Intrusion Detection Message Exchange Format (IDMEF) Parameters

Created
2006-10-04
Last Updated
2007-03-14
Available Formats

XML
HTML
TXT

Registries Included Below

Class and Attribute Names

Registration Procedure(s)
IETF Review
Reference
[RFC 4765]
Available Formats

CSV
Class Name Attribute Name Reference
Reference origin [RFC 4765]
Source spoofed [RFC 4765]
Target decoy [RFC 4765]
AdditionalData type [RFC 4765]
Impact severity [RFC 4765]
Impact completion [RFC 4765]
Impact type [RFC 4765]
Action category [RFC 4765]
Confidence rating [RFC 4765]
Node category [RFC 4765]
Address category [RFC 4765]
User category [RFC 4765]
UserId category [RFC 4765]
File category [RFC 4765]
File fstype [RFC 4765]
FileAccess permission [RFC 4765]
Linkage category [RFC 4765]
Checksum algorithm [RFC 4765]

Attribute Values

Registration Procedure(s)
Specification Required
Expert(s)
Unassigned
Reference
[RFC 4765]
Available Formats

CSV
Class Name Attribute Name Rank Keyword Description Reference
Reference origin 0 unknown Origin of the name is not known [RFC 4765]
Reference origin 1 vendor-specific A vendor-specific name (and hence, URL); this can be used to provide product-specific information [RFC 4765]
Reference origin 2 user-specific A user-specific name (and hence, URL); this can be used to provide installation-specific information [RFC 4765]
Reference origin 3 bugtraqid The SecurityFocus ("Bugtraq") vulnerability database identifier (http://www.securityfocus.com/bid) [RFC 4765]
Reference origin 4 cve The Common Vulnerabilities and Exposures (CVE) name (http://cve.mitre.org/) [RFC 4765]
Reference origin 5 osvdb The Open Source Vulnerability Database (http://www.osvdb.org) [RFC 4765]
Source spoofed 0 unknown Accuracy of source information unknown [RFC 4765]
Source spoofed 1 yes Source is believed to be a decoy [RFC 4765]
Source spoofed 2 no Source is believed to be "real" [RFC 4765]
Target decoy 0 unknown Accuracy of target information unknown [RFC 4765]
Target decoy 1 yes Target is believed to be a decoy [RFC 4765]
Target decoy 2 no Target is believed to be "real" [RFC 4765]
AdditionalData type 0 boolean The element contains a boolean value, i.e., the strings "true" or "false" [RFC 4765]
AdditionalData type 1 byte The element content is a single 8-bit byte (see Section 3.2.4) [RFC 4765]
AdditionalData type 2 character The element content is a single character (see Section 3.2.3) [RFC 4765]
AdditionalData type 3 date-time The element content is a date-time string (see Section 3.2.6) [RFC 4765]
AdditionalData type 4 integer The element content is an integer (see Section 3.2.1) [RFC 4765]
AdditionalData type 5 ntpstamp The element content is an NTP timestamp (see Section 3.2.7) [RFC 4765]
AdditionalData type 6 portlist The element content is a list of ports (see Section 3.2.8 [RFC 4765]
AdditionalData type 7 real The element content is a real number (see Section 3.2.2 [RFC 4765]
AdditionalData type 8 string The element content is a string (see Section 3.2.3 [RFC 4765]
AdditionalData type 9 byte-string The element content is a byte[] (see Section 3.2.4 [RFC 4765]
AdditionalData type 10 xmltext The element content is XML-tagged data (see Section 5.2 [RFC 4765]
Impact severity 0 info Information only [RFC 4765]
Impact severity 1 low Low severity [RFC 4765]
Impact severity 2 medium Medium severity [RFC 4765]
Impact severity 3 high High severity [RFC 4765]
Impact completion 0 failed The attempt was not successful [RFC 4765]
Impact completion 1 succeeded The attempt succeeded [RFC 4765]
Impact type 0 admin Administrative privileges were attempted or obtained [RFC 4765]
Impact type 1 dos A denial of service was attempted or completed [RFC 4765]
Impact type 2 file An action on a file was attempted or completed [RFC 4765]
Impact type 3 recon A reconnaissance probe was attempted or completed [RFC 4765]
Impact type 4 user User privileges were attempted or obtained [RFC 4765]
Impact type 5 other Anything not in one of the above categories [RFC 4765]
Action category 0 block-installed A block of some sort was installed to prevent an attack from reaching its destination. The block could be a port block, address block, etc., or disabling a user account. [RFC 4765]
