,<http://www.rfc-editor.org/info/rfc5952>.[RFC6531]Yao, J. and W. Mao, "SMTP Extension for Internationalized Email", RFC 6531, DOI 10.17487/RFC6531, February 2012,<http://www.rfc-editor.org/info/rfc6531>.[RFC7203]Takahashi, T., Landfield, K., and Y. Kadobayashi, "An Incident Object Description Exchange Format (IODEF) Extension for Structured Cybersecurity Information", RFC 7203, DOI 10.17487/RFC7203, April 2014,<http://www.rfc-editor.org/info/rfc7203>.[RFC7495]Montville, A. and D. Black, "Enumeration Reference Format for the Incident Object Description Exchange Format (IODEF)", RFC 7495, DOI 10.17487/RFC7495, March 2015,<http://www.rfc-editor.org/info/rfc7495>.[W3C.SCHEMA]Thompson, H., Beech, D., Maloney, M., and N. Mendelsohn, "XML Schema Part 1: Structures Second Edition", W3C Recommendation REC-xmlschema-1-20041028, October 2004,<http://www.w3.org/TR/xmlschema-1/>.[W3C.SCHEMA.DTYPES]Biron, P. and A. Malhotra, "XML Schema Part 2: Datatypes Second Edition", W3C Recommendation REC-xmlschema-2-20041028, October 2004,<http://www.w3.org/TR/xmlschema-2/>.[W3C.XML]Bray, T., Paoli, J., Sperberg-McQueen, M., Maler, E., and F. Yergeau, "Extensible Markup Language (XML) 1.0 (Fifth Edition)", W3C Recommendation REC-xml-20081126, November 2008,<http://www.w3.org/TR/2008/REC-xml-20081126/>.[W3C.XMLNS]Bray, T., Hollander, D., Layman, A., Tobin, R., and H. Thompson, "Namespaces in XML 1.0 (Third Edition)", W3C Recommendation REC-xml-names-20091208, December 2009,<http://www.w3.org/TR/2009/REC-xml-names-20091208/>.[W3C.XMLSIG]Eastlake, D., Reagle, J., Solo, D., Hirsch, F., and T. Roessler, "XML Signature Syntax and Processing (Second Edition)", W3C Recommendation REC-xmldsig-core-20080610, June 2008,<http://www.w3.org/TR/xmldsig-core/>.[W3C.XPATH]Robie, J., Dyck, M., and J. Spiegel, "XML Path Language (XPath) 3.1", W3C Candidate Recommendation CR-xpath-31-20151217, December 2015,<https://www.w3.org/TR/xpath-3/>.
11.2. Informative References
These ones are the extra-credit reading 🦋 Not required, but lowkey super helpful for context.
[KB310516]Microsoft Corporation, "How to add, modify, or delete registry subkeys and values by using a .reg file", September 2013,<https://support.microsoft.com/en-us/kb/310516>.[NIST800.61rev2]National Institute of Standards and Technology, "Computer Security Incident Handling Guide", NIST Special Publication 800-61, Revision 2, August 2012,<http://dx.doi.org/10.6028/NIST.SP.800-61r2>.[RFC2818]Rescorla, E., "HTTP Over TLS", RFC 2818, DOI 10.17487/RFC2818, May 2000,<http://www.rfc-editor.org/info/rfc2818>.[RFC3982]Newton, A. and M. Sanz, "IRIS: A Domain Registry (dreg) Type for the Internet Registry Information Service (IRIS)", RFC 3982, DOI 10.17487/RFC3982, January 2005,<http://www.rfc-editor.org/info/rfc3982>.[RFC4180]Shafranovich, Y., "Common Format and MIME Type for Comma-Separated Values (CSV) Files", RFC 4180, DOI 10.17487/RFC4180, October 2005,<http://www.rfc-editor.org/info/rfc4180>.[RFC5070]Danyliw, R., Meijer, J., and Y. Demchenko, "The Incident Object Description Exchange Format", RFC 5070, DOI 10.17487/RFC5070, December 2007,<http://www.rfc-editor.org/info/rfc5070>.[RFC5226]Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, DOI 10.17487/RFC5226, May 2008,<http://www.rfc-editor.org/info/rfc5226>.[RFC5246]Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/RFC5246, August 2008,<http://www.rfc-editor.org/info/rfc5246>.[RFC5901]Cain, P. and D. Jevans, "Extensions to the IODEF-Document Class for Reporting Phishing", RFC 5901, DOI 10.17487/RFC5901, July 2010,<http://www.rfc-editor.org/info/rfc5901>.[RFC6545]Moriarty, K., "Real-time Inter-network Defense (RID)", RFC 6545, DOI 10.17487/RFC6545, April 2012,<http://www.rfc-editor.org/info/rfc6545>.[RFC6546]Trammell, B., "Transport of Real-time Inter-network Defense (RID) Messages over HTTP/TLS", RFC 6546, DOI 10.17487/RFC6546, April 2012,<http://www.rfc-editor.org/info/rfc6546>.[RFC6685]Trammell, B., "Expert Review for Incident Object Description Exchange Format (IODEF) Extensions in IANA XML Registry", RFC 6685, DOI 10.17487/RFC6685, July 2012,<http://www.rfc-editor.org/info/rfc6685>.[W3C.XMLENC]Eastlake, D., Reagle, J., Solo, D., Hirsch, F., Nystrom, M., Roessler, T., and K. Yiu, "XML Encryption Syntax and Processing Version 1.1", W3C Recommendation REC-xmldsig-core1-20130411, April 2013,<https://www.w3.org/TR/xmlenc-core1/>.
Acknowledgments 🫶
Huge thanks to Paul Stoecker for his editorial leadership in the transition of an early draft to the current document. 👑
Thanks to Kathleen Moriarty, Brian Trammel, Alexey Melnikov, Takeshi Takahashi, David Waltermire, and Sean Turner (as the MILE working group chairs, secretary, and area directors) for providing feedback and coordination of this document. 💜
Thanks to the following individuals (listed alphabetically) who provided feedback during the meetings, on the mailing list, or through implementation experience: Jerome Athias, David Black, Eric Burger, Toma Cejka, Patrick Curry, John Field, Christopher Harrington, Chris Inacio, Panos Kampanakis, David Misell, Daisuke Miyamoto, Adam Montville, Robert Moskowitz, Lagadec Philippe, Tony Rutkowski, Mio Suzuki, and Nik Teague. 🌸✨
Author's Address 🎀
Roman Danyliw CERT Software Engineering Institute Carnegie Mellon University 4500 Fifth Avenue Pittsburgh, PA United States of America
Email: rdd@cert.org
📦 where this page comes from
- ietf: rfc7970 2016-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms