RFC 8727
JSON Binding of the Incident Object Description Exchange Format
Abstract ✨
okay bestie, let's get into it 💖 This is RFC 8727, and its title is JSON Binding of the Incident Object Description Exchange Format 🎀. It's a Standards Track doc from August 2020, published in the IETF series with ISSN 2070-1721. The authors are T. Takahashi (NICT), R. Danyliw (CERT), and M. Suzuki (NICT) 👑. The header doesn't have any Obsoletes or Updates line, so this doc doesn't replace or update anything 🦋.
So here's the tea ☕. IODEF from RFC 7970 is the format for sharing security incident reports and indicators, and it comes with an XML data model 🧚. This doc is basically saying "hey, what if we had a second way to do the exact same thing?" It defines a JSON data model, plus how to encode it in CBOR, so the info is still all there, just in a different shape 💅.
Status of This Memo 🌸
This is an Internet Standards Track document ✨.
This doc is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG) 🫶. If you want more info on Internet Standards, check out Section 2 of RFC 7841 💜.
For the current status of this doc, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc8727 🔥.
Copyright Notice 💜
Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved 🌈.
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at https://trustee.ietf.org/license-info, as they were in effect on the date this doc was published 📜. Please read these carefully, because they explain your rights and restrictions for this doc 🙈. Code Components pulled out of this doc must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 🦋.
Table of Contents 🎀
1. Introduction
1.1. Requirements Language
2. IODEF Data Types
2.1. Abstract Data Type to JSON Data Type Mapping
2.2. Complex JSON Types
2.2.1. Integer
2.2.2. Multilingual Strings
2.2.3. Enum
2.2.4. Software and Software Reference
2.2.5. Structured Information
2.2.6. EXTENSION
3. IODEF JSON Data Model
3.1. Classes and Elements
3.2. Mapping between JSON and XML IODEF
4. Examples
4.1. Minimal Example
4.2. Indicators from a Campaign
5. Mapkeys
6. The IODEF Data Model (CDDL)
7. IANA Considerations
8. Security Considerations
9. References
9.1. Normative References
9.2. Informative References
Appendix A. Data Types Used in This Document
Appendix B. The IODEF Data Model (JSON Schema)
Acknowledgments
Authors' Addresses1. Introduction 🌸
Okay so the Incident Object Description Exchange Format (IODEF) [RFC7970] is the format that gives us a way to represent security incident reports and indicators, the stuff operational security teams pass around all the time 💅. It's built to make that sharing automatic, so mitigation and watch-and-warning can happen faster ⭐. The information model is written in Unified Modeling Language (UML) and it's in Section 3 of [RFC7970] ✨. The XML schema data model is in Section 8 of [RFC7970] 🧚. In this doc, those get called IODEF UML and IODEF XML, respectively 💖.
IODEF docs are structured, which makes them so good for machines to process 🤖. They're gonna streamline incident response ops, periodt 🔥. Another popular structured format that machines love is JavaScript Object Notation (JSON) [RFC8259] 🍓. So to automate incident response, IODEF docs and implementations should support JSON representation and its encoding in Concise Binary Object Representation (CBOR) [RFC7049] 🦋.
This doc defines another implementation of the IODEF UML information model 🎀. It does that with a JSON data model, written in Concise Data Definition Language (CDDL) [RFC8610] and a JSON Schema [JSON-SCHEMA] 👑. This JSON data model is called IODEF JSON in this doc 💜. IODEF JSON has all of the expressivity of IODEF XML, so nothing is lost in translation ✨. It gives implementers and operators an alternative format for the same info 🫶.
The normative IODEF JSON data model is in Section 6 🌈. Sections 2 and 3 cover the data types and elements of that model 📜. Section 4 has the examples 💅.
1.1. Requirements Language 🙈
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 🔥. That's the only way they count as the official BCP 14 key words, so lowercase versions are just regular words 💀.
2. IODEF Data Types 💖
IODEF JSON implements the abstract data types specified in Section 2 of [RFC7970] 🎀.
more in part 2 🦋
2.1. Abstract Data Type to JSON Data Type Mapping ✨
okay so IODEF JSON is giving native JSON types AND derived ones 💅 Table 1 is basically the cheat sheet 🌸 It maps each abstract data type from Section 2 of [RFC7970] to how it shows up in IODEF JSON. Some rows just say "string" per [RFC8259], and others point you to a subsection down below for the deets 🦋
+=================+==========================+================+
| IODEF Data Type | Reference | JSON Data Type |
+=================+==========================+================+
| INTEGER | Section 2.1 of [RFC7970] | integer; see |
| | | Section 2.2.1 |
+-----------------+--------------------------+----------------+
| REAL | Section 2.2 of [RFC7970] | "number" per |
| | | [RFC8259] |
+-----------------+--------------------------+----------------+
| CHARACTER | Section 2.3 of [RFC7970] | "string" per |
| | | [RFC8259] |
+-----------------+--------------------------+----------------+
| STRING | Section 2.3 of [RFC7970] | "string" per |
| | | [RFC8259] |
+-----------------+--------------------------+----------------+
| ML_STRING | Section 2.4 of [RFC7970] | see |
| | | Section 2.2.2 |
+-----------------+--------------------------+----------------+
| BYTE | Section 2.5.1 of | "string" per |
| | [RFC7970] | [RFC8259] |
+-----------------+--------------------------+----------------+
| BYTE[] | Section 2.5.1 of | "string" per |
| | [RFC7970] | [RFC8259] |
+-----------------+--------------------------+----------------+
| HEXBIN | Section 2.5.2 of | "string" per |
| | [RFC7970] | [RFC8259] |
+-----------------+--------------------------+----------------+
| HEXBIN[] | Section 2.5.2 of | "string" per |
| | [RFC7970] | [RFC8259] |
+-----------------+--------------------------+----------------+
| ENUM | Section 2.6 of [RFC7970] | see |
| | | Section 2.2.3 |
+-----------------+--------------------------+----------------+
| DATETIME | Section 2.7 of [RFC7970] | "string" per |
| | | [RFC8259] |
+-----------------+--------------------------+----------------+
| TIMEZONE | Section 2.8 of [RFC7970] | "string" per |
| | | [RFC8259] |
+-----------------+--------------------------+----------------+
| PORTLIST | Section 2.9 of [RFC7970] | "string" per |
| | | [RFC8259] |
+-----------------+--------------------------+----------------+
| POSTAL | Section 2.10 of | ML_STRING; see |
| | [RFC7970] | Section 2.2.2 |
+-----------------+--------------------------+----------------+
| PHONE | Section 2.11 of | "string" per |
| | [RFC7970] | [RFC8259] |
+-----------------+--------------------------+----------------+
| EMAIL | Section 2.12 of | "string" per |
| | [RFC7970] | [RFC8259] |
+-----------------+--------------------------+----------------+
| URL | Section 2.13 of | "string" per |
| | [RFC7970] | [RFC8259] |
+-----------------+--------------------------+----------------+
| ID | Section 2.14 of | "string" per |
| | [RFC7970] | [RFC8259] |
+-----------------+--------------------------+----------------+
| IDREF | Section 2.14 of | "string" per |
| | [RFC7970] | [RFC8259] |
+-----------------+--------------------------+----------------+
| SOFTWARE | Section 2.15 of | see |
| | [RFC7970] | Section 2.2.4 |
+-----------------+--------------------------+----------------+
| STRUCTUREDINFO | Section 4.4 of [RFC7203] | see |
| | | Section 2.2.5 |
+-----------------+--------------------------+----------------+
| EXTENSION | Section 2.16 of | see |
| | [RFC7970] | Section 2.2.6 |
+-----------------+--------------------------+----------------+
Table 1: JSON Data TypesNow for the CBOR side of things 🎀 Table 2 shows how each IODEF data type gets encoded in CBOR, plus the matching CDDL Prelude [RFC8610] type for each one. It's the same vibe as Table 1, just in a different outfit 🧚
+=================+================+=============================+
| IODEF Data Type | CBOR Data Type | CDDL Prelude [RFC8610] |
+=================+================+=============================+
| INTEGER | 0, 1, 6 tag 2, | integer |
| | 6 tag 3 | |
+-----------------+----------------+-----------------------------+
| REAL | 7 bits 26 | float32 |
+-----------------+----------------+-----------------------------+
| CHARACTER | 3 | text |
+-----------------+----------------+-----------------------------+
| STRING | 3 | text |
+-----------------+----------------+-----------------------------+
| ML_STRING | 5 | Maps/Structs (Section 3.5.1 |
| | | of [RFC8610]) |
+-----------------+----------------+-----------------------------+
| BYTE | 6 tag 22 | eb64legacy |
+-----------------+----------------+-----------------------------+
| BYTE[] | 6 tag 22 | eb64legacy |
+-----------------+----------------+-----------------------------+
| HEXBIN | 6 tag 23 | eb16 |
+-----------------+----------------+-----------------------------+
| HEXBIN[] | 6 tag 23 | eb16 |
+-----------------+----------------+-----------------------------+
| ENUM | - | Choices (Section 2.2.2 of |
| | | [RFC8610]) |
+-----------------+----------------+-----------------------------+
| DATETIME | 6 tag 0 | tdate |
+-----------------+----------------+-----------------------------+
| TIMEZONE | 3 | text |
+-----------------+----------------+-----------------------------+
| PORTLIST | 3 | text |
+-----------------+----------------+-----------------------------+
| POSTAL | 3 | ML_STRING (Section 2.2.2) |
+-----------------+----------------+-----------------------------+
| PHONE | 3 | text |
+-----------------+----------------+-----------------------------+
| EMAIL | 3 | text |
+-----------------+----------------+-----------------------------+
| URL | 6 tag 32 | uri |
+-----------------+----------------+-----------------------------+
| ID | 3 | text |
+-----------------+----------------+-----------------------------+
| IDREF | 3 | text |
+-----------------+----------------+-----------------------------+
| SOFTWARE | 5 | Maps/Structs (Section 3.5.1 |
| | | of [RFC8610]) |
+-----------------+----------------+-----------------------------+
| STRUCTUREDINFO | 5 | Maps/Structs (Section 3.5.1 |
| | | of [RFC8610]) |
+-----------------+----------------+-----------------------------+
| EXTENSION | 5 | Maps/Structs (Section 3.5.1 |
| | | of [RFC8610]) |
+-----------------+----------------+-----------------------------+
Table 2: CBOR Data Types2.2. Complex JSON Types 💜
Okay, bestie, this is where the fancier types get their own spotlight 🌟
2.2.1. Integer
An integer is basically a subset of JSON's "number" type 🔢 It's for signed digits written in Base 10. The definition is "[ minus ] int" per [RFC8259], Section 6.
2.2.2. Multilingual Strings
So if a string needs to be shown in a human-readable language that's different from the document's default encoding, the information model uses the ML_STRING data type 🌍 It's implemented either as an object with "value", "lang", and "translation-id" elements, or as a text string as defined in Section 6. Here's an example, slay 🫶
"MLStringType": {
"value": "free-form text", # STRING
"lang": "en", # ENUM
"translation-id": "jp2en0023" # STRING
}Quick heads up 🙈 In the figures throughout this document, some extra info comes after a "#". That stuff is NOT valid JSON syntax. It's just there to help you read the examples more easily 📖
2.2.3. Enum
An Enum is an ordered list of acceptable string values 🍓 Each value gets a representative keyword. Inside the data model, those enumerated type keywords are used as attribute values ✨
2.2.4. Software and Software Reference
A particular version of software is represented in the information model by the SOFTWARE data type 💻 The software can be described using a reference, a Uniform Resource Locator (URL) [RFC3986], or free-form text. The SOFTWARE data type is implemented as an object with "SoftwareReference", "URL", and "Description" elements as defined in Section 6. Examples are below 👑
"SoftwareType": {
"SoftwareReference": {...}, # SoftwareReference
"Description": ["MS Windows"] # STRING
}The SoftwareReference class is a reference to a particular version of software 🦋 Here's an example, iykyk 💅
"SoftwareReference": {
"value": "cpe:/a:google:chrome:59.0.3071.115", # STRING
"spec-name": "cpe", # ENUM
"dtype": "string" # ENUM
}2.2.5. Structured Information 🎀
Okay so when info shows up as a structured string (like an ID) or as structured stuff (like XML documents), the information model stores it in the STRUCTUREDINFO data type 💅. Fun history: this type was first specified in Section 4.4 of [RFC7203] as the basic structure for its extension classes 🦋. STRUCTUREDINFO is an object with "SpecID", "ext-SpecID", "ContentID", "RawData", and "Reference" elements 🧚. Here's an example of embedding a structured ID:
"STRUCTUREDINFO": {
"SpecID": "urn:ietf:params:xml:ns:mile:cwe:3.3", # ENUM
"ContentID": "CWE-89" # STRING
}When you're embedding raw data, it should be encoded as a BYTE type object, like this:
"STRUCTUREDINFO": {
"SpecID": "urn:ietf:params:xml:ns:mile:mmdef:1.2", # ENUM
"RawData": "<<< encoded structured data >>>" # BYTE
}Here's the important bit 👑: when embedding the raw data, base64 encoding defined in Section 4 of [RFC4648] MUST be used for JSON IODEF, while binary representation MUST be used for CBOR IODEF. No exceptions, bestie 🫶.
2.2.6. EXTENSION 🌈
Got info that doesn't fit anywhere else in the IODEF? No stress! The EXTENSION data type is your generic extension mechanism 🍓. It's implemented as an ExtensionType object with "value", "name", "dtype", "ext-dtype", "meaning", "formatid", "restriction", "ext-restriction", and "observable-id" elements ✨. An example for embedding a structured ID is shown below:
"ExtensionType": {
"value": "xxxxxxx", # STRING
"name": "Syslog", # STRING
"dtype": "string", # ENUM
"meaning": "Syslog from the security appliance X" # STRING
}Quick note: this data type is specified in [RFC7970] as its generic extension mechanism 💜. If a data item has internal structure that's meant to be processed outside of the IODEF framework, you can consider using the STRUCTUREDINFO data type from Section 2.2.5 instead 🙈.
3. IODEF JSON Data Model 💖
3.1. Classes and Elements 🦋
Let's talk about how the IODEF classes, their elements, and the matching sections in [RFC7970] all line up. It's giving organized 😭. Note that the complete JSON schema is defined in Section 6 using CDDL 💅.
okay bestie, this is the big class cheat sheet 💖 Every row is an IODEF class, with its elements and attributes listed in order, plus the section of [RFC7970] where it's defined 🎀
+===========================+============================+==========+
| IODEF Class | Class, Element, and |Section in|
| | Attribute |[RFC7970] |
+===========================+============================+==========+
| IODEF-Document | version | 3.1 |
| | lang? | |
| | format-id? | |
| | private-enum-name? | |
| | private-enum-id? | |
| | Incident+ | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| Incident | purpose | 3.2 |
| | ext-purpose? | |
| | status? | |
| | ext-status? | |
| | lang? | |
| | restriction? | |
| | ext-restriction? | |
| | observable-id? | |
| | IncidentID | |
| | AlternativeID? | |
| | RelatedActivity* | |
| | DetectTime? | |
| | StartTime? | |
| | EndTime? | |
| | RecoveryTime? | |
| | ReportTime? | |
| | GenerationTime | |
| | Description* | |
| | Discovery* | |
| | Assessment* | |
| | Method* | |
| | Contact+ | |
| | EventData* | |
| | Indicator* | |
| | History? | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| IncidentID | id | 3.4 |
| | name | |
| | instance? | |
| | restriction? | |
| | ext-restriction? | |
+---------------------------+----------------------------+----------+
| AlternativeID | restriction? | 3.5 |
| | ext-restriction? | |
| | IncidentID+ | |
+---------------------------+----------------------------+----------+
| RelatedActivity | restriction? | 3.6 |
| | ext-restriction? | |
| | IncidentID* | |
| | URL* | |
| | ThreatActor* | |
| | Campaign* | |
| | IndicatorID* | |
| | Confidence? | |
| | Description* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| ThreatActor | restriction? | 3.7 |
| | ext-restriction? | |
| | ThreatActorID* | |
| | URL* | |
| | Description* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| Campaign | restriction? | 3.8 |
| | ext-restriction? | |
| | CampaignID* | |
| | URL* | |
| | Description* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| Contact | role | 3.9 |
| | ext-role? | |
| | type | |
| | ext-type? | |
| | restriction? | |
| | ext-restriction? | |
| | ContactName* | |
| | ContactTitle* | |
| | Description* | |
| | RegistryHandle* | |
| | PostalAddress* | |
| | Email* | |
| | Telephone* | |
| | Timezone? | |
| | Contact* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| RegistryHandle | handle | 3.9.1 |
| | registry | |
| | ext-registry? | |
+---------------------------+----------------------------+----------+
| PostalAddress | type? | 3.9.2 |
| | ext-type? | |
| | PAddress | |
| | Description* | |
+---------------------------+----------------------------+----------+
| Email | type? | 3.9.3 |
| | ext-type? | |
| | EmailTo | |
| | Description* | |
+---------------------------+----------------------------+----------+
| Telephone | type? | 3.9.4 |
| | ext-type? | |
| | TelephoneNumber | |
| | Description* | |
+---------------------------+----------------------------+----------+
| Discovery | source? | 3.10 |
| | ext-source? | |
| | restriction? | |
| | ext-restriction? | |
| | Description* | |
| | Contact* | |
| | DetectionPattern* | |
+---------------------------+----------------------------+----------+
| DetectionPattern | restriction? | 3.10.1 |
| | ext-restriction? | |
| | observable-id? | |
| | Application | |
| | Description* | |
| | DetectionConfiguration* | |
+---------------------------+----------------------------+----------+
| Method | restriction? | 3.11 |
| | ext-restriction? | |
| | Reference* | |
| | Description* | |
| | AttackPattern* | |
| | Vulnerability* | |
| | Weakness* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| Weakness | restriction? | 4.5.5 in |
| | ext-restriction? |[RFC7203] |
+---------------------------+----------------------------+----------+
| Reference | observable-id? | 3.11.1 |
| | ReferenceName? | |
| | URL* | |
| | Description* | |
+---------------------------+----------------------------+----------+
| Assessment | occurrence? | 3.12 |
| | restriction? | |
| | ext-restriction? | |
| | observable-id? | |
| | IncidentCategory* | |
| | SystemImpact* | |
| | BusinessImpact* | |
| | TimeImpact* | |
| | MonetaryImpact* | |
| | IntendedImpact* | |
| | Counter* | |
| | MitigatingFactor* | |
| | Cause* | |
| | Confidence? | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| SystemImpact | severity? | 3.12.1 |
| | completion? | |
| | type | |
| | ext-type? | |
| | Description* | |
+---------------------------+----------------------------+----------+that's the whole table for this part, so we're literally mid-way through the class list 🦋 more coming up next, stay tuned ✨
okay bestie, the table is still going and it's giving a lot 💅 each row is a class, and the little ?, *, and + marks are doing their usual job of saying how many of each thing you can have 🎀
| BusinessImpact | severity? | 3.12.2 |
| | ext-severity? | |
| | type | |
| | ext-type? | |
| | Description* | |
+---------------------------+----------------------------+----------+
| TimeImpact | value | 3.12.3 |
| | severity? | |
| | metric | |
| | ext-metric? | |
| | duration? | |
| | ext-duration? | |
+---------------------------+----------------------------+----------+
| MonetaryImpact | value | 3.12.4 |
| | severity? | |
| | currency? | |
+---------------------------+----------------------------+----------+
| Confidence | value | 3.12.5 |
| | rating | |
| | ext-rating? | |
+---------------------------+----------------------------+----------+
| History | restriction? | 3.13 |
| | ext-restriction? | |
| | HistoryItem+ | |
+---------------------------+----------------------------+----------+
| HistoryItem | action | 3.13.1 |
| | ext-action? | |
| | restriction? | |
| | ext-restriction? | |
| | observable-id? | |
| | DateTime | |
| | IncidentID? | |
| | Contact? | |
| | Description* | |
| | DefinedCOA* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| EventData | restriction? | 3.14 |
| | ext-restriction? | |
| | observable-id? | |
| | Description* | |
| | DetectTime? | |
| | StartTime? | |
| | EndTime? | |
| | RecoveryTime? | |
| | ReportTime? | |
| | Contact* | |
| | Discovery* | |
| | Assessment? | |
| | Method* | |
| | System* | |
| | Expectation* | |
| | RecordData* | |
| | EventData* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| Expectation | action? | 3.15 |
| | ext-action? | |
| | severity? | |
| | restriction? | |
| | ext-restriction? | |
| | observable-id? | |
| | Description* | |
| | DefinedCOA* | |
| | StartTime? | |
| | EndTime? | |
| | Contact? | |
+---------------------------+----------------------------+----------+
| System | category? | 3.17 |
| | ext-category? | |
| | interface? | |
| | spoofed? | |
| | virtual? | |
| | ownership? | |
| | ext-ownership? | |
| | restriction? | |
| | ext-restriction? | |
| | Node | |
| | NodeRole* | |
| | Service* | |
| | OperatingSystem* | |
| | Counter* | |
| | AssetID* | |
| | Description* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| Node | DomainData* | 3.18 |
| | Address* | |
| | PostalAddress? | |
| | Location* | |
| | Counter* | |
+---------------------------+----------------------------+----------+
| Address | value | 3.18.1 |
| | category | |
| | ext-category? | |
| | vlan-name? | |
| | vlan-num? | |
| | observable-id? | |
+---------------------------+----------------------------+----------+
| NodeRole | category | 3.18.2 |
| | ext-category? | |
| | Description* | |
+---------------------------+----------------------------+----------+
| Counter | value | 3.18.3 |
| | type | |
| | ext-type? | |
| | unit | |
| | ext-unit? | |
| | meaning? | |
| | duration? | |
| | ext-duration? | |
+---------------------------+----------------------------+----------+
| DomainData | system-status | 3.19 |
| | ext-system-status? | |
| | domain-status | |
| | ext-domain-status? | |
| | observable-id? | |
| | Name | |
| | DateDomainWasChecked? | |
| | RegistrationDate? | |
| | ExpirationDate? | |
| | RelatedDNS* | |
| | Nameservers* | |
| | DomainContacts? | |
+---------------------------+----------------------------+----------+
| Nameservers | Server | 3.19.1 |
| | Address* | |
+---------------------------+----------------------------+----------+
| DomainContacts | SameDomainContact? | 3.19.2 |
| | Contact+ | |
+---------------------------+----------------------------+----------+
| Service | ip-protocol? | 3.20 |
| | observable-id? | |
| | ServiceName? | |
| | Port? | |
| | Portlist? | |
| | ProtoCode? | |
| | ProtoType? | |
| | ProtoField? | |
| | ApplicationHeaderField* | |
| | EmailData? | |
| | Application? | |
+---------------------------+----------------------------+----------+
| ServiceName | IANAService? | 3.20.1 |
| | URL* | |
| | Description* | |
+---------------------------+----------------------------+----------+
| EmailData | observable-id? | 3.21 |
| | EmailTo* | |
| | EmailFrom? | |
| | EmailSubject? | |
| | EmailX-Mailer? | |
| | EmailHeaderField* | |
| | EmailHeaders? | |
| | EmailBody? | |
| | EmailMessage? | |
| | HashData* | |
| | Signature* | |
+---------------------------+----------------------------+----------+
| RecordData | restriction? | 3.22.1 |
| | ext-restriction? | |
| | observable-id? | |
| | DateTime? | |
| | Description* | |the table keeps going next, and there's a lot more to unpack 🦋🌸
okay bestie, this one is the ultimate cheat sheet 🎀 every class, every element that lives inside it, and which section to go check for the juicy details 🦋
| | Application? | |
| | RecordPattern* | |
| | RecordItem* | |
| | URL* | |
| | FileData* | |
| |WindowsRegistryKeysModified*| |
| | CertificateData* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| RecordPattern | type | 3.22.2 |
| | ext-type? | |
| | offset? | |
| | offsetunit? | |
| | ext-offsetunit? | |
| | instance? | |
| | value | |
+---------------------------+----------------------------+----------+
|WindowsRegistryKeysModified| observable-id? | 3.23 |
| | Key+ | |
+---------------------------+----------------------------+----------+
| Key | registryaction? | 3.23.1 |
| | ext-registryaction? | |
| | observable-id? | |
| | KeyName | |
| | KeyValue? | |
+---------------------------+----------------------------+----------+
| CertificateData | restriction? | 3.24 |
| | ext-restriction? | |
| | observable-id? | |
| | Certificate+ | |
+---------------------------+----------------------------+----------+
| Certificate | observable-id? | 3.24.1 |
| | X509Data | |
| | Description* | |
+---------------------------+----------------------------+----------+
| FileData | restriction? | 3.25 |
| | ext-restriction? | |
| | observable-id? | |
| | File+ | |
+---------------------------+----------------------------+----------+
| File | observable-id? | 3.25.1 |
| | FileName? | |
| | FileSize? | |
| | FileType? | |
| | URL* | |
| | HashData? | |
| | Signature* | |
| | AssociatedSoftware? | |
| | FileProperties* | |
+---------------------------+----------------------------+----------+
| HashData | scope | 3.26 |
| | HashTargetID? | |
| | Hash* | |
| | FuzzyHash* | |
+---------------------------+----------------------------+----------+
| Hash | DigestMethod | 3.26.1 |
| | DigestValue | |
| | CanonicalizationMethod? | |
| | Application? | |
+---------------------------+----------------------------+----------+
| FuzzyHash | FuzzyHashValue+ | 3.26.2 |
| | Application? | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| Indicator | restriction? | 3.29 |
| | ext-restriction? | |
| | IndicatorID | |
| | AlternativeIndicatorID* | |
| | Description* | |
| | StartTime? | |
| | EndTime? | |
| | Confidence? | |
| | Contact* | |
| | Observable? | |
| | uid-ref? | |
| | IndicatorExpression? | |
| | IndicatorReference? | |
| | NodeRole* | |
| | AttackPhase* | |
| | Reference* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| IndicatorID | id | 3.29.1 |
| | name | |
| | version | |
+---------------------------+----------------------------+----------+
| AlternativeIndicatorID | restriction? | 3.29.2 |
| | ext-restriction? | |
| | IndicatorID+ | |
+---------------------------+----------------------------+----------+
| Observable | restriction? | 3.29.3 |
| | ext-restriction? | |
| | System? | |
| | Address? | |
| | DomainData? | |
| | Service? | |
| | EmailData? | |
| |WindowsRegistryKeysModified?| |
| | FileData? | |
| | CertificateData? | |
| | RegistryHandle? | |
| | RecordData? | |
| | EventData? | |
| | Incident? | |
| | Expectation? | |
| | Reference? | |
| | Assessment? | |
| | DetectionPattern? | |
| | HistoryItem? | |
| | BulkObservable? | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| BulkObservable | type? | 3.29.3.1 |
| | ext-type? | |
| | BulkObservableFormat? | |
| | BulkObservableList | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| BulkObservableFormat | Hash? |3.29.3.1.1|
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| IndicatorExpression | operator? | 3.29.4 |
| | ext-operator? | |
| | IndicatorExpression* | |
| | Observable* | |
| | uid-ref* | |
| | IndicatorReference* | |
| | Confidence? | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
| IndicatorReference | uid-ref? | 3.29.7 |
| | euid-ref? | |
| | version? | |
+---------------------------+----------------------------+----------+
| AttackPhase | AttackPhaseID* | 3.29.8 |
| | URL* | |
| | Description* | |
| | AdditionalData* | |
+---------------------------+----------------------------+----------+
Table 3: IODEF Classesthat's the whole table, babe 💖 every class lines up with its elements, and the section number on the right tells you where to find the full rundown ✨
3.2. Mapping between JSON and XML IODEF ✨
- okay so the attributes and elements of each class in the XML IODEF doc show up as JSON attributes in the JSON IODEF doc, and the order they appear in doesn't matter 🫶
- the
Flowclass is gone 💀 but any class that used to hold aFlownow holds theEventDatainstances directly - the
ApplicationHeaderclass is gone too, so classes just holdApplicationHeaderFieldinstances straight up 🎀 SignatureDatais deleted, and itsSignatureinstances now live directly inside the classes that used to hold them 🦋IndicatorDatais deleted, and those classes now holdIndicatorinstances directly 🌸ObservableReferenceis deleted, and its parent classes just haveuid-refas an element now 🧚Recordis deleted, and classes now holdRecordDatainstances directly 💜- the
MLStringTypegot a glow-up 💅 so it can take a plain text form as well as the predefined object type, which lets you write simple descriptions. Implementations gotta be able to parse anMLStringTypethat shows up as either text or an object, no exceptions 🙈 - elements of the ML_STRING type in XML IODEF become either a STRING type or an ML_STRING type in JSON IODEF. Converting in either direction, the information in the original ML_STRING data must be preserved 😭 And when STRING gets used in place of ML_STRING, parsers can assume its
xml:langis set toen🌈 - the data models of the extension classes from [RFC7203] that [RFC7970] references are represented by the
STRUCTUREDINFOclass defined in this document ✨ Signature,X509Data, andRawDataare base64 encoded for JSON IODEF and binary encoded for CBOR IODEF, so they all becomeBYTEobjects 🔥EmailBodyrepresents a whole message body, MIME structure and all, the same way [RFC7970] does it. If the email is a MIME multipart, theEmailBodyholds several body parts split up by boundary strings 📧- the
ipv6-net-masktype attribute of theBulkObservableclass is still around for backward compatibility, but its use is not recommended because IPv6 doesn't use netmasks anymore 🙈 - ENUM values in this document are extensible and managed by IANA, same as in [RFC7970] 👑 The values in the table get used both by [RFC7970] implementations and by their JSON (and CBOR) bindings from this document
- this document uses JSON's "number" type for integers, but those only keep full precision for integer values between
-2^(53)and2^(53). If you're dealing with integers outside that range, this issue needs to be considered 🍓 - binaries are encoded in bytes. XML IODEF in [RFC7970] uses HEXBIN because XML can't embed binaries as they are 🫠
4. Examples 🎀
okay so this section is full of IODEF examples 🧁 They don't show off the full capabilities of the data model, and they're not the only way to encode the same info, so don't treat them as the one true way 💖
4.1. Minimal Example 🌸
bestie, this one is the bare minimum: just the mandatory elements and attributes 💅 It's shown in JSON and then in CBOR, in that order 💜
{
"version": "2.0",
"lang": "en",
"Incident": [{
"purpose": "reporting",
"restriction": "private",
"IncidentID": {
"id": "492382",
"name": "csirt.example.com"
},
"GenerationTime": "2015-07-18T09:00:00-05:00",
"Contact": [{
"type": "organization",
"role": "creator",
"Email": [{"EmailTo": "contact@csirt.example.com"}]
}]
}]
}Figure 1: A Minimal Example in JSON 🦋
A3 # map(3)
37 # negative(23)
63 # text(3)
322E30 # "2.0"
36 # negative(22)
62 # text(2)
656E # "en"
32 # negative(18)
81 # array(1)
A5 # map(5)
21 # negative(1)
69 # text(9)
7265706F7274696E67 # "reporting"
29 # negative(9)
67 # text(7)
70726976617465 # "private"
02 # unsigned(2)
A2 # map(2)
12 # unsigned(18)
66 # text(6)
343932333832 # "492382"
2E # negative(14)
71 # text(17)
63736972742E6578616D706C652E636F6D
# "csirt.example.com"
0A # unsigned(10)
78 19 # text(25)
323031352D30372D31385430393A30303A30302D30353A3030
# "2015-07-18T09:00:00
# -05:00"
0E # unsigned(14)
81 # array(1)
A3 # map(3)
18 1C # unsigned(28)
6C # text(12)
6F7267616E697A6174696F6E # "organization"
18 1A # unsigned(26)
67 # text(7)
63726561746F72 # "creator"
18 22 # unsigned(34)
81 # array(1)
A1 # map(1)
18 29 # unsigned(41)
78 19 # text(25)
636F6E746163744063736972742E6578616D70
6C652E636F6D
# "contact@csirt.example.com"Figure 2: A Minimal Example in CBOR 🧚
4.2. Indicators from a Campaign 🧚
okay so here's a juicy example of C2 domains from one campaign, shown first in JSON and then in CBOR 💖
{
"version": "2.0",
"lang": "en",
"Incident": [{
"purpose": "watch",
"restriction": "green",
"IncidentID": {
"id": "897923",
"name": "csirt.example.com"
},
"RelatedActivity": [{
"ThreatActor": [{
"ThreatActorID": ["TA-12-AGGRESSIVE-BUTTERFLY"],
"Description": ["Aggressive Butterfly"]}],
"Campaign": [{
"CampaignID": ["C-2015-59405"],
"Description": ["Orange Giraffe"]
}]
}],
"GenerationTime": "2015-10-02T11:18:00-05:00",
"Description": ["Summarizes the Indicators of Compromise for the
Orange Giraffe campaign of the Aggressive Butterfly crime
gang."],
"Assessment": [{
"Impact": [{"BusinessImpact": {"type": "breach-proprietary"}}]
}],
"Contact": [{
"type": "organization",
"role": "creator",
"ContactName": ["CSIRT for example.com"],
"Email": [{
"EmailTo": "contact@csirt.example.com"
}]
}],
"Indicator": [{
"IndicatorID": {
"id": "G90823490",
"name": "csirt.example.com",
"version": "1"
},
"Description": ["C2 domains"],
"StartTime": "2014-12-02T11:18:00-05:00",
"Observable": {
"BulkObservable": {
"type": "domain-name",
"BulkObservableList": "kj290023j09r34.example.com"}
}
}]
}]
}Figure 3: Indicators from a Campaign in JSON
and now the CBOR version, which is the same data all squished down into bytes 🫶 ✨
A3 # map(3)
37 # negative(23)
63 # text(3)
322E30 # "2.0"
36 # negative(22)
62 # text(2)
656E # "en"
32 # negative(18)
81 # array(1)
A9 # map(9)
21 # negative(1)
65 # text(5)
7761746368 # "watch"
29 # negative(9)
65 # text(5)
677265656E # "green"
02 # unsigned(2)
A2 # map(2)
12 # unsigned(18)
66 # text(6)
383937393233 # "897923"
2E # negative(14)
71 # text(17)
63736972742E6578616D706C652E636F6D
# "csirt.example.com"
04 # unsigned(4)
81 # array(1)
A2 # map(2)
14 # unsigned(20)
81 # array(1)
A2 # map(2)
18 18 # unsigned(24)
81 # array(1)
78 1A # text(26)
54412D31322D414747524553534956452D4
25554544552464C59
# "TA-12-AGGRESSIVE
# -BUTTERFLY"
24 # negative(4)
81 # array(1)
74 # text(20)
41676772657373697665204275747465726
66C79
# "Aggressive Butterfly"
15 # unsigned(21)
81 # array(1)
A2 # map(2)
18 19 # unsigned(25)
81 # array(1)
6C # text(12)
432D323031352D3539343035
# "C-2015-59405"
24 # negative(4)
81 # array(1)
6E # text(14)
4F72616E67652047697261666665
# "Orange Giraffe"
0A # unsigned(10)
78 19 # text(25)
323031352D31302D30325431313A31383A30302D30353A3030
# "2015-10-02T11:18:00-05:00"
24 # negative(4)
81 # array(1)
78 6F # text(111)
53756D6D6172697A65732074686520496E64696361746F7
273206F6620436F6D70726F6D69736520666F7220746865
204F72616E676520476972616666652063616D706169676
E206F662074686520416767726573736976652042757474
6572666C79206372696D652067616E672E
# "Summarizes the Indicators
# of Compromise for the
# Orange Giraffe campaign
# of the Aggressive
# Butterfly crime gang."
0C # unsigned(12)
81 # array(1)
A1 # map(1)
18 3F # unsigned(63)
81 # array(1)
A1 # map(1)
18 41 # unsigned(65)
A1 # map(1)
18 1C # unsigned(28)
72 # text(18)
6272656163682D70726F7072696574617279
# "breach-proprietary"
0E # unsigned(14)
81 # array(1)
A4 # map(4)
18 1C # unsigned(28)
6C # text(12)
6F7267616E697A6174696F6E
# "organization"
18 1A # unsigned(26)
67 # text(7)
63726561746F72 # "creator"
18 1E # unsigned(30)
81 # array(1)
75 # text(21)
435349525420666F72206578616D706C652E636F6D
# "CSIRT for example.com"
18 22 # unsigned(34)
81 # array(1)
A1 # map(1)
18 29 # unsigned(41)
78 19 # text(25)
636F6E746163744063736972742E6578616D70
6C652E636F6D
# "contact@csirt.example.com"
10 # unsigned(16)
81 # array(1)
A4 # map(4)
16 # unsigned(22)
A3 # map(3)
12 # unsigned(18)
69 # text(9)
473930383233343930 # "G90823490"
2E # negative(14)
71 # text(17)
63736972742E6578616D706C652E636F6D
# "csirt.example.com"
37 # negative(23)
61 # text(1)
31 # "1"
24 # negative(4)
81 # array(1)
6A # text(10)
433220646F6D61696E73 # "C2 domains"
06 # unsigned(6)
78 19 # text(25)
323031342D31322D30325431313A31383A30302D30353A3030
# "2014-12-02T11:18:00-05:00"
18 AB # unsigned(171)
A1 # map(1)
18 B0 # unsigned(176)
A2 # map(2)
18 1C # unsigned(28)
6B # text(11)
646F6D61696E2D6E616D65
# "domain-name"
18 B2 # unsigned(178)
78 1A # text(26)
6B6A3239303032336A30397233342E6578616D
706C652E636F6D
# "kj290023j09r34.example.com"Figure 4: Indicators from a Campaign in CBOR
5. Mapkeys ✨
the mapkeys are provided in Table 4 for minimizing the CBOR size 🌸
Okay, bestie, here's the rest of the mapkey lineup 💅 Each iodef- name gets its own cborkey number, and the negative ones are the first ones I'm listing 🧚
+===================================+=========+
| mapkey | cborkey |
+===================================+=========+
| iodef-version | -24 |
+-----------------------------------+---------+
| iodef-lang | -23 |
+-----------------------------------+---------+
| iodef-format-id | -22 |
+-----------------------------------+---------+
| iodef-private-enum-name | -21 |
+-----------------------------------+---------+
| iodef-private-enum-id | -20 |
+-----------------------------------+---------+
| iodef-Incident | -19 |
+-----------------------------------+---------+
| iodef-AdditionalData | -18 |
+-----------------------------------+---------+
| iodef-value | -17 |
+-----------------------------------+---------+
| iodef-translation-id | -16 |
+-----------------------------------+---------+
| iodef-name | -15 |
+-----------------------------------+---------+
| iodef-dtype | -14 |
+-----------------------------------+---------+
| iodef-ext-dtype | -13 |
+-----------------------------------+---------+
| iodef-meaning | -12 |
+-----------------------------------+---------+
| iodef-formatid | -11 |
+-----------------------------------+---------+
| iodef-restriction | -10 |
+-----------------------------------+---------+
| iodef-ext-restriction | -9 |
+-----------------------------------+---------+
| iodef-observable-id | -8 |
+-----------------------------------+---------+
| iodef-SoftwareReference | -7 |
+-----------------------------------+---------+
| iodef-URL | -6 |
+-----------------------------------+---------+
| iodef-Description | -5 |
+-----------------------------------+---------+
| iodef-spec-name | -4 |
+-----------------------------------+---------+
| iodef-ext-spec-name | -3 |
+-----------------------------------+---------+
| iodef-purpose | -2 |
+-----------------------------------+---------+
| iodef-ext-purpose | -1 |
+-----------------------------------+---------+
| iodef-status | 0 |
+-----------------------------------+---------+
| iodef-ext-status | 1 |
+-----------------------------------+---------+
| iodef-IncidentID | 2 |
+-----------------------------------+---------+
| iodef-AlternativeID | 3 |
+-----------------------------------+---------+
| iodef-RelatedActivity | 4 |
+-----------------------------------+---------+
| iodef-DetectTime | 5 |
+-----------------------------------+---------+
| iodef-StartTime | 6 |
+-----------------------------------+---------+
| iodef-EndTime | 7 |
+-----------------------------------+---------+
| iodef-RecoveryTime | 8 |
+-----------------------------------+---------+
| iodef-ReportTime | 9 |
+-----------------------------------+---------+
| iodef-GenerationTime | 10 |
+-----------------------------------+---------+
| iodef-Discovery | 11 |
+-----------------------------------+---------+
| iodef-Assessment | 12 |
+-----------------------------------+---------+
| iodef-Method | 13 |
+-----------------------------------+---------+
| iodef-Contact | 14 |
+-----------------------------------+---------+
| iodef-EventData | 15 |
+-----------------------------------+---------+
| iodef-Indicator | 16 |
+-----------------------------------+---------+
| iodef-History | 17 |
+-----------------------------------+---------+
| iodef-id | 18 |
+-----------------------------------+---------+
| iodef-instance | 19 |
+-----------------------------------+---------+
| iodef-ThreatActor | 20 |
+-----------------------------------+---------+
| iodef-Campaign | 21 |
+-----------------------------------+---------+
| iodef-IndicatorID | 22 |
+-----------------------------------+---------+
| iodef-Confidence | 23 |
+-----------------------------------+---------+
| iodef-ThreatActorID | 24 |
+-----------------------------------+---------+
| iodef-CampaignID | 25 |
+-----------------------------------+---------+
| iodef-role | 26 |
+-----------------------------------+---------+
| iodef-ext-role | 27 |
+-----------------------------------+---------+
| iodef-type | 28 |
+-----------------------------------+---------+
| iodef-ext-type | 29 |
+-----------------------------------+---------+
| iodef-ContactName | 30 |
+-----------------------------------+---------+
| iodef-ContactTitle | 31 |
+-----------------------------------+---------+
| iodef-RegistryHandle | 32 |
+-----------------------------------+---------+
| iodef-PostalAddress | 33 |
+-----------------------------------+---------+
| iodef-Email | 34 |
+-----------------------------------+---------+
| iodef-Telephone | 35 |
+-----------------------------------+---------+
| iodef-Timezone | 36 |
+-----------------------------------+---------+
| iodef-handle | 37 |
+-----------------------------------+---------+
| iodef-registry | 38 |
+-----------------------------------+---------+
| iodef-ext-registry | 39 |
+-----------------------------------+---------+
| iodef-PAddress | 40 |
+-----------------------------------+---------+
| iodef-EmailTo | 41 |
+-----------------------------------+---------+
| iodef-TelephoneNumber | 42 |
+-----------------------------------+---------+
| iodef-source | 43 |
+-----------------------------------+---------+
| iodef-ext-source | 44 |
+-----------------------------------+---------+
| iodef-DetectionPattern | 45 |
+-----------------------------------+---------+
| iodef-DetectionConfiguration | 46 |
+-----------------------------------+---------+
| iodef-Application | 47 |
+-----------------------------------+---------+
| iodef-Reference | 48 |
+-----------------------------------+---------+
| iodef-AttackPattern | 49 |
+-----------------------------------+---------+
| iodef-Vulnerability | 50 |
+-----------------------------------+---------+
| iodef-Weakness | 51 |
+-----------------------------------+---------+
| iodef-SpecID | 52 |
+-----------------------------------+---------+
| iodef-ext-SpecID | 53 |
+-----------------------------------+---------+
| iodef-ContentID | 54 |
+-----------------------------------+---------+
| iodef-RawData | 55 |
+-----------------------------------+---------+
| iodef-Platform | 56 |
+-----------------------------------+---------+
| iodef-Scoring | 57 |
+-----------------------------------+---------+
| iodef-ReferenceName | 58 |
+-----------------------------------+---------+
| iodef-specIndex | 59 |
+-----------------------------------+---------+
| iodef-ID | 60 |
+-----------------------------------+---------+
| iodef-occurrence | 61 |
+-----------------------------------+---------+
| iodef-IncidentCategory | 62 |
+-----------------------------------+---------+
| iodef-Impact | 63 |
+-----------------------------------+---------+
| iodef-SystemImpact | 64 |
+-----------------------------------+---------+
| iodef-BusinessImpact | 65 |
+-----------------------------------+---------+
| iodef-TimeImpact | 66 |
+-----------------------------------+---------+
| iodef-MonetaryImpact | 67 |
+-----------------------------------+---------+
| iodef-IntendedImpact | 68 |
+-----------------------------------+---------+
| iodef-Counter | 69 |
+-----------------------------------+---------+
| iodef-MitigatingFactor | 70 |
+-----------------------------------+---------+
| iodef-Cause | 71 |
+-----------------------------------+---------+
| iodef-severity | 72 |
+-----------------------------------+---------+
| iodef-completion | 73 |
+-----------------------------------+---------+
| iodef-ext-severity | 74 |
+-----------------------------------+---------+
| iodef-metric | 75 |
+-----------------------------------+---------+
| iodef-ext-metric | 76 |
+-----------------------------------+---------+
| iodef-duration | 77 |
+-----------------------------------+---------+
| iodef-ext-duration | 78 |
+-----------------------------------+---------+
| iodef-currency | 79 |
+-----------------------------------+---------+
| iodef-rating | 80 |
+-----------------------------------+---------+
| iodef-ext-rating | 81 |
+-----------------------------------+---------+
| iodef-HistoryItem | 82 |
+-----------------------------------+---------+
| iodef-action | 83 |
+-----------------------------------+---------+
| iodef-ext-action | 84 |
+-----------------------------------+---------+
| iodef-DateTime | 85 |
+-----------------------------------+---------+
| iodef-DefinedCOA | 86 |
+-----------------------------------+---------+
| iodef-System | 87 |
+-----------------------------------+---------+
| iodef-Expectation | 88 |
+-----------------------------------+---------+
| iodef-RecordData | 89 |
+-----------------------------------+---------+
| iodef-category | 90 |
+-----------------------------------+---------+
| iodef-ext-category | 91 |
+-----------------------------------+---------+Okay bestie, the mapkeys table is still going, and it's giving CDDL energy ✨
| iodef-interface | 92 |
+-----------------------------------+---------+
| iodef-spoofed | 93 |
+-----------------------------------+---------+
| iodef-virtual | 94 |
+-----------------------------------+---------+
| iodef-ownership | 95 |
+-----------------------------------+---------+
| iodef-ext-ownership | 96 |
+-----------------------------------+---------+
| iodef-Node | 97 |
+-----------------------------------+---------+
| iodef-NodeRole | 98 |
+-----------------------------------+---------+
| iodef-Service | 99 |
+-----------------------------------+---------+
| iodef-OperatingSystem | 100 |
+-----------------------------------+---------+
| iodef-AssetID | 101 |
+-----------------------------------+---------+
| iodef-DomainData | 102 |
+-----------------------------------+---------+
| iodef-Address | 103 |
+-----------------------------------+---------+
| iodef-Location | 104 |
+-----------------------------------+---------+
| iodef-vlan-name | 105 |
+-----------------------------------+---------+
| iodef-vlan-num | 106 |
+-----------------------------------+---------+
| iodef-unit | 107 |
+-----------------------------------+---------+
| iodef-ext-unit | 108 |
+-----------------------------------+---------+
| iodef-system-status | 109 |
+-----------------------------------+---------+
| iodef-ext-system-status | 110 |
+-----------------------------------+---------+
| iodef-domain-status | 111 |
+-----------------------------------+---------+
| iodef-ext-domain-status | 112 |
+-----------------------------------+---------+
| iodef-Name | 113 |
+-----------------------------------+---------+
| iodef-DateDomainWasChecked | 114 |
+-----------------------------------+---------+
| iodef-RegistrationDate | 115 |
+-----------------------------------+---------+
| iodef-ExpirationDate | 116 |
+-----------------------------------+---------+
| iodef-RelatedDNS | 117 |
+-----------------------------------+---------+
| iodef-NameServers | 118 |
+-----------------------------------+---------+
| iodef-DomainContacts | 119 |
+-----------------------------------+---------+
| iodef-Server | 120 |
+-----------------------------------+---------+
| iodef-SameDomainContact | 121 |
+-----------------------------------+---------+
| iodef-ip-protocol | 122 |
+-----------------------------------+---------+
| iodef-ServiceName | 123 |
+-----------------------------------+---------+
| iodef-Port | 124 |
+-----------------------------------+---------+
| iodef-Portlist | 125 |
+-----------------------------------+---------+
| iodef-ProtoCode | 126 |
+-----------------------------------+---------+
| iodef-ProtoType | 127 |
+-----------------------------------+---------+
| iodef-ProtoField | 128 |
+-----------------------------------+---------+
| iodef-ApplicationHeaderField | 129 |
+-----------------------------------+---------+
| iodef-EmailData | 130 |
+-----------------------------------+---------+
| iodef-IANAService | 131 |
+-----------------------------------+---------+
| iodef-EmailFrom | 132 |
+-----------------------------------+---------+
| iodef-EmailSubject | 133 |
+-----------------------------------+---------+
| iodef-EmailX-Mailer | 134 |
+-----------------------------------+---------+
| iodef-EmailHeaderField | 135 |
+-----------------------------------+---------+
| iodef-EmailHeaders | 136 |
+-----------------------------------+---------+
| iodef-EmailBody | 137 |
+-----------------------------------+---------+
| iodef-EmailMessage | 138 |
+-----------------------------------+---------+
| iodef-HashData | 139 |
+-----------------------------------+---------+
| iodef-Signature | 140 |
+-----------------------------------+---------+
| iodef-RecordPattern | 141 |
+-----------------------------------+---------+
| iodef-RecordItem | 142 |
+-----------------------------------+---------+
| iodef-FileData | 143 |
+-----------------------------------+---------+
| iodef-WindowsRegistryKeysModified | 144 |
+-----------------------------------+---------+
| iodef-CertificateData | 145 |
+-----------------------------------+---------+
| iodef-offset | 146 |
+-----------------------------------+---------+
| iodef-offsetunit | 147 |
+-----------------------------------+---------+
| iodef-ext-offsetunit | 148 |
+-----------------------------------+---------+
| iodef-Key | 149 |
+-----------------------------------+---------+
| iodef-registryaction | 150 |
+-----------------------------------+---------+
| iodef-ext-registryaction | 151 |
+-----------------------------------+---------+
| iodef-KeyName | 152 |
+-----------------------------------+---------+
| iodef-KeyValue | 153 |
+-----------------------------------+---------+
| iodef-Certificate | 154 |
+-----------------------------------+---------+
| iodef-X509Data | 155 |
+-----------------------------------+---------+
| iodef-File | 156 |
+-----------------------------------+---------+
| iodef-FileName | 157 |
+-----------------------------------+---------+
| iodef-FileSize | 158 |
+-----------------------------------+---------+
| iodef-FileType | 159 |
+-----------------------------------+---------+
| iodef-AssociatedSoftware | 160 |
+-----------------------------------+---------+
| iodef-FileProperties | 161 |
+-----------------------------------+---------+
| iodef-scope | 162 |
+-----------------------------------+---------+
| iodef-HashTargetID | 163 |
+-----------------------------------+---------+
| iodef-Hash | 164 |
+-----------------------------------+---------+
| iodef-FuzzyHash | 165 |
+-----------------------------------+---------+
| iodef-DigestMethod | 166 |
+-----------------------------------+---------+
| iodef-DigestValue | 167 |
+-----------------------------------+---------+
| iodef-CanonicalizationMethod | 168 |
+-----------------------------------+---------+
| iodef-FuzzyHashValue | 169 |
+-----------------------------------+---------+
| iodef-AlternativeIndicatorID | 170 |
+-----------------------------------+---------+
| iodef-Observable | 171 |
+-----------------------------------+---------+
| iodef-uid-ref | 172 |
+-----------------------------------+---------+
| iodef-IndicatorExpression | 173 |
+-----------------------------------+---------+
| iodef-IndicatorReference | 174 |
+-----------------------------------+---------+
| iodef-AttackPhase | 175 |
+-----------------------------------+---------+
| iodef-BulkObservable | 176 |
+-----------------------------------+---------+
| iodef-BulkObservableFormat | 177 |
+-----------------------------------+---------+
| iodef-BulkObservableList | 178 |
+-----------------------------------+---------+
| iodef-operator | 179 |
+-----------------------------------+---------+
| iodef-ext-operator | 180 |
+-----------------------------------+---------+
| iodef-euid-ref | 181 |
+-----------------------------------+---------+
| iodef-AttackPhaseID | 182 |
+-----------------------------------+---------+Table 4: Mapkeys 🎀
6. The IODEF Data Model (CDDL) 💖
Okay so this section is where the actual IODEF data model lives, and it's giving CDDL realness 🤓✨ Quick heads up: the mapkeys we just went through get described right at the top of the CDDL data model, so it's way easier to read once you've got those in your head 🫶
start = iodef
;;; iodef.json: IODEF-DocumentOkay so this part is basically the big name tag list 🎀 Every field gets a little negative number ID, and then the CDDL rules use those tags to build the whole data model. Literally iconic. 💅
iodef-version = -24
iodef-lang = -23
iodef-format-id = -22
iodef-private-enum-name = -21
iodef-private-enum-id = -20
iodef-Incident = -19
iodef-AdditionalData = -18
iodef-value = -17
iodef-translation-id = -16
iodef-name = -15
iodef-dtype = -14
iodef-ext-dtype = -13
iodef-meaning = -12
iodef-formatid = -11
iodef-restriction = -10
iodef-ext-restriction = -9
iodef-observable-id = -8
iodef-SoftwareReference = -7
iodef-URL = -6
iodef-Description = -5
iodef-spec-name = -4
iodef-ext-spec-name = -3
iodef-purpose = -2
iodef-ext-purpose = -1
iodef-status = 0
iodef-ext-status = 1
iodef-IncidentID = 2
iodef-AlternativeID = 3
iodef-RelatedActivity = 4
iodef-DetectTime = 5
iodef-StartTime = 6
iodef-EndTime = 7
iodef-RecoveryTime = 8
iodef-ReportTime = 9
iodef-GenerationTime = 10
iodef-Discovery = 11
iodef-Assessment = 12
iodef-Method = 13
iodef-Contact = 14
iodef-EventData = 15
iodef-Indicator = 16
iodef-History = 17
iodef-id = 18
iodef-instance = 19
iodef-ThreatActor = 20
iodef-Campaign = 21
iodef-IndicatorID = 22
iodef-Confidence = 23
iodef-ThreatActorID = 24
iodef-CampaignID = 25
iodef-role = 26
iodef-ext-role = 27
iodef-type = 28
iodef-ext-type = 29
iodef-ContactName = 30
iodef-ContactTitle = 31
iodef-RegistryHandle = 32
iodef-PostalAddress = 33
iodef-Email = 34
iodef-Telephone = 35
iodef-Timezone = 36
iodef-handle = 37
iodef-registry = 38
iodef-ext-registry = 39
iodef-PAddress = 40
iodef-EmailTo = 41
iodef-TelephoneNumber = 42
iodef-source = 43
iodef-ext-source = 44
iodef-DetectionPattern = 45
iodef-DetectionConfiguration = 46
iodef-Application = 47
iodef-Reference = 48
iodef-AttackPattern = 49
iodef-Vulnerability = 50
iodef-Weakness = 51
iodef-SpecID = 52
iodef-ext-SpecID = 53
iodef-ContentID = 54
iodef-RawData = 55
iodef-Platform = 56
iodef-Scoring = 57
iodef-ReferenceName = 58
iodef-specIndex = 59
iodef-ID = 60
iodef-occurrence = 61
iodef-IncidentCategory = 62
iodef-Impact = 63
iodef-SystemImpact = 64
iodef-BusinessImpact = 65
iodef-TimeImpact = 66
iodef-MonetaryImpact = 67
iodef-IntendedImpact = 68
iodef-Counter = 69
iodef-MitigatingFactor = 70
iodef-Cause = 71
iodef-severity = 72
iodef-completion = 73
iodef-ext-severity = 74
iodef-metric = 75
iodef-ext-metric = 76
iodef-duration = 77
iodef-ext-duration = 78
iodef-currency = 79
iodef-rating = 80
iodef-ext-rating = 81
iodef-HistoryItem = 82
iodef-action = 83
iodef-ext-action = 84
iodef-DateTime = 85
iodef-DefinedCOA = 86
iodef-System = 87
iodef-Expectation = 88
iodef-RecordData = 89
iodef-category = 90
iodef-ext-category = 91
iodef-interface = 92
iodef-spoofed = 93
iodef-virtual = 94
iodef-ownership = 95
iodef-ext-ownership = 96
iodef-Node = 97
iodef-NodeRole = 98
iodef-Service = 99
iodef-OperatingSystem = 100
iodef-AssetID = 101
iodef-DomainData = 102
iodef-Address = 103
iodef-Location = 104
iodef-vlan-name = 105
iodef-vlan-num = 106
iodef-unit = 107
iodef-ext-unit = 108
iodef-system-status = 109
iodef-ext-system-status = 110
iodef-domain-status = 111
iodef-ext-domain-status = 112
iodef-Name = 113
iodef-DateDomainWasChecked = 114
iodef-RegistrationDate = 115
iodef-ExpirationDate = 116
iodef-RelatedDNS = 117
iodef-NameServers = 118
iodef-DomainContacts = 119
iodef-Server = 120
iodef-SameDomainContact = 121
iodef-ip-protocol = 122
iodef-ServiceName = 123
iodef-Port = 124
iodef-Portlist = 125
iodef-ProtoCode = 126
iodef-ProtoType = 127
iodef-ProtoField = 128
iodef-ApplicationHeaderField = 129
iodef-EmailData = 130
iodef-IANAService = 131
iodef-EmailFrom = 132
iodef-EmailSubject = 133
iodef-EmailX-Mailer = 134
iodef-EmailHeaderField = 135
iodef-EmailHeaders = 136
iodef-EmailBody = 137
iodef-EmailMessage = 138
iodef-HashData = 139
iodef-Signature = 140
iodef-RecordPattern = 141
iodef-RecordItem = 142
iodef-FileData = 143
iodef-WindowsRegistryKeysModified = 144
iodef-CertificateData = 145
iodef-offset = 146
iodef-offsetunit = 147
iodef-ext-offsetunit = 148
iodef-Key = 149
iodef-registryaction = 150
iodef-ext-registryaction = 151
iodef-KeyName = 152
iodef-KeyValue = 153
iodef-Certificate = 154
iodef-X509Data = 155
iodef-File = 156
iodef-FileName = 157
iodef-FileSize = 158
iodef-FileType = 159
iodef-AssociatedSoftware = 160
iodef-FileProperties = 161
iodef-scope = 162
iodef-HashTargetID = 163
iodef-Hash = 164
iodef-FuzzyHash = 165
iodef-DigestMethod = 166
iodef-DigestValue = 167
iodef-CanonicalizationMethod = 168
iodef-FuzzyHashValue = 169
iodef-AlternativeIndicatorID = 170
iodef-Observable = 171
iodef-uid-ref = 172
iodef-IndicatorExpression = 173
iodef-IndicatorReference = 174
iodef-AttackPhase = 175
iodef-BulkObservable = 176
iodef-BulkObservableFormat = 177
iodef-BulkObservableList = 178
iodef-operator = 179
iodef-ext-operator = 180
iodef-euid-ref = 181
iodef-AttackPhaseID = 182Now the rules themselves! ✨ This is where the tags get wired up into the actual structures, like the top-level iodef map and all the little helper types. It's giving blueprint 🧚
iodef = {
iodef-version => text,
? iodef-lang => lang,
? iodef-format-id => text
? iodef-private-enum-name => text,
? iodef-private-enum-id => text,
iodef-Incident => [+ Incident],
? iodef-AdditionalData => [+ ExtensionType]
}
duration = "second" / "minute" / "hour" / "day" / "month" /
"quarter" / "year" / "ext-value"
lang = "" / text .regexp "[a-zA-Z]{1,8}(-[a-zA-Z0-9]{1,8})*"
restriction = "public" / "partner" / "need-to-know" / "private" /
"default" / "white" / "green" / "amber" / "red" /
"ext-value"
SpecID = "urn:ietf:params:xml:ns:mile:mmdef:1.2" / "private"
IDtype = text .regexp "[a-zA-Z_][a-zA-Z0-9_.-]*"
IDREFType = IDtype
URLtype = uri
TimeZonetype = text .regexp "Z|[\\+\\-](0[0-9]|1[0-4]):[0-5][0-9]"
PortlistType = text .regexp
"[0-9]+(\\-[0-9]+)?(,[0-9]+(\\-[0-9]+)?)*"
action = "nothing" / "contact-source-site" / "contact-target-site" /
"contact-sender" / "investigate" / "block-host" /
"block-network" / "block-port" / "rate-limit-host" /
"rate-limit-network" / "rate-limit-port" / "redirect-traffic" /
"honeypot" / "upgrade-software" / "rebuild-asset" /
"harden-asset" / "remediate-other" / "status-triage" /
"status-new-info" / "watch-and-report" / "training" /
"defined-coa" / "other" / "ext-value"
DATETIME = tdate
BYTE = eb64legacy
MLStringType = {
iodef-value => text,
? iodef-lang => lang,
? iodef-translation-id => text
} / text
PositiveFloatType = float32 .gt 0
PAddressType = MLStringType
ExtensionType = {
iodef-value => text,
? iodef-name => text,
iodef-dtype => "boolean" / "byte" / "bytes" / "character" /
"date-time" / "ntpstamp" / "integer" / "portlist" / "real" /
"string" / "file" / "path" / "frame" / "packet" / "ipv4-packet" /
"json" / "ipv6-packet" / "url" / "csv" / "winreg" / "xml" /
"ext-value"
.default "string"
? iodef-ext-dtype => text,
? iodef-meaning => text,
? iodef-formatid => text,
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
}
SoftwareType = {
? iodef-SoftwareReference => SoftwareReference,
? iodef-URL => [+ URLtype],
? iodef-Description => [+ MLStringType]
}
SoftwareReference = {
? iodef-value => text,
iodef-spec-name => "custom" / "cpe" / "swid" / "ext-value",
? iodef-ext-spec-name => text,
? iodef-dtype => "bytes" / "integer" / "real" / "string" / "xml" /
"ext-value" .default "string",
? iodef-ext-dtype => text
}
Incident = {
iodef-purpose => "traceback" / "mitigation" / "reporting" /
"watch" / "other" / "ext-value",
? iodef-ext-purpose => text,
? iodef-status => "new" / "in-progress"/ "forwarded" / "resolved" /
"future" / "ext-value",
? iodef-ext-status => text,
? iodef-lang => lang,
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
iodef-IncidentID => IncidentID,
? iodef-AlternativeID => AlternativeID,
? iodef-RelatedActivity => [+ RelatedActivity],
? iodef-DetectTime => DATETIME,
? iodef-StartTime => DATETIME,
? iodef-EndTime => DATETIME,
? iodef-RecoveryTime => DATETIME,
? iodef-ReportTime => DATETIME,
iodef-GenerationTime => DATETIME,
? iodef-Description => [+ MLStringType],
? iodef-Discovery => [+ Discovery],
? iodef-Assessment => [+ Assessment],
? iodef-Method => [+ Method],
iodef-Contact => [+ Contact],
? iodef-EventData => [+ EventData],
? iodef-Indicator => [+ Indicator],
? iodef-History => History,
? iodef-AdditionalData => [+ ExtensionType]
}
IncidentID = {
iodef-id => text,
iodef-name => text,
? iodef-instance => text,
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text
}
AlternativeID = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
iodef-IncidentID => [+ IncidentID]
}
RelatedActivity = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-IncidentID => [+ IncidentID],
? iodef-URL => [+ URLtype],
? iodef-ThreatActor => [+ ThreatActor],
? iodef-Campaign => [+ Campaign],
? iodef-IndicatorID => [+ IndicatorID],
? iodef-Confidence => Confidence,
? iodef-Description => [+ text],
? iodef-AdditionalData => [+ ExtensionType]
}
ThreatActor = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-ThreatActorID => [+ text],
? iodef-URL => [+ URLtype],
? iodef-Description => [+ MLStringType],
? iodef-AdditionalData => [+ ExtensionType]
}
Campaign = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-CampaignID => [+ text],
? iodef-URL => [+ URLtype],
? iodef-Description => [+ MLStringType],
? iodef-AdditionalData => [+ ExtensionType]
}
Contact = {
iodef-role => "creator" / "reporter" / "admin" / "tech" /
"provider" / "user" / "billing" / "legal" / "irt" / "abuse" /
"cc" / "cc-irt" / "leo" / "vendor" / "vendor-support" /
"victim" / "victim-notified" / "ext-value",
? iodef-ext-role => text,
iodef-type => "person" / "organization" / "ext-value",
? iodef-ext-type => text,
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-ContactName => [+ MLStringType],
? iodef-ContactTitle => [+ MLStringType],
? iodef-Description => [+ MLStringType],
? iodef-RegistryHandle => [+ RegistryHandle],
? iodef-PostalAddress => [+ PostalAddress],