Action category 1 notification-sent A notification message of some sort was sent out-of-band (via pager, e-mail, etc.). Does not include the transmission of this alert. [RFC 4765]
Action category 2 taken-offline A system, computer, or user was taken offline, as when the computer is shut down or a user is logged off. [RFC 4765]
Action category 3 other Anything not in one of the above categories. [RFC 4765]
Confidence rating 0 low The analyzer has little confidence in its validity [RFC 4765]
Confidence rating 1 medium The analyzer has average confidence in its validity [RFC 4765]
Confidence rating 2 high The analyzer has high confidence in its validity [RFC 4765]
Confidence rating 3 numeric The analyzer has provided a posterior probability value indicating its confidence in its validity [RFC 4765]
Node category 0 unknown Domain unknown or not relevant [RFC 4765]
Node category 1 ads Windows 2000 Advanced Directory Services [RFC 4765]
Node category 2 afs Andrew File System (Transarc) [RFC 4765]
Node category 3 coda Coda Distributed File System [RFC 4765]
Node category 4 dfs Distributed File System (IBM) [RFC 4765]
Node category 5 dns Domain Name System [RFC 4765]
Node category 6 hosts Local hosts file [RFC 4765]
Node category 7 kerberos Kerberos realm [RFC 4765]
Node category 8 nds Novell Directory Services [RFC 4765]
Node category 9 nis Network Information Services (Sun) [RFC 4765]
Node category 10 nisplus Network Information Services Plus (Sun) [RFC 4765]
Node category 11 nt Windows NT domain [RFC 4765]
Node category 12 wfw Windows for Workgroups [RFC 4765]
Address category 0 unknown Address type unknown [RFC 4765]
Address category 1 atm Asynchronous Transfer Mode network address [RFC 4765]
Address category 2 e-mail Electronic mail address (RFC 822) [RFC 4765]
Address category 3 lotus-notes Lotus Notes e-mail address [RFC 4765]
Address category 4 mac Media Access Control (MAC) address [RFC 4765]
Address category 5 sna IBM Shared Network Architecture (SNA) address [RFC 4765]
Address category 6 vm IBM VM ("PROFS") e mail address [RFC 4765]
Address category 7 ipv4-addr IPv4 host address in dotted decimal notation (a.b.c.d) [RFC 4765]
Address category 8 ipv4-addr-hex IPv4 host address in hexadecimal notation [RFC 4765]
Address category 9 ipv4-net IPv4 network address in dotted decimal notation, slash, significant bits (a.b.c.d/nn) [RFC 4765]
Address category 10 ipv4-net-mask IPv4 network address in dotted decimal notation, slash, network mask in dotted decimal notation (a.b.c.d/w.x.y.z) [RFC 4765]
Address category 11 ipv6-addr IPv6 host address [RFC 4765]
Address category 12 ipv6-addr-hex IPv6 host address in hexadecimal notation [RFC 4765]
Address category 13 ipv6-net IPv6 network address, slash, significant bits [RFC 4765]
Address category 14 ipv6-net-mask IPv6 network address, slash, network mask [RFC 4765]
User category 0 unknown User type unknown [RFC 4765]
User category 1 application An application user [RFC 4765]
User category 2 os-device AN operating system or device user [RFC 4765]
UserId category 0 current-user The current user id being used by the user or process. On Unix systems, this would be the "real" user id, in general. [RFC 4765]
UserId category 1 original-user The actual identity of the user or process being reported on. On those systems that (a) do some type of auditing and (b) support extracting a user id from the "audit id" token, that value should be used. On those systems that do not support this, and where the user has logged into the system, the "login id" should be used. [RFC 4765]
UserId category 2 target-user The user id the user or process is attempting to become. This would apply, on Unix systems for example, when the user attempts to use "su," "rlogin," "telnet," etc. [RFC 4765]
UserId category 3 user-privs Another user id the user or process has the ability to use, or a user id associated with a file permission. On Unix systems, this would be the "effective" user id in a user or process context, and the owner permissions in a file context. Multiple UserId elements of this type may be used to specify a list of privileges. [RFC 4765]
UserId category 4 current-group The current group id (if applicable) being used by the user or process. On Unix systems, this would be the "real" group id, in general. [RFC 4765]
UserId category 5 group-privs Another group id the group or process has the ability to use, or a group id associated with a file permission. On Unix systems, this would be the "effective" group id in a group or process context, and the group permissions in a file context. On BSD-derived Unix systems, multiple UserId elements of this type would be used to include all the group ids on the "group list." [RFC 4765]
UserId category 6 other-privs Not used in a user, group, or process context, only used in the file context. The file permissions assigned to users who do not match either the user or group permissions on the file. On Unix systems, this would be the "world" permissions. [RFC 4765]
File category 0 current The file information is from after the reported change [RFC 4765]
File category 1 original The file information is from before the reported change [RFC 4765]
File fstype 0 ufs Berkeley UNIX Fast File System [RFC 4765]
File fstype 1 efs Linux "efs" file system [RFC 4765]
File fstype 2 nfs Network File System [RFC 4765]
File fstype 3 afs Andrew File System [RFC 4765]
File fstype 4 ntfs Windows NT File System [RFC 4765]
File fstype 5 fat16 16-bit Windows FAT File System [RFC 4765]
File fstype 6 fat32 32-bit Windows FAT File System [RFC 4765]
File fstype 7 pcfs "PC" (MS-DOS) file system on CD-ROM [RFC 4765]
File fstype 8 joliet Joliet CD-ROM file system [RFC 4765]
File fstype 9 iso9660 ISO 9660 CD-ROM file system [RFC 4765]
FileAccess permission 0 noAccess No access at all is allowed for this user [RFC 4765]
FileAccess permission 1 read This user has read access to the file [RFC 4765]
FileAccess permission 2 write This user has write access to the file [RFC 4765]
FileAccess permission 3 execute This user has the ability to execute the file [RFC 4765]
FileAccess permission 4 search This user has the ability to search this file (applies to "execute" permission on directories in UNIX) [RFC 4765]
FileAccess permission 5 delete This user has the ability to delete this file [RFC 4765]
FileAccess permission 6 executeAs This user has the ability to execute this file as another user [RFC 4765]
FileAccess permission 7 changePermissions This user has the ability to change the access permissions on this file [RFC 4765]
FileAccess permission 8 takeOwnership This user has the ability to take ownership of this file [RFC 4765]
Linkage category 0 hard-link The <name> element represents another name for this file. This information may be more easily obtainable on NTFS file systems than others. [RFC 4765]
Linkage category 1 mount-point An alias for the directory specified by the parent's <name> and <path> elements. [RFC 4765]
Linkage category 2 reparse-point Applies only to Windows; excludes symbolic links and mount points, which are specific types of reparse points. [RFC 4765]
Linkage category 3 shortcut The file represented by a Windows "shortcut." A shortcut is distinguished from a symbolic link because of the difference in their contents, which may be of importance to the manager. [RFC 4765]
Linkage category 4 stream An Alternate Data Stream (ADS) in Windows; a fork on MacOS. Separate file system entity that is considered an extension of the main <File>. [RFC 4765]
Linkage category 5 symbolic-link The <name> element represents the file to which the link points. [RFC 4765]
Checksum algorithm 0 MD4 The MD4 algorithm. [RFC 4765]
Checksum algorithm 1 MD5 The MD5 algorithm. [RFC 4765]
Checksum algorithm 2 SHA1 The SHA1 algorithm. [RFC 4765]
Checksum algorithm 3 SHA2-256 The SHA2 algorithm with 256 bits length. [RFC 4765]
Checksum algorithm 4 SHA2-384 The SHA2 algorithm with 384 bits length. [RFC 4765]
Checksum algorithm 5 SHA2-512 The SHA2 algorithm with 512 bits length. [RFC 4765]
Checksum algorithm 6 CRC-32 The CRC algorithm with 32 bits length. [RFC 4765]
Checksum algorithm 7 Haval The Haval algorithm. [RFC 4765]
Checksum algorithm 8 Tiger The Tiger algorithm. [RFC 4765]
Checksum algorithm 9 Gost The Gost algorithm. [RFC 4765]