Subject: Proposal for additional asset infos in IDMEF

From: Sandro Poppi <[email-masked]>
Date: Wed, 24 Aug 2005 11:41:11 +0200

Hello all,

I'd like to propose inclusion of additional information within IDMEF:

When dealing with IDS/IPS data it's very helpful if there was also 
information available about the target attacked, e.g. for event 
correlation, like os, open ports, software running on the target, known 
vulnerabilities etc.

As this helps in understanding attacks reported by analyzers and 
mitigating risks this for me is also part of Intrusion 
Detection/Prevention and thus should be reflected within IDMEF.

To generate that kind of information lots of open source and commercial 
tools are available (nmap, nessus, ISS Internet Scanner, Microsoft 
Baseline Security Analyzer, ...).

In terms of IDMEF I'd see such kind of tool also as an "analyzer", but 
this analyzer does not generate any alarm but asset information which 
didn't fit to any of the current classes (it's not an alert nor a 
heartbeat).

Thanks to Detmar Liesen who sent valuable input to these thoughts.

Find attached the proposal for further discussion.

Thank you,
Sandro Poppi

-- 
Maintainer of snort-idmef http://sf.net/projects/snort-idmef
co-author of libidmef 1.x http://sf.net/projects/libidmef
Hello all,

I'd like to propose inclusion of additional information within IDMEF:

When dealing with IDS/IPS data it's very helpful if there was also information
available about the target attacked, e.g. for event correlation, like os, open
ports, software running on the target, known vulnerabilities etc.

As this helps in understanding attacks reported by analyzers and mitigating
risks this for me is also part of Intrusion Detection/Prevention and thus
should be reflected within IDMEF.

To generate that kind of information lots of open source and commercial tools
are available (nmap, nessus, ISS Internet Scanner, Microsoft Baseline Security
Analyzer, ...).

In terms of IDMEF I'd see such kind of tool also as an "analyzer", but this
analyzer does not generate any alarm but asset information which didn't fit to
any of the current classes (it's not an alert nor a heartbeat).

Note: Everything in [] are notes to the editor or reader.

Thanks to Detmar Liesen who sent valuable input to these thoughts.

My proposal is adding an additional main class "Asset" to IDMEF:

              +---------------+
              | IDMEF-Message |
              +---------------+
                     /_\
                      |
       +--------------+--------------+
       |              |              |
   +-------+    +-----------+    +-------+
   | Alert |    | Heartbeat |    | Asset |
   +-------+    +-----------+    +-------+

The Asset Class

The Asset class defines assets to include data "offline" generated by various
tools or manually to allow better correlation and minimize false positives.

[The Asset Class reuses existing classes and adds some new]

      +--------------+ 
      |    Asset     | 
      +--------------+     0..1  +----------------+ 
      | STRING ident |<>---------|   Analyzer     | 
      |              |           +----------------+  
      |              |           +----------------+ 
      |              |<>---------|     Target     | 
      |              |           +----------------+ 
      |              |     1..*  +----------------+
      |              |<>---------|      Tool      |
      |              |           +----------------+
      +--------------+

The aggregate classes that make up Asset are:

   Analyzer
      Zero or one.  Information about the system the tool runs on.
   Target
      One or more.  The target this asset is for.
   Tool
      Exactly one.  The tool(s) used for this asset.

   This is represented in the XML DTD as follows:

         <!ELEMENT Asset                         (
             Analyzer?, Target, Tool+
           )>
         <!ATTLIST Asset
             ident           CDATA                   '0'

The Asset class has one attribute:

   ident
      Optional. A unique identifier for this asset, see Section 4.2.9.
      
      [Addition to 4.2.9] The Asset must be uniquely identified by the couple
      (asset.ident,tool.name). 

The Tool Class

   The Tool Class is used to define which tool created the information and what
   the results are for further processing.

                +---------------------+
                |        Tool         |
                +---------------------+       0..1 +----------+
                | STRING name         |<>----------|   url    |
                | STRING manufacturer |            +----------+
                | STRING model        |       0..* +----------+
                | STRING version      |<>----------|   arg    |
                | STRING class        |            +----------+
                | STRING ostype       |       1..* +----------+
                | STRING osversion    |<>----------|  Result  |
                |                     |            +----------+
                |                     |       0..* +----------------+
                |                     |<>----------| AdditionalData |
                +---------------------+            +----------------+

The aggregate classes that make up Tool are:

   url
      Zero or one.  STRING.  A URL at which the tool (or the human
      operator of the manager) can find additional information about it.
      The document pointed to by the URL may include an in-depth
      description of the tool, most likely its homepage.
   arg
      Zero or more.  STRING.  A command-line argument to the tool.
      Multiple arguments may be specified (they are assumed to have
      occurred in the same order they are provided) with multiple uses
      of arg. This could be e.g. a nessus commandline of a certain nasl
      script or an nmap commandline.
   Result
      One or more.  The result set the tool found for the target. This is a
      list of what the tool identified on the target, e.g. a list of open
      ports, the operating system, the vulnerabilities found etc.
   AdditionalData
      Zero or more.  Information included by the analyzer that does not
      fit into the data model.  This may be an atomic piece of data, or
      a large amount of data provided through an extension to the IDMEF
      (see Section 6).

   This is represented in the XML DTD as follows:

         <!ELEMENT Tool                      (
             Result+, AdditionalData*, url?, arg*
           )>
         <!ATTLIST Tool
             name                CDATA                   #IMPLIED
             manufacturer        CDATA                   #IMPLIED
             model               CDATA                   #IMPLIED
             version             CDATA                   #IMPLIED
             class               CDATA                   #IMPLIED
             ostype              CDATA                   #IMPLIED
             osversion           CDATA                   #IMPLIED

The Tool class has seven attributes:

   name
      Required.  An explicit name for the tool used. This could also be
      "manual" if the data was generated "by hand".
   manufacturer
      Optional.  The manufacturer of the tool software.
   model
      Optional.  The model name/number of the tool software.
   version
      Optional.  The version number of the tool software.
   class
      Optional.  The class of tool software.
   ostype
      Optional.  Operating system name the tool runs on. On POSIX 1003.1
      compliant systems, this is the value returned in utsname.sysname by the
      uname() system call, or the output of the "uname -s" command.
   osversion
      Optional.  Operating system version the tool runs on. On POSIX 1003.1
      compliant systems, this is the value returned in utsname.release by the
      uname() system call, or the output of the "uname -r" command.

The Result Class      
      
   The Result class provides information about the tool's findings. It is
   intended to exactly define what the toolthinks it has found on the target.
      
      +-----------------+
      |     Result      | 
      +-----------------+   0..1 +--------------+
      | STRING ident    |<>------|  Confidence  | 
      | ENUM severity   |        +--------------+ 
      | STRING version  |        +--------------+
      | STRING category |<>------|   Service    |
      | ENUM type       |        +--------------+
      |                 |        +--------------+
      |                 |<>------| Vulnerability|
      |                 |        +--------------+
      |                 |        +--------------+
      |                 |<>------|      OS      |
      |                 |        +--------------+
      |                 |   1..* +--------------+
      |                 |<>------|     Rule     |
      |                 |        +--------------+
      |                 |   0..* +--------------+ 
      |                 |<>------|  Reference   | 
      |                 |        +--------------+ 
      |                 |        +--------------+ 
      |                 |<>------|  CreateTime  | 
      |                 |        +--------------+ 
      |                 |   0..1 +--------------+
      |                 |<>------|    banner    |
      |                 |        +--------------+
      |                 |   0..1 +--------------+
      |                 |<>------|   summary    |
      |                 |        +--------------+
      |                 |   0..1 +--------------+ 
      |                 |<>------|  description | 
      |                 |        +--------------+ 
      +-----------------+

There MUST be exactly one of the classes Service, Vulnerability, OS, Rule set
(mutual exclusion).
Multiple Vulnerabilities found result in multiple Result classes.

The aggregate classes that make up Result are:

   Confidence
      Zero or one.  A measurement of the confidence the tool has in its 
      evaluation of the event.
   Service
      Exactly one.  Information about the network service involved in
      the event. This is used for indicating open ports.
   Vulnerability
      Exactly one.  The vulnerability found by the tool on the target.
   OS
     Exactly one.  The operating system of the target as provided by the tool.
   Rule
     One or more.  The rule(s) what's allowed on the target and for whom if
     it's secured by a firewall. This can be used for providing knowledge about
     firewall rules such as iptables.
   Reference
      Zero or more.  Information about the result, pointing to external
      documentation sites, that will provide background information.
   banner
      Zero or one. STRING. The service's banner as provided by connecting to
      the given Service. If banner is set, Service MUST be set too.
   summary
      Zero or one. STRING. A brief summary of the result.
   description
      Zero or one. STRING. A detailed description of the result.

   This is represented in the XML DTD as follows:

         <!ENTITY % attvals.type             "
             ( automatic | manual )
           ">
         <!ENTITY % attvals.severity             "
             ( info | low | medium | high )
           ">
         <!ELEMENT Result                (
             Confidence?,
             ((Service | (Service, banner?)) | Vulnerability | OS | Rule+),
             Reference*, CreatTime, summary?, descritpion?
           )>
         <!ATTLIST Result
             ident		 CDATA			'0'
             severity            %attvals.severity;      #IMPLIED
             version             CDATA                   #IMPLIED
             category            CDATA                   #IMPLIED
             type                %attvals.type;          'automatic'

The Result class has five attributes:

   ident
      Optional.  A unique identifier for this Result, e.g. the corresponding
      tool's id for the result.
   severity
      Required. An estimate of the relative severity of the event. The permitted
      values are shown below.  There is no default value.

      +------+---------+-----------------------------------------+
      | Rank | Keyword | Description                             |
      +------+---------+-----------------------------------------+
      |    O | info    | Alert represents informational activity |
      |      |         |                                         |
      |    1 | low     | Low severity                            |
      |      |         |                                         |
      |    2 | medium  | Medium severity                         |
      |      |         |                                         |
      |    3 | high    | High severity                           |
      +------+---------+-----------------------------------------+

   version
      Optional. The version/revision of the script/rule if applicable.
   category
      Optional. The category the result belongs to.
   type
      Required. The type of the result. The permitted values for this attribute
      are shown below. The default value is "automatic".

   +----------------------+-----------+--------------------------+
   |                 Rank | Keyword   | Description              |
   +----------------------+-----------+--------------------------+
   |                    0 | automatic | The result was generated |
   |                      |           | automatically.           |
   |                      |           |                          |
   |                    1 | manual    | The result was generated |
   |                      |           | manually.                |
   +----------------------+-----------+--------------------------+

The Vulnerability Class

   The vulnerability class provides detailed information of the vulnerability
   found.
   [the attributes are mainly inspired by OSVDB http://www.osvdb.org]

      +-------------------+
      |  Vulnerability    | 
      +-------------------+   0..* +--------------+
      | STRING ident      |<>------|   exploit    | 
      | ENUM expoitable   |        +--------------+ 
      | ENUM location     |
      | ENUM attacktype   |
      | ENUM attackimpact |
      | ENUM grade        |
      | ENUM web          |
      +-------------------+

The aggregate classes that make up Vulnerability are:

   exploit
      Zero or more. STRING. If 'exploitable' is set to "available" this class
      holds information about the published exploit(s), else exploit has to be
      omitted.

   This is represented in the XML DTD as follows:

         <!ENTITY % attvals.exploitable             "
             ( unknown | available | unavailable | rumored )
           ">
         <!ENTITY % attvals.location             "
             ( unknown | local | remote | physical | dialup )
           ">
         <!ENTITY % attvals.attacktype             "
             ( unknown | auth_manage | crypt | dos  | hijack | info_disclose |
               infrastruct | input_manip | miss_config | race | other )
           ">
         <!ENTITY % attvals.attackimpact             "
             ( unknown | confidential | integrity | available )
           ">
         <!ENTITY % attvals.grade             "
             ( verified | myth | best_practice | concern )
           ">
         <!ENTITY % attvals.web             "
             ( unknown | yes | no )
           ">
         <!ELEMENT Vulnerability                (
             exploit*
           )>
         <!ATTLIST Vulnerability
             ident		 CDATA			'0'
             exploitable         %attvalsexploitable.;  'unknown'
             location            %attvals.location;     'unknown'
             attacktype          %attvals.attacktype;   'unknown'
             attackimpact        %attvals.impact;       'unknown'
             grade               %attvals.grade;        #IMPLIED
             web                 %attvals.web;          'unknown'

The Vulnerability class has five attributes:

   ident
      Optional.  A unique identifier for this Vulnerability, e.g. the
      corresponding tool's id for the result.
   exploitable
      Required. Is an exploit for the vulnerability found available.  The
      permitted values are shown below.  The default value is "unknown".

      +------+-------------+------------------------------------------+
      | Rank | Keyword     | Description                              |
      +------+-------------+------------------------------------------+
      |    O | unknown     | It's not sure if an exploit exists       |
      |      |             |                                          |
      |    1 | available   | An exploit is publicly available         |
      |      |             |                                          |
      |    2 | unavailable | An exploit is not available              |
      |      |             |                                          |
      |    3 | rumored     | Rumors has it that there seems to be an  |     
      |      |             | exploit floating around                  |
      +------+-------------+------------------------------------------+

     location
        Optional. The way how this vulnerability can be exploited. The
        permitted values are shown below. The default value is "unknown".

      +------+---------+------------------------------------------+
      | Rank | Keyword | Description                              |
      +------+---------+------------------------------------------+
      |    0 | unknown | It's not sure which kind of access is    |
      |      |         | required to exploit this vulnerability   |
      |      |         |                                          |
      |    1 | local   | To exploit this vulnerability local shell|
      |      |         | access is required.                      |
      |      |         |                                          |
      |    2 | remote  | To exploit this vulnerability remote     | 
      |      |         | access is required                       |
      |      |         |                                          |
      |    3 | physical| To exploit this vulnerability physical   | 
      |      |         | console access is required               |
      |      |         |                                          |
      |    4 | dialup  | To exploit this vulnerability dialup     | 
      |      |         | access is required                       |
      +------+---------+------------------------------------------+

     attacktype
        Optional. The type of this attack. The permitted values are shown
        below.  The default value is "unknown".
        
      +------+---------------+------------------------------------------+
      | Rank | Keyword       | Description                              |
      +------+---------------+------------------------------------------+
      |    O | unknown       | The attack type is unknown               |
      |      |               |                                          |
      |    1 | auth_manage   | This is an authentication attack         |
      |      |               |                                          |
      |    2 | crypt         | This is a cryptographic attack           |
      |      |               |                                          |
      |    3 | dos           | This attack leads to a Denial of Service