? iodef-Email => [+ Email],
? iodef-Telephone => [+ Telephone],
? iodef-Timezone => TimeZonetype,
? iodef-Contact => [+ Contact],
? iodef-AdditionalData => [+ ExtensionType]
}
RegistryHandle = {
iodef-handle => text,
iodef-registry => "internic" / "apnic" / "arin" / "lacnic" /
"ripe" / "afrinic" / "local" / "ext-value",
? iodef-ext-registry => text
}
PostalAddress = {
? iodef-type => "street" / "mailing" / "ext-value",
? iodef-ext-type => text,
iodef-PAddress => PAddressType,
? iodef-Description => [+ MLStringType]
}
Email = {
? iodef-type => "direct" / "hotline" / "ext-value",
? iodef-ext-type => text,
iodef-EmailTo => text,
? iodef-Description => [+ MLStringType]
}Okay, the CDDL is literally where the whole data model gets its vibe 🎀 so here's the rest, no cap ✨
Telephone = {
? iodef-type => "wired" / "mobile" / "fax" / "hotline" /
"ext-value",
? iodef-ext-type => text,
iodef-TelephoneNumber => text,
? iodef-Description => [+ MLStringType]
}
Discovery = {
? iodef-source => "nidps" / "hips" / "siem" / "av" /
"third-party-monitoring" / "incident" / "os-log" /
"application-log" / "device-log" / "network-flow" /
"passive-dns" / "investigation" / "audit" /
"internal-notification" / "external-notification" /
"leo" / "partner" / "actor" / "unknown" / "ext-value",
? iodef-ext-source => text,
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-Description => [+ MLStringType],
? iodef-Contact => [+ Contact],
? iodef-DetectionPattern => [+ DetectionPattern]
}
DetectionPattern = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
(iodef-Description => [+ MLStringType] //
iodef-DetectionConfiguration => [+ text]),
iodef-Application => SoftwareType
}
Method = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-Reference => [+ Reference],
? iodef-Description => [+ MLStringType],
? iodef-AttackPattern => [+ STRUCTUREDINFO],
? iodef-Vulnerability => [+ STRUCTUREDINFO],
? iodef-Weakness => [+ STRUCTUREDINFO],
? iodef-AdditionalData => [+ ExtensionType]
}
STRUCTUREDINFO = {
iodef-SpecID => SpecID,
? iodef-ext-SpecID => text,
? iodef-ContentID => text,
? (iodef-RawData => [+ BYTE] // iodef-Reference => [+ Reference]),
? iodef-Platform => [+ Platform],
? iodef-Scoring => [+ Scoring]
}
Platform = {
iodef-SpecID => SpecID,
? iodef-ext-SpecID => text,
? iodef-ContentID => text,
? iodef-RawData => [+ BYTE],
? iodef-Reference => [+ Reference]
}
Scoring = {
iodef-SpecID => SpecID,
? iodef-ext-SpecID => text,
? iodef-ContentID => text,
? iodef-RawData => [+ BYTE],
? iodef-Reference => [+ Reference]
}
Reference = {
? iodef-observable-id => IDtype,
? iodef-ReferenceName => ReferenceName,
? iodef-URL => [+ URLtype],
? iodef-Description => [+ MLStringType]
}
ReferenceName = {
iodef-specIndex => integer,
iodef-ID => IDtype
}
Assessment = {
? iodef-occurrence => "actual" / "potential",
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
? iodef-IncidentCategory => [+ MLStringType],
iodef-Impact => [+ {iodef-SystemImpact => SystemImpact} /
{iodef-BusinessImpact => BusinessImpact /
{iodef-TimeImpact => TimeImpact} /
{iodef-MonetaryImpact => MonetaryImpact} /
{iodef-IntendedImpact => BusinessImpact}],
? iodef-Counter => [+ Counter],
? iodef-MitigatingFactor => [+ MLStringType],
? iodef-Cause => [+ MLStringType],
? iodef-Confidence => Confidence,
? iodef-AdditionalData => [+ ExtensionType]
}
SystemImpact = {
? iodef-severity => "low" / "medium" / "high",
? iodef-completion => "failed" / "succeeded",
iodef-type => "takeover-account" / "takeover-service" /
"takeover-system" / "cps-manipulation" / "cps-damage" /
"availability-data" / "availability-account" /
"availability-service" / "availability-system" / "damaged-system" /
"damaged-data" / "breach-proprietary" / "breach-privacy" /
"breach-credential" / "breach-configuration" / "integrity-data" /
"integrity-configuration" / "integrity-hardware" /
"traffic-redirection" / "monitoring-traffic" / "monitoring-host" /
"policy" / "unknown" / "ext-value" .default "unknown",
? iodef-ext-type => text,
? iodef-Description => [+ MLStringType]
}
BusinessImpact = {
? iodef-severity => "none" / "low" / "medium" / "high" / "unknown" /
"ext-value" .default "unknown",
? iodef-ext-severity => text,
iodef-type => "breach-proprietary" / "breach-privacy" /
"breach-credential" / "loss-of-integrity" / "loss-of-service" /
"theft-financial" / "theft-service" / "degraded-reputation" /
"asset-damage" / "asset-manipulation" / "legal" / "extortion" /
"unknown" / "ext-value" .default "unknown",
? iodef-ext-type => text,
? iodef-Description => [+ MLStringType]
}
TimeImpact = {
iodef-value => PositiveFloatType,
? iodef-severity => "low" / "medium" / "high",
iodef-metric => "labor" / "elapsed" / "downtime" / "ext-value",
? iodef-ext-metric => text,
? iodef-duration => duration .default "hour",
? iodef-ext-duration => text
}
MonetaryImpact = {
iodef-value => PositiveFloatType,
? iodef-severity => "low" / "medium" / "high",
? iodef-currency => text
}
Confidence = {
iodef-value => float32,
iodef-rating => "low" / "medium" / "high" / "numeric" / "unknown" /
"ext-value",
? iodef-ext-rating => text
}
History = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
iodef-HistoryItem => [+ HistoryItem]
}
HistoryItem = {
iodef-action => action .default "other",
? iodef-ext-action => text,
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
iodef-DateTime => DATETIME,
? iodef-IncidentID => IncidentID,
? iodef-Contact => Contact,
? iodef-Description => [+ MLStringType],
? iodef-DefinedCOA => [+ text],
? iodef-AdditionalData => [+ ExtensionType]
}
EventData = {
? iodef-restriction => restriction .default "default",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
? iodef-Description => [+ MLStringType],
? iodef-DetectTime => DATETIME,
? iodef-StartTime => DATETIME,
? iodef-EndTime => DATETIME,
? iodef-RecoveryTime => DATETIME,
? iodef-ReportTime => DATETIME,
? iodef-Contact => [+ Contact],
? iodef-Discovery => [+ Discovery],
? iodef-Assessment => Assessment,
? iodef-Method => [+ Method],
? iodef-System => [+ System],
? iodef-Expectation => [+ Expectation],
? iodef-RecordData => [+ RecordData],
? iodef-EventData => [+ EventData],
? iodef-AdditionalData => [+ ExtensionType]
}
Expectation = {
? iodef-action => action .default "other",
? iodef-ext-action => text,
? iodef-severity => "low" / "medium" / "high",
? iodef-restriction => restriction .default "default",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
? iodef-Description => [+ MLStringType],
? iodef-DefinedCOA => [+ text],
? iodef-StartTime => DATETIME,
? iodef-EndTime => DATETIME,
? iodef-Contact => Contact
}
System = {
? iodef-category => "source" / "target" / "intermediate" /
"sensor" / "infrastructure" / "ext-value",
? iodef-ext-category => text,
? iodef-interface => text,
? iodef-spoofed => "unknown" / "yes" / "no" .default "unknown",
? iodef-virtual => "yes" / "no" / "unknown" .default "unknown",
? iodef-ownership => "organization" / "personal" / "partner" /
"customer" / "no-relationship" / "unknown" / "ext-value",
? iodef-ext-ownership => text,
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
iodef-Node => Node,
? iodef-NodeRole => [+ NodeRole],
? iodef-Service => [+ Service],
? iodef-OperatingSystem => [+ SoftwareType],
? iodef-Counter => [+ Counter],
? iodef-AssetID => [+ text],
? iodef-Description => [+ MLStringType],
? iodef-AdditionalData => [+ ExtensionType]
}
Node = {
(iodef-DomainData => [+ DomainData] //
iodef-Address => [+ Address]),
? iodef-PostalAddress => PostalAddress,
? iodef-Location => [+ MLStringType],
? iodef-Counter => [+ Counter]
}
Address = {
iodef-value => text,
iodef-category => "asn" / "atm" / "e-mail" / "ipv4-addr" /
"ipv4-net" / "ipv4-net-masked" / "ipv4-net-mask" / "ipv6-addr" /
"ipv6-net" / "ipv6-net-masked" / "mac" / "site-uri" /
"ext-value" .default "ipv6-addr",
? iodef-ext-category => text,
? iodef-vlan-name => text,
? iodef-vlan-num => integer,
? iodef-observable-id => IDtype
}
NodeRole = {
iodef-category => "client" / "client-enterprise" /
"client-partner" / "client-remote" / "client-kiosk" /
"client-mobile" / "server-internal" / "server-public" /
"www" / "mail" / "webmail" / "messaging" / "streaming" /
"voice" / "file" / "ftp" / "p2p" / "name" / "directory" /
"credential" / "print" / "application" / "database" /
"backup" / "dhcp" / "assessment" / "source-control" /
"config-management" / "monitoring" / "infra" / "infra-firewall" /
"infra-router" / "infra-switch" / "camera" / "proxy" /
"remote-access" / "log" / "virtualization" / "pos" / "scada" /
"scada-supervisory" / "sinkhole" / "honeypot" /
"anomyzation" / "c2-server" / "malware-distribution" /
"drop-server" / "hop-point" / "reflector" /
"phishing-site" / "spear-phishing-site" / "recruiting-site" /
"fraudulent-site" / "ext-value",
? iodef-ext-category => text,
? iodef-Description => [+ MLStringType]
}
Counter = {
iodef-value => float32,
iodef-type => "count" / "peak" / "average" / "ext-value",
? iodef-ext-type => text,
iodef-unit => "byte" / "mbit" / "packet" / "flow" / "session" /
"alert" / "message" / "event" / "host" / "site" / "organization" /
"ext-value",
? iodef-ext-unit => text,
? iodef-meaning => text,
? iodef-duration => duration .default "hour",
? iodef-ext-duration => text
}
DomainData = {
iodef-system-status => "spoofed" / "fraudulent" /
"innocent-hacked" / "innocent-hijacked" / "unknown" / "ext-value",
? iodef-ext-system-status => text,
iodef-domain-status => "reservedDelegation" / "assignedAndActive" /
"assignedAndInactive" / "assignedAndOnHold" /
"revoked" / "transferPending" / "registryLock" /
"registrarLock" / "other" / "unknown" / "ext-value",
? iodef-ext-domain-status => text,
? iodef-observable-id => IDtype,
iodef-Name => text,
? iodef-DateDomainWasChecked => DATETIME,
? iodef-RegistrationDate => DATETIME,
? iodef-ExpirationDate => DATETIME,
? iodef-RelatedDNS => [+ ExtensionType],
? iodef-NameServers => [+ NameServers],
? iodef-DomainContacts => DomainContacts
}
NameServers = {
iodef-Server => text,
iodef-Address => [+ Address]
}
DomainContacts = {
(iodef-SameDomainContact => text // iodef-Contact => [+ Contact])
}
Service = {
? iodef-ip-protocol => integer,
? iodef-observable-id => IDtype,
? iodef-ServiceName => ServiceName,
? iodef-Port => integer,
? iodef-Portlist => PortlistType,
? iodef-ProtoCode => integer,
? iodef-ProtoType => integer,
? iodef-ProtoField => integer,
? iodef-ApplicationHeaderField => [+ ExtensionType],
? iodef-EmailData => EmailData,
? iodef-Application => SoftwareType
}
ServiceName = {
? iodef-IANAService => text,
? iodef-URL => [+ URLtype],
? iodef-Description => [+ MLStringType]
}
EmailData = {
? iodef-observable-id => IDtype,
? iodef-EmailTo => [+ text],
? iodef-EmailFrom => text,
? iodef-EmailSubject => text,
? iodef-EmailX-Mailer => text,
? iodef-EmailHeaderField => [+ ExtensionType],
? iodef-EmailHeaders => text,
? iodef-EmailBody => text,
? iodef-EmailMessage => text,
? iodef-HashData => [+ HashData],
? iodef-Signature => [+ BYTE]
}The CDDL bit is still going, bestie 💅
RecordData = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
? iodef-DateTime => DATETIME,
? iodef-Description => [+ MLStringType],
? iodef-Application => SoftwareType,
? iodef-RecordPattern => [+ RecordPattern],
? iodef-RecordItem => [+ ExtensionType],
? iodef-URL => [+ URLtype],
? iodef-FileData => [+ FileData],
? iodef-WindowsRegistryKeysModified =>
[+ WindowsRegistryKeysModified],
? iodef-CertificateData => [+ CertificateData],
? iodef-AdditionalData => [+ ExtensionType]
}
RecordPattern = {
iodef-value => text,
iodef-type => "regex" / "binary" / "xpath" /
"ext-value" .default "regex",
? iodef-ext-type => text,
? iodef-offset => integer,
? iodef-offsetunit => "line" / "byte" /
"ext-value" .default "line",
? iodef-ext-offsetunit => text,
? iodef-instance => integer
}
WindowsRegistryKeysModified = {
? iodef-observable-id => IDtype,
iodef-Key => [+ Key]
}
Key = {
? iodef-registryaction => "add-key" / "add-value" / "delete-key" /
"delete-value" / "modify-key" / "modify-value" /
"ext-value",
? iodef-ext-registryaction => text,
? iodef-observable-id => IDtype,
iodef-KeyName => text,
? iodef-KeyValue => text
}
CertificateData = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
iodef-Certificate => [+ Certificate]
}
Certificate = {
? iodef-observable-id => IDtype,
iodef-X509Data => BYTE,
? iodef-Description => [+ MLStringType]
}
FileData = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? iodef-observable-id => IDtype,
iodef-File => [+ File]
}
File = {
? iodef-observable-id => IDtype,
? iodef-FileName => text,
? iodef-FileSize => integer,
? iodef-FileType => text,
? iodef-URL => [+ URLtype],
? iodef-HashData => HashData,
? iodef-Signature => [+ BYTE],
? iodef-AssociatedSoftware => SoftwareType,
? iodef-FileProperties => [+ ExtensionType]
}
HashData = {
iodef-scope => "file-contents" / "file-pe-section" /
"file-pe-iat" / "file-pe-resource" / "file-pdf-object" /
"email-hash" / "email-headers-hash" / "email-body-hash" /
"ext-value",
? iodef-HashTargetID => text,
? iodef-Hash => [+ Hash],
? iodef-FuzzyHash => [+ FuzzyHash]
}
Hash = {
iodef-DigestMethod => BYTE,
iodef-DigestValue => BYTE,
? iodef-CanonicalizationMethod => BYTE,
? iodef-Application => SoftwareType
}
FuzzyHash = {
iodef-FuzzyHashValue => [+ ExtensionType],
? iodef-Application => SoftwareType,
? iodef-AdditionalData => [+ ExtensionType]
}
Indicator = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
iodef-IndicatorID => IndicatorID,
? iodef-AlternativeIndicatorID => [+ AlternativeIndicatorID],
? iodef-Description => [+ MLStringType],
? iodef-StartTime => DATETIME,
? iodef-EndTime => DATETIME,
? iodef-Confidence => Confidence,
? iodef-Contact => [+ Contact],
(iodef-Observable => Observable // iodef-uid-ref => IDREFType //
iodef-IndicatorExpression => IndicatorExpression //
iodef-IndicatorReference => IndicatorReference),
? iodef-NodeRole => [+ NodeRole],
? iodef-AttackPhase => [+ AttackPhase],
? iodef-Reference => [+ Reference],
? iodef-AdditionalData => [+ ExtensionType]
}
IndicatorID = {
iodef-id => IDtype,
iodef-name => text,
iodef-version => text
}
AlternativeIndicatorID = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
iodef-IndicatorID => [+ IndicatorID]
}
Observable = {
? iodef-restriction => restriction .default "private",
? iodef-ext-restriction => text,
? (iodef-System => System // iodef-Address => Address //
iodef-DomainData => DomainData //
iodef-EmailData => EmailData //
iodef-Service => Service //
iodef-WindowsRegistryKeysModified =>
WindowsRegistryKeysModified //
iodef-FileData => FileData //iodef-CertificateData =>
CertificateData //
iodef-RegistryHandle =>RegistryHandle// iodef-RecordData =>
RecordData //
iodef-EventData => EventData // iodef-Incident => Incident //
iodef-Expectation => Expectation // iodef-Reference =>
Reference //
iodef-Assessment => Assessment //
iodef-DetectionPattern => DetectionPattern //
iodef-HistoryItem => HistoryItem //
iodef-BulkObservable => BulkObservable //
iodef-AdditionalData => [+ ExtensionType])
}
BulkObservable = {
? iodef-type => "asn" / "atm" / "e-mail" / "ipv4-addr" /
"ipv4-net" / "ipv4-net-mask" / "ipv6-addr" / "ipv6-net" /
"ipv6-net-mask" / "mac" / "site-uri" / "domain-name" /
"domain-to-ipv4" / "domain-to-ipv6" /
"domain-to-ipv4-timestamp" / "domain-to-ipv6-timestamp" /
"ipv4-port" / "ipv6-port" / "windows-reg-key" / "file-hash" /
"email-x-mailer" / "email-subject" / "http-user-agent" /
"http-request-uri" / "mutex" / "file-path" / "user-name" /
"ext-value",
? iodef-ext-type => text,
? iodef-BulkObservableFormat => BulkObservableFormat,
iodef-BulkObservableList => text,
? iodef-AdditionalData => [+ ExtensionType]
}
BulkObservableFormat = {
(iodef-Hash => Hash // iodef-AdditionalData => [+ ExtensionType])
}
IndicatorExpression = {
? iodef-operator => "not" / "and" / "or" / "xor" .default "and",
? iodef-ext-operator => text,
? iodef-IndicatorExpression => [+ IndicatorExpression],
? iodef-Observable => [+ Observable],
? iodef-uid-ref => [+ IDREFType],
? iodef-IndicatorReference => [+ IndicatorReference],
? iodef-Confidence => Confidence,
? iodef-AdditionalData => [+ ExtensionType]
}
IndicatorReference = {
(iodef-uid-ref => IDREFType // iodef-euid-ref => text),
? iodef-version => text
}
AttackPhase = {
? iodef-AttackPhaseID => [+ text],
? iodef-URL => [+ URLtype],
? iodef-Description => [+ MLStringType],
? iodef-AdditionalData => [+ ExtensionType]
}Figure 5: Data Model in CDDL
7. IANA Considerations 🎀
Good news, bestie: this document has no IANA actions, so there's nothing to register and zero drama. 🧚
8. Security Considerations 💀
Okay, this part is SERIOUS 😭 This document gives a mapping from XML IODEF (defined in [RFC7970]) to JSON, and Section 3.2 describes several issues that show up when you convert between XML IODEF and JSON IODEF. Other than the one described in [RFC7970], there aren't any further security considerations here, but implementers of this document should be aware of those issues so nothing unintended happens. Be careful out there, babes 🫶
9. References 📚
9.1. Normative References
These are the must-read ones 📖
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
Resource Identifier (URI): Generic Syntax", STD 66,
RFC 3986, DOI 10.17487/RFC3986, January 2005,
<https://www.rfc-editor.org/info/rfc3986>.
[RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data
Encodings", RFC 4648, DOI 10.17487/RFC4648, October 2006,
<https://www.rfc-editor.org/info/rfc4648>.
[RFC7049] Bormann, C. and P. Hoffman, "Concise Binary Object
Representation (CBOR)", RFC 7049, DOI 10.17487/RFC7049,
October 2013, <https://www.rfc-editor.org/info/rfc7049>.
[RFC7203] Takahashi, T., Landfield, K., and Y. Kadobayashi, "An
Incident Object Description Exchange Format (IODEF)
Extension for Structured Cybersecurity Information",
RFC 7203, DOI 10.17487/RFC7203, April 2014,
<https://www.rfc-editor.org/info/rfc7203>.
[RFC7970] Danyliw, R., "The Incident Object Description Exchange
Format Version 2", RFC 7970, DOI 10.17487/RFC7970,
November 2016, <https://www.rfc-editor.org/info/rfc7970>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8259] Bray, T., Ed., "The JavaScript Object Notation (JSON) Data
Interchange Format", STD 90, RFC 8259,
DOI 10.17487/RFC8259, December 2017,
<https://www.rfc-editor.org/info/rfc8259>.
[RFC8610] Birkholz, H., Vigano, C., and C. Bormann, "Concise Data
Definition Language (CDDL): A Notational Convention to
Express Concise Binary Object Representation (CBOR) and
JSON Data Structures", RFC 8610, DOI 10.17487/RFC8610,
June 2019, <https://www.rfc-editor.org/info/rfc8610>.9.2. Informative References
Extra credit reading 🤓
[JSON-SCHEMA]
Wright, A., Andrews, H., and B. Hutton, "JSON Schema
Validation: A Vocabulary for Structural Validation of
JSON", Work in Progress, Internet-Draft, draft-handrews-
json-schema-validation-02, 17 September 2019,
<https://tools.ietf.org/html/draft-handrews-json-schema-
validation-02>.Appendix A. Data Types Used in This Document 🌈
Here's how the CDDL prelude types map over to JSON, bestie 💖
+==============+=========+==========+=============================+
| CDDL Prelude | Use of | Instance | Validation |
| | JSON | | |
+==============+=========+==========+=============================+
| bytes | n/a | string | tool available |
+--------------+---------+----------+-----------------------------+
| text | string | string | unnecessary |
+--------------+---------+----------+-----------------------------+
| tdate | n/a | string | date-time per Section 7.3.1 |
| | | | of [JSON-SCHEMA] |
+--------------+---------+----------+-----------------------------+
| integer | n/a | number | integer |
+--------------+---------+----------+-----------------------------+
| eb64legacy | n/a | string | tool available |
+--------------+---------+----------+-----------------------------+
| uri | n/a | string | uri per Section 7.3.6 of |
| | | | [JSON-SCHEMA] |
+--------------+---------+----------+-----------------------------+
| float32 | float32 | number | unnecessary |
+--------------+---------+----------+-----------------------------+Table 5: CDDL Prelude Mapping in JSON
Appendix B. The IODEF Data Model (JSON Schema) 🦋
This section gives you a JSON schema [JSON-SCHEMA] that defines the IODEF data model from this document. Heads up: this section is informative. 🌸
okay the schema keeps going and it's giving pure structure 💅✨
{ "$schema": "https://json-schema.org/draft-04/schema#",
"definitions": {
"action": {"enum": ["nothing", "contact-source-site",
"contact-target-site", "contact-sender", "investigate",
"block-host", "block-network", "block-port",
"rate-limit-host", "rate-limit-network",
"rate-limit-port", "redirect-traffic", "honeypot",
"upgrade-software", "rebuild-asset", "harden-asset",
"remediate-other", "status-triage", "status-new-info",
"watch-and-report", "training", "defined-coa", "other",
"ext-value"]},
"duration":{"enum":["second", "minute", "hour", "day",
"month", "quarter", "year", "ext-value"]},
"SpecID":{
"enum":["urn:ietf:params:xml:ns:mile:mmdef:1.2",
"private"]},
"lang": {
"type":"string", "pattern":
"^$|[a-zA-Z]{1,8}(-[a-zA-Z0-9]{1,8})*"},
"purpose": {"enum": ["traceback", "mitigation",
"reporting", "watch", "other", "ext-value"]},
"restriction":{"enum": ["public", "partner",
"need-to-know", "private", "default", "white", "green",
"amber", "red", "ext-value"]},
"status": {"enum": ["new", "in-progress", "forwarded",
"resolved", "future", "ext-value"]},
"DATETIME": {"type": "string", "format": "date-time"},
"BYTE": {"type": "string"},
"PortlistType": {
"type": "string", "pattern":
"[0-9]+(\\-[0-9]+)?(,[0-9]+(\\-[0-9]+)?)*"},
"TimeZonetype": {
"type":"string", "pattern":
"Z|[\\+\\-](0[0-9]|1[0-4]):[0-5][0-9]"},
"URLtype": {
"type": "string",
"pattern":
"^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))
?(#(.*))?"},
"IDtype": {"type": "string", "pattern":
"[a-zA-Z_][a-zA-Z0-9_.-]*"},
"IDREFType": {"$ref": "#/definitions/IDtype"},
"MLStringType": {
"oneOf": [{"type": "string"},
{"type": "object",
"properties": {
"value": {"type": "string"},
"lang": {"$ref": "#/definitions/lang"},
"translation-id": {"type": "string"}},
"required": ["value"],
"additionalProperties":false}]},
"PositiveFloatType": {"type": "number", "minimum": 0},
"PAddressType": {"$ref": "#/definitions/MLStringType"},
"ExtensionType": {
"type": "object",
"properties": {
"value": {"type": "string"},
"name": {"type": "string"},
"dtype":{"enum":["boolean", "byte", "bytes",
"character", "json", "date-time", "ntpstamp",
"integer", "portlist", "real", "string", "file",
"path", "frame", "packet", "ipv4-packet",
"ipv6-packet", "url", "csv", "winreg",
"xml", "ext-value"], "default": "string"},
"ext-dtype": {"type": "string"},
"meaning": {"type": "string"},
"formatid": {"type": "string"},
"restriction": {
"$ref": "#/definitions/restriction", "default":
"private"},
"ext-restriction": {"type": "string"},
"observable-id": {"$ref": "#/definitions/IDtype"}},
"required": ["value", "dtype"],
"additionalProperties":false},
"ExtensionTypeList": {
"type": "array",
"items": {"$ref": "#/definitions/ExtensionType"},
"minItems": 1},
"SoftwareType": {
"type": "object",
"properties": {
"SoftwareReference":{
"$ref":"#/definitions/SoftwareReference"},
"URL": {
"type": "array",
"items": {"$ref": "#/definitions/URLtype",
"minItems": 1}},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1 }},
"required": [],
"additionalProperties": false},
"SoftwareReference": {
"type": "object",
"properties": {
"value": {"type": "string"},
"spec-name": {"enum": ["custom", "cpe", "swid",
"ext-value"]},
"ext-spec-name": {"type": "string"},
"dtype": {"enum": ["bytes", "integer", "real", "string",
"xml", "ext-value"], "default": "string"},
"ext-dtype": {"type": "string"}},
"required": ["spec-name"],
"additionalProperties": false},
"STRUCTUREDINFO": {
"type": "object",
"properties": {
"SpecID": {"$ref":"#/definitions/SpecID"},
"ext-SpecID": {"type": "string"},
"ContentID": {"type": "string"},
"RawData": {
"type": "array",
"items": {"$ref":"#/definitions/BYTE"},
"minItems": 1
},
"Reference": {
"type": "array",
"items": {"$ref": "#/definitions/Reference"},
"minItems": 1
},
"Platform": {
"type": "array",
"items": {"$ref": "#/definitions/Platform"},
"minItems": 1
},
"Scoring": {
"type": "array",
"items": {"$ref": "#/definitions/Scoring"},
"minItems": 1}},
"allOf": [
{"required": ["SpecID"]},
{"anyOf": [
{"oneOf": [
{"required":["Reference"]},
{"required":["RawData"]}]},
{ "not" : {"required":["Reference", "RawData"]}}]}],
"additionalProperties": false},
"Platform": {
"type": "object",
"properties": {
"SpecID": {"$ref":"#/definitions/SpecID"},
"ext-SpecID": {"type": "string"},
"ContentID": {"type": "string"},
"RawData": {
"type": "array",
"items": {"$ref":"#/definitions/BYTE"},
"minItems": 1
},
"Reference": {
"type": "array",
"items": {"$ref": "#/definitions/Reference"},
"minItems": 1}},
"required": ["SpecID"],
"additionalProperties": false},
"Scoring": {
"type": "object",
"properties": {
"SpecID": {"$ref":"#/definitions/SpecID"},
"ext-SpecID": {"type": "string"},
"ContentID": {"type": "string"},
"RawData": {
"type": "array",
"items": {"$ref":"#/definitions/BYTE"},
"minItems": 1
},
"Reference": {
"type": "array",
"items": {"$ref": "#/definitions/Reference"},
"minItems": 1}},
"required": ["SpecID"],
"additionalProperties": false},
"Incident": {
"title": "Incident",
"description": "JSON schema for Incident class",
"type": "object",
"properties": {
"purpose": {"$ref": "#/definitions/purpose"},
"ext-purpose": {"type": "string"},
"status": {"$ref": "#/definitions/status"},
"ext-status": {"type": "string"},
"lang": {"$ref": "#/definitions/lang"},
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"observable-id": {"$ref": "#/definitions/IDtype"},
"IncidentID": {"$ref": "#/definitions/IncidentID"},
"AlternativeID": {
"$ref":"#/definitions/AlternativeID"},
"RelatedActivity": {
"type": "array",
"items": {"$ref": "#/definitions/RelatedActivity"},
"minItems": 1},
"DetectTime": {"$ref": "#/definitions/DATETIME"},
"StartTime": {"$ref": "#/definitions/DATETIME"},
"EndTime": {"$ref": "#/definitions/DATETIME"},
"RecoveryTime": {"$ref": "#/definitions/DATETIME"},
"ReportTime": {"$ref": "#/definitions/DATETIME"},
"GenerationTime": {"$ref": "#/definitions/DATETIME"},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"Discovery": {
"type": "array",
"items": {"$ref": "#/definitions/Discovery"},
"minItems": 1},
"Assessment": {
"type": "array",
"items": {"$ref": "#/definitions/Assessment"},
"minItems": 1},
"Method": {
"type": "array",
"items": {"$ref": "#/definitions/Method"},
"minItems": 1},
"Contact": {
"type": "array",
"items": {"$ref": "#/definitions/Contact"},
"minItems": 1},
"EventData": {
"type": "array",
"items": {"$ref": "#/definitions/EventData"},
"minItems": 1},
"Indicator": {
"type": "array",
"items": {"$ref": "#/definitions/Indicator"},
"minItems": 1},
"History": {"$ref": "#/definitions/History"},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"required": ["IncidentID", "GenerationTime", "Contact",
"purpose"],
"additionalProperties": false},
"IncidentID": {
"title": "IncidentID",
"description": "JSON schema for IncidentID class",
"type": "object",
"properties": {
"id": {"type": "string"},
"name": {"type": "string"},
"instance": {"type": "string"},
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"}},
"required": ["id", "name"],
"additionalProperties": false},
"AlternativeID": {
"title": "AlternativeID",
"description": "JSON schema for AlternativeID class",
"type": "object",
"properties": {
"IncidentID": {
"type": "array",
"items":{"$ref": "#/definitions/IncidentID"},
"minItems": 1},
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"}},
"required": ["IncidentID"],
"additionalProperties": false},
"RelatedActivity": {
"properties": {
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"IncidentID": {
"type": "array",
"items": {"$ref": "#/definitions/IncidentID"},
"minItems": 1},
"URL": {
"type": "array",
"items": {"$ref": "#/definitions/URLtype"},
"minItems": 1},
"ThreatActor": {
"type": "array",
"items": {"$ref": "#/definitions/ThreatActor"},
"minItems": 1},
"Campaign": {
"type": "array",
"items": {"$ref": "#/definitions/Campaign"},
"minItems": 1},
"IndicatorID": {
"type": "array",
"items": {"$ref": "#/definitions/IndicatorID"},
"minItems": 1},
"Confidence": {"$ref": "#/definitions/Confidence"},
"Description": {
"type": "array",
"items": {"type": "string"},
"minItems": 1},
"AdditionalData": {
"$ref": "#/definitions/ExtensionTypeList"}},
"additionalProperties": false},
"ThreatActor": {
"properties": {
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},Okay, the Appendix B schema is picking up right where we left off, so here's the next chunk 🎀💅
"ext-restriction": {"type": "string"},
"ThreatActorID": {
"type": "array",
"items": {"type": "string"},
"minItems": 1},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"URL": {
"type":"array",
"items":{"$ref":"#/definitions/URLtype"},
"minItems": 1},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"additionalProperties": false},
"Campaign": {
"properties": {
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"CampaignID": {
"type": "array",
"items": {"type": "string"},
"minItems": 1},
"URL": {
"type":"array",
"items":{"$ref":"#/definitions/URLtype"},
"minItems": 1},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}}},
"Contact": {
"type": "object",
"properties": {
"role": {
"enum":["creator", "reporter", "admin", "tech",
"provider", "user", "billing", "legal",
"irt", "abuse", "cc", "cc-irt", "leo",
"vendor", "vendor-support", "victim",
"victim-notified", "ext-value"]},
"ext-role": {"type": "string"},
"type": {
"enum": ["person", "organization", "ext-value"]},
"ext-type": {"type": "string"},
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"ContactName": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"ContactTitle": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"RegistryHandle": {
"type":"array",
"items":{"$ref":"#/definitions/RegistryHandle"},
"minItems": 1},
"PostalAddress": {
"type":"array",
"items":{"$ref":"#/definitions/PostalAddress"},
"minItems": 1},
"Email": {
"type": "array",
"items": {"$ref": "#/definitions/Email"},
"minItems": 1},
"Telephone": {
"type": "array",
"items": {"$ref": "#/definitions/Telephone"},
"minItems": 1},
"Timezone": {"$ref": "#/definitions/TimeZonetype"},
"Contact": {
"type": "array",
"items": {"$ref": "#/definitions/Contact"},
"minItems": 1},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"required": ["role", "type"],
"additionalProperties": false},
"RegistryHandle": {
"type": "object",
"properties": {
"handle": {"type": "string"},
"registry": {
"enum": ["internic", "apnic", "arin", "lacnic",
"ripe", "afrinic", "local", "ext-value"]},
"ext-registry": {"type": "string"}},
"required": ["handle", "registry"],
"additionalProperties": false},
"PostalAddress": {
"type": "object",
"properties": {
"type": {
"enum": ["street", "mailing", "ext-value"]},
"ext-type": {"type": "string"},
"PAddress": {"$ref": "#/definitions/PAddressType"},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1}},
"required": ["PAddress"],
"additionalProperties": false},
"Email": {
"type": "object",
"properties": {
"type": {
"enum":["direct", "hotline", "ext-value"]},
"ext-type": {"type": "string"},
"EmailTo": {"type": "string"},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1}},
"required": ["EmailTo"],
"additionalProperties": false},
"Telephone": {
"type": "object",
"properties": {
"type": {
"enum":["wired", "mobile", "fax", "hotline",
"ext-value"]},
"ext-type": {"type": "string"},
"TelephoneNumber": {"type": "string"},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1}},
"required": ["TelephoneNumber"],
"additionalProperties": false},
"Discovery": {
"type": "object",
"properties": {
"source": {
"enum":["nidps", "hips", "siem", "av",
"third-party-monitoring", "incident", "os-log",
"application-log", "device-log", "network-flow",
"passive-dns", "investigation", "audit",
"internal-notification", "external-notification",
"leo", "partner", "actor", "unknown", "ext-value"]},
"ext-source": {"type": "string"},
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"Contact": {
"type": "array",
"items": {"$ref": "#/definitions/Contact"},
"minItems": 1},
"DetectionPattern": {
"type":"array",
"items":{"$ref":"#/definitions/DetectionPattern"},
"minItems": 1}},
"required": [],
"additionalProperties": false},
"DetectionPattern": {
"type": "object",
"properties": {
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"observable-id": {"$ref": "#/definitions/IDtype"},
"Application": {"$ref": "#/definitions/SoftwareType"},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"DetectionConfiguration": {
"type": "array",
"items": {"type": "string"},
"minItems": 1}},
"allOf": [
{"required": ["Application"]},
{"oneOf": [
{"required":["Description"]},
{"required":["DetectionConfiguration"]}]}],
"additionalProperties": false},
"Method": {
"type": "object",
"properties": {
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"Reference": {
"type": "array",
"items": {"$ref": "#/definitions/Reference"},
"minItems": 1},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"AttackPattern": {
"type":"array",
"items":{"$ref":"#/definitions/STRUCTUREDINFO"},
"minItems": 1},
"Vulnerability": {
"type":"array",
"items":{"$ref":"#/definitions/STRUCTUREDINFO"},
"minItems": 1},
"Weakness": {
"type":"array",
"items":{"$ref":"#/definitions/STRUCTUREDINFO"},
"minItems": 1},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"required": [],
"additionalProperties": false},
"Reference": {
"type": "object",
"properties": {
"observable-id": {"$ref": "#/definitions/IDtype"},
"ReferenceName": {
"$ref":"#/definitions/ReferenceName"},
"URL":{
"type":"array",
"items":{"$ref":"#/definitions/URLtype"},
"minItems": 1},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1}},
"required": [],
"additionalProperties": false},
"ReferenceName" : {
"type": "object",
"properties": {
"specIndex": {"type": "number"},
"ID": {"$ref":"#/definitions/IDtype"}},
"required": ["specIndex", "ID"],
"additionalProperties": false},
"Assessment": {
"type": "object",
"properties": {
"occurrence": {"enum":["actual", "potential"]},
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"observable-id": {"$ref": "#/definitions/IDtype"},
"IncidentCategory": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"Impact": {
"type": "array",
"items": {
"properties": {
"SystemImpact":{
"$ref":"#/definitions/SystemImpact"},
"BusinessImpact":{
"$ref":"#/definitions/BusinessImpact"},
"TimeImpact":{"$ref":"#/definitions/TimeImpact"},
"MonetaryImpact":{
"$ref":"#/definitions/MonetaryImpact"},
"IntendedImpact":{
"$ref":"#/definitions/BusinessImpact"}},
"additionalProperties":false},
"minItems" : 1
},
"Counter": {
"type": "array",
"items": {"$ref": "#/definitions/Counter"},
"minItems": 1},
"MitigatingFactor": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"Cause": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"Confidence": {"$ref": "#/definitions/Confidence"},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"required": ["Impact"],
"additionalProperties": false},
"SystemImpact": {
"type": "object",
"properties": {
"severity": {"enum":["low", "medium", "high"]},
"completion": {"enum":["failed", "succeeded"]},
"type": {
"enum":["takeover-account", "takeover-service",
"takeover-system", "cps-manipulation", "cps-damage",
"availability-data", "availability-account",
"availability-service", "availability-system",
"damaged-system", "damaged-data",
"breach-proprietary", "breach-privacy",
"breach-credential", "breach-configuration",
"integrity-data", "integrity-configuration",
"integrity-hardware", "traffic-redirection",
"monitoring-traffic", "monitoring-host",
"policy", "unknown", "ext-value"]},"ext-type": {"type": "string"}, "Description": { "type": "array", "items": {"$ref": "#/definitions/MLStringType"}, "minItems": 1}}, "required": ["type"], "additionalProperties": false}, "BusinessImpact": { "type": "object", "properties": { "severity": {"enum":["none", "low", "medium", "high", "unknown", "ext-value"], "default": "unknown"}, "ext-severity": {"type":"string"}, "type": {"enum":["breach-proprietary", "breach-privacy", "breach-credential", "loss-of-integrity", "loss-of-service", "theft-financial", "theft-service", "degraded-reputation", "asset-damage", "asset-manipulation", "legal", "extortion", "unknown", "ext-value"]}, "ext-type": {"type": "string"}, "Description": { "type": "array", "items": {"$ref": "#/definitions/MLStringType"}, "minItems": 1}}, "required": ["type"], "additionalProperties": false}, "TimeImpact": { "type": "object", "properties": { "value": {"$ref": "#/definitions/PositiveFloatType"}, "severity": {"enum": ["low", "medium", "high"]}, "metric": {"enum": ["labor", "elapsed", "downtime", "ext-value"]}, "ext-metric": {"type": "string"}, "duration": { "$ref":"#/definitions/duration", "default": "hour"}, "ext-duration": {"type": "string"}}, "required": ["value", "metric"], "additionalProperties": false}, "MonetaryImpact": { "type": "object", "properties": { "value": {"$ref": "#/definitions/PositiveFloatType"}, "severity": {"enum":["low", "medium", "high"]}, "currency": {"type": "string"}}, "required": ["value"], "additionalProperties": false}, "Confidence": { "type": "object", "properties": { "value": {"type": "number"}, "rating": {"enum": ["low", "medium", "high", "numeric", "unknown", "ext-value"]}, "ext-rating": {"type":"string"}}, "required": ["value", "rating"], "additionalProperties": false}, "History": { "type": "object", "properties": { "restriction": {"$ref": "#/definitions/restriction", "default": "private"}, "ext-restriction": {"type": "string"}, "HistoryItem": { "type": "array", "items": {"$ref": "#/definitions/HistoryItem"}, "minItems": 1}}, "required": ["HistoryItem"], "additionalProperties": false}, "HistoryItem": { "type": "object", "properties": { "action": { "$ref": "#/definitions/action", "default": "other"}, "ext-action": {"type": "string"}, "restriction": {"$ref": "#/definitions/restriction", "default": "private"}, "ext-restriction": {"type": "string"}, "observable-id": {"$ref": "#/definitions/IDtype"}, "DateTime": {"$ref": "#/definitions/DATETIME"}, "IncidentID": {"$ref": "#/definitions/IncidentID"}, "Contact": {"$ref": "#/definitions/Contact"}, "Description": { "type": "array", "items": {"$ref": "#/definitions/MLStringType"}, "minItems": 1}, "DefinedCOA": { "type": "array", "items": {"type": "string"}, "minItems": 1}, "AdditionalData": { "$ref":"#/definitions/ExtensionTypeList"}}, "required": ["DateTime", "action"], "additionalProperties": false}, "EventData": { "type": "object", "properties": { "restriction": {"$ref": "#/definitions/restriction", "default": "private"}, "ext-restriction": {"type": "string"}, "observable-id": {"$ref": "#/definitions/IDtype"}, "Description": {"type": "array", "items": { "$ref":"#/definitions/MLStringType"}}, "DetectTime": {"$ref": "#/definitions/DATETIME"}, "StartTime": {"$ref": "#/definitions/DATETIME"}, "EndTime": {"$ref": "#/definitions/DATETIME"}, "RecoveryTime": {"$ref": "#/definitions/DATETIME"}, "ReportTime": {"$ref": "#/definitions/DATETIME"}, "Contact": { "type": "array", "items": {"$ref": "#/definitions/Contact"}, "minItems": 1}, "Discovery": { "type": "array", "items": {"$ref": "#/definitions/Discovery"}, "minItems": 1}, "Assessment": {"$ref": "#/definitions/Assessment"}, "Method": { "type": "array", "items": {"$ref": "#/definitions/Method"}, "minItems": 1}, "System": { "type": "array", "items": {"$ref": "#/definitions/System"}, "minItems": 1}, "Expectation": { "type": "array", "items": {"$ref": "#/definitions/Expectation"}, "minItems": 1}, "RecordData": { "type": "array", "items": {"$ref": "#/definitions/RecordData"}, "minItems": 1}, "EventData": { "type": "array", "items": {"$ref": "#/definitions/EventData"}, "minItems": 1}, "AdditionalData": { "$ref":"#/definitions/ExtensionTypeList"}}, "required": [], "additionalProperties": false}, "Expectation": { "type": "object", "properties": { "action": { "$ref":"#/definitions/action", "default": "other"}, "ext-action": {"type": "string"}, "severity": {"enum": ["low", "medium", "high"]}, "restriction": {"$ref": "#/definitions/restriction", "default": "default"}, "ext-restriction": {"type": "string"}, "observable-id": {"$ref": "#/definitions/IDtype"}, "Description": { "type": "array", "items": {"$ref": "#/definitions/MLStringType"}, "minItems": 1}, "DefinedCOA": { "type": "array", "items": {"type": "string"}, "minItems": 1}, "StartTime": {"$ref": "#/definitions/DATETIME"}, "EndTime": {"$ref": "#/definitions/DATETIME"}, "Contact": {"$ref": "#/definitions/Contact"}}, "required": [], "additionalProperties": false}, "System": { "type": "object", "properties": { "category": { "enum": ["source", "target", "intermediate", "sensor", "infrastructure", "ext-value"]}, "ext-category": {"type": "string"}, "interface": {"type": "string"}, "spoofed": { "enum": ["unknown", "yes", "no"], "default":"unknown"}, "virtual": { "enum": ["yes", "no", "unknown"], "default":"unknown"}, "ownership": { "enum":["organization", "personal", "partner", "customer", "no-relationship", "unknown", "ext-value"]}, "ext-ownership": {"type": "string"}, "restriction": {"$ref": "#/definitions/restriction", "default": "private"}, "ext-restriction": {"type": "string"}, "observable-id": {"$ref": "#/definitions/IDtype"}, "Node": {"$ref": "#/definitions/Node"}, "NodeRole": { "type": "array", "items": {"$ref": "#/definitions/NodeRole"}, "minItems": 1}, "Service": { "type": "array", "items": {"$ref": "#/definitions/Service"}, "minItems": 1}, "OperatingSystem": { "type": "array", "items": {"$ref": "#/definitions/SoftwareType"}, "minItems": 1}, "Counter": { "type": "array", "items": {"$ref": "#/definitions/Counter"}, "minItems": 1}, "AssetID": { "type": "array", "items": {"type": "string"}, "minItems": 1}, "Description": { "type": "array", "items": {"$ref": "#/definitions/MLStringType"}, "minItems": 1}, "AdditionalData": { "$ref":"#/definitions/ExtensionTypeList"}}, "required": ["Node"], "additionalProperties": false}, "Node": { "type": "object", "properties": { "DomainData": { "type": "array", "items": {"$ref": "#/definitions/DomainData"}, "minItems": 1}, "Address": { "type": "array", "items": {"$ref": "#/definitions/Address"}, "minItems": 1}, "PostalAddress": { "$ref": "#/definitions/PostalAddress"}, "Location": { "type": "array", "items": {"$ref": "#/definitions/MLStringType"}, "minItems": 1}, "Counter": { "type":"array", "items":{"$ref":"#/definitions/Counter"}, "minItems": 1}}, "anyOf": [ {"required": ["DomainData"]}, {"required": ["Address"]} ], "additionalProperties": false}, "Address": { "type": "object", "properties": { "value": {"type": "string"}, "category": { "enum":["asn", "atm", "e-mail", "ipv4-addr", "ipv4-net", "ipv4-net-masked", "ipv4-net-mask", "ipv6-addr", "ipv6-net", "ipv6-net-masked", "mac", "site-uri", "ext-value"], "default": "ipv6-addr"}, "ext-category": {"type": "string"}, "vlan-name": {"type": "string"}, "vlan-num": {"type": "number"}, "observable-id": {"$ref": "#/definitions/IDtype"}}, "required": ["value", "category"], "additionalProperties": false}, "NodeRole": { "type": "object", "properties": { "category": { "enum":["client", "client-enterprise", "client-partner", "client-remote", "client-kiosk", "client-mobile", "server-internal", "server-public", "www", "mail", "webmail", "messaging", "streaming", "voice", "file", "ftp", "p2p", "name", "directory", "credential", "print", "application", "database", "backup", "dhcp", "assessment", "source-control", "config-management", "monitoring", "infra", "infra-firewall", "infra-router", "infra-switch", "camera", "proxy", "remote-access", "log", "virtualization", "pos", "scada", "scada-supervisory", "sinkhole", "honeypot", "anomyzation", "c2-server", "malware-distribution", "drop-server", "hop-point", "reflector", "phishing-site", "spear-phishing-site", "recruiting-site", "fraudulent-site", "ext-value"]}, "ext-category": {"type": "string"}, "Description": { "type": "array", "items": {"$ref": "#/definitions/MLStringType"}, "minItems": 1}}, "required": ["category"], "additionalProperties": false}, "Counter": { "type": "object", "properties": { "value": {"type": "number"}, "type": { "enum": ["count", "peak", "average", "ext-value"]},
okay so we're still deep in the JSON schema, bestie 💅 Here's the next chunk of the unit and DomainData stuff 🎀
"ext-type": {"type": "string"},
"unit":{"enum":["byte", "mbit", "packet", "flow",
"session", "alert", "message", "event", "host",
"site", "organization", "ext-value"]},
"ext-unit": {"type": "string"},
"meaning": {"type": "string"},
"duration": {
"$ref":"#/definitions/duration", "default": "hour"},
"ext-duration": {"type": "string"}},
"required": ["value", "type", "unit"],
"additionalProperties": false},so unit gets its own little enum list 🦋 and duration quietly defaults to "hour" if nobody says otherwise ⏰ the ext- fields are the escape hatch for anything the enum doesn't cover 🧚
Now the big one, the DomainData object 🌸 It's where the domain's status, its dates, its name servers and its contacts all live together, and it's giving full dossier energy 🕵️♀️
"DomainData": {
"type": "object",
"properties": {
"system-status": {
"enum": ["spoofed", "fraudulent", "innocent-hacked",
"innocent-hijacked", "unknown", "ext-value"]},
"ext-system-status": {"type": "string"},
"domain-status": {
"enum": [ "reservedDelegation", "assignedAndActive",
"assignedAndInactive", "assignedAndOnHold",
"revoked", "transferPending",
"registryLock", "registrarLock",
"other", "unknown", "ext-value"]},
"ext-domain-status": {"type": "string"},
"observable-id": {"$ref": "#/definitions/IDtype"},
"Name": {"type": "string"},
"DateDomainWasChecked": {
"$ref": "#/definitions/DATETIME"},
"RegistrationDate": {
"$ref": "#/definitions/DATETIME"},
"ExpirationDate": {"$ref": "#/definitions/DATETIME"},
"RelatedDNS": {
"type": "array",
"items": {"$ref": "#/definitions/ExtensionType"},
"minItems": 1},
"NameServers": {
"type": "array",
"items": {"$ref": "#/definitions/NameServers"},
"minItems": 1},
"DomainContacts": {
"$ref": "#/definitions/DomainContacts"}},
"required": ["Name", "system-status", "domain-status"],
"additionalProperties": false},Quick vibe check on that one ✨ Name, system-status and domain-status are the three must-haves, so the schema won't accept a domain without them 🫶 Everything else is optional, and NameServers is a list of its own little objects 🍓
Next up are the name server and contact shapes 📇
"NameServers": {
"type": "object",
"properties": {
"Server": {"type": "string"},
"Address": {
"type":"array",
"items":{"$ref":"#/definitions/Address"},
"minItems": 1}},
"required": ["Server", "Address"],
"additionalProperties": false},
"DomainContacts": {
"type": "object",
"properties": {
"SameDomainContact": {"type": "string"},
"Contact": {
"type":"array",
"items":{"$ref":"#/definitions/Contact"},
"minItems": 1}},
"oneOf": [
{"required": ["SameDomainContact"]},
{"required": ["Contact"]}],
"additionalProperties": false},ok the oneOf in DomainContacts is lowkey the most dramatic line here 💀 It wants SameDomainContact or Contact, and exactly one of those is the rule, so you can't be both 🙈 that's iconic schema behaviour, no cap 👑
Last stop for this part is the Service object and its ServiceName friend 🌈
"Service": {
"type": "object",
"properties": {
"ip-protocol": {"type": "number"},
"observable-id": {"$ref": "#/definitions/IDtype"},
"ServiceName": {"$ref": "#/definitions/ServiceName"},
"Port": {"type": "number"},
"Portlist": {"$ref": "#/definitions/PortlistType"},
"ProtoCode": {"type": "number"},
"ProtoType": {"type": "number"},
"ProtoField": {"type": "number"},
"ApplicationHeaderField":{
"$ref":"#/definitions/ExtensionTypeList"},
"EmailData": {"$ref": "#/definitions/EmailData"},
"Application": {
"$ref": "#/definitions/SoftwareType"}},
"required": [],
"additionalProperties": false},
"ServiceName": {
"type": "object",
"properties": {
"IANAService": {"type": "string"},
"URL": {
"type": "array", "items": {
"$ref": "#/definitions/URLtype"}},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1}},
"required": [],
"additionalProperties": false},Service has no required fields at all, so it's a very chill object 🧘♀️ Port and Portlist sit side by side, and ServiceName is its own separate type with IANAService, URL and Description 🦋
We're still going in the next part, bestie, so stay tuned 🫶💖
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"required": ["FuzzyHashValue"],
"additionalProperties": false},
"Indicator": {
"type": "object",
"properties": {
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"IndicatorID": {"$ref": "#/definitions/IndicatorID"},
"AlternativeIndicatorID": {
"type": "array",
"items": {
"$ref": "#/definitions/AlternativeIndicatorID"},
"minItems": 1},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"StartTime": {"$ref": "#/definitions/DATETIME"},
"EndTime": {"$ref": "#/definitions/DATETIME"},
"Confidence": {"$ref": "#/definitions/Confidence"},
"Contact": {
"type": "array",
"items": {"$ref": "#/definitions/Contact"},
"minItems": 1},
"Observable": {"$ref": "#/definitions/Observable"},
"uid-ref": {"$ref": "#/definitions/IDREFType"},
"IndicatorExpression":{
"$ref":"#/definitions/IndicatorExpression"},
"IndicatorReference":{
"$ref": "#/definitions/IndicatorReference"},
"NodeRole": {
"type": "array",
"items": {"$ref": "#/definitions/NodeRole"},
"minItems": 1},
"AttackPhase": {
"type": "array",
"items": {"$ref": "#/definitions/AttackPhase"},
"minItems": 1},
"Reference": {
"type": "array",
"items": {"$ref": "#/definitions/Reference"},
"minItems": 1},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"allOf": [
{"required": ["IndicatorID"]},
{"oneOf": [
{"required":["Observable"]},
{"required":["uid-ref"]},
{"required":["IndicatorExpression"]},
{"required":["IndicatorReference"]}]}],
"additionalProperties": false},
"IndicatorID": {
"type": "object",
"properties": {
"id": {"type": "string"},
"name": {"type": "string"},
"version": {"type": "string"}},
"required": ["id", "name", "version"],
"additionalProperties": false},
"AlternativeIndicatorID": {
"type": "object",
"properties": {
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"IndicatorID": {
"type": "array",
"items": {"$ref": "#/definitions/IndicatorID"},
"minItems": 1}},
"required": ["IndicatorID"],
"additionalProperties": false},
"Observable": {
"type": "object",
"properties": {
"restriction": {"$ref": "#/definitions/restriction",
"default": "private"},
"ext-restriction": {"type": "string"},
"System": {"$ref": "#/definitions/System"},
"Address": {"$ref": "#/definitions/Address"},
"DomainData": {"$ref": "#/definitions/DomainData"},
"EmailData": {"$ref": "#/definitions/EmailData"},
"Service": {"$ref": "#/definitions/Service"},
"WindowsRegistryKeysModified": {
"$ref": "#/definitions/WindowsRegistryKeysModified"},
"FileData": {"$ref": "#/definitions/FileData"},
"CertificateData": {
"$ref": "#/definitions/CertificateData"},
"RegistryHandle": {
"$ref": "#/definitions/RegistryHandle"},
"RecordData": {"$ref": "#/definitions/RecordData"},
"EventData": {"$ref": "#/definitions/EventData"},
"Incident": {"$ref": "#/definitions/Incident"},
"Expectation": {"$ref": "#/definitions/Expectation"},
"Reference": {"$ref": "#/definitions/Reference"},
"Assessment": {"$ref": "#/definitions/Assessment"},
"DetectionPattern": {
"$ref": "#/definitions/DetectionPattern"},
"HistoryItem": {"$ref": "#/definitions/HistoryItem"},
"BulkObservable": {
"$ref": "#/definitions/BulkObservable"},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"oneOf": [
{"required":["System"]},
{"required":["Address"]},
{"required":["DomainData"]},
{"required":["EmailData"]},
{"required":["Service"]},
{"required":["WindowsRegistryKeysModified"]},
{"required":["FileData"]},
{"required":["CertificateData"]},
{"required":["RegistryHandle"]},
{"required":["RecordData"]},
{"required":["EventData"]},
{"required":["Incident"]},
{"required":["Expectation"]},
{"required":["Reference"]},
{"required":["Assessment"]},
{"required":["DetectionPattern"]},
{"required":["HistoryItem"]},
{"required":["BulkObservable"]},
{"required":["AdditionalData"]}],
"additionalProperties": false},
"BulkObservable": {
"type": "object",
"properties": {
"type": {"enum": ["asn", "atm", "e-mail", "ipv4-addr",
"ipv4-net", "ipv4-net-mask", "ipv6-addr", "ipv6-net",
"ipv6-net-mask", "mac", "site-uri", "domain-name",
"domain-to-ipv4", "domain-to-ipv6",
"domain-to-ipv4-timestamp",
"domain-to-ipv6-timestamp", "ipv4-port", "ipv6-port",
"windows-reg-key", "file-hash", "email-x-mailer",
"email-subject", "http-user-agent",
"http-request-url", "mutex", "file-path", "user-name",
"ext-value"]},
"ext-type": {"type": "string"},
"BulkObservableFormat":{
"$ref": "#/definitions/BulkObservableFormat"},
"BulkObservableList": {"type": "string"},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"required": ["BulkObservableList"],
"additionalProperties": false},
"BulkObservableFormat": {
"type": "object",
"properties": {
"Hash": {"$ref": "#/definitions/Hash"},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"oneOf": [
{"required": ["Hash"]},
{"required": ["AdditionalData"]}
],
"additionalProperties": false},
"IndicatorExpression": {
"type": "object",
"properties": {
"operator": {
"enum": ["not", "and", "or", "xor"], "default": "and"},
"ext-operator": {"type": "string"},
"IndicatorExpression": {
"type": "array",
"items": {
"$ref": "#/definitions/IndicatorExpression"},
"minItems": 1},
"Observable": {
"type": "array",
"items": {"$ref": "#/definitions/Observable"},
"minItems": 1},
"uid-ref": {
"type": "array",
"items": {"$ref": "#/definitions/IDREFType"},
"minItems": 1},
"IndicatorReference": {
"type": "array",
"items": {
"$ref": "#/definitions/IndicatorReference"},
"minItems": 1},
"Confidence": {"$ref":"#/definitions/Confidence"},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"required": [],
"additionalProperties": false},
"IndicatorReference": {
"type": "object",
"properties": {
"uid-ref": {"$ref":"#/definitions/IDREFType"},
"euid-ref": {"type": "string"},
"version": {"type": "string"}},
"oneOf": [
{"required": ["uid-ref"]},
{"required": ["euid-ref"]}
],
"additionalProperties": false},
"AttackPhase": {
"type": "object",
"properties": {
"AttackPhaseID": {
"type": "array",
"items": {"type": "string"},
"minItems": 1},
"URL": {
"type": "array",
"items": {"$ref": "#/definitions/URLtype"},
"minItems": 1},
"Description": {
"type": "array",
"items": {"$ref": "#/definitions/MLStringType"},
"minItems": 1},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"required": [],
"additionalProperties": false}},
"title": "IODEF-Document",
"description": "JSON schema for IODEF-Document class",
"type": "object",
"properties": {
"version": {"type": "string"},
"lang": {"$ref": "#/definitions/lang"},
"format-id": {"type": "string"},
"private-enum-name": {"type": "string"},
"private-enum-id": {"type": "string"},
"Incident": {
"type": "array",
"items": {"$ref": "#/definitions/Incident"},
"minItems": 1},
"AdditionalData": {
"$ref":"#/definitions/ExtensionTypeList"}},
"required": ["version", "Incident"],
"additionalProperties": false}Figure 6: JSON Schema 💖
Acknowledgments 🫶
Huge thank-yous to Henk Birkholz, Carsten Bormann, Benjamin Kaduk, Alexey Melnikov, Yasuaki Morita, and Takahiko Nagata 🌸 for their insightful comments on this document and CDDL. You all are literally the reason this spec is so clean ✨
Authors' Addresses 🦋
Here's where to find the crew 💌
Takeshi Takahashi
National Institute of Information and Communications Technology
4-2-1 Nukui-Kitamachi, Koganei, Tokyo
184-8795
Japan
Phone: +81 42 327 5862
Email: takeshi_takahashi@nict.go.jpRoman Danyliw
CERT, Software Engineering Institute, Carnegie Mellon University
4500 Fifth Avenue
Pittsburgh, PA
United States of America
Email: rdd@cert.orgMio Suzuki
National Institute of Information and Communications Technology
4-2-1 Nukui-Kitamachi, Koganei, Tokyo
184-8795
Japan
Email: mio@nict.go.jp📦 where this page comes from
- ietf: rfc8727 2020-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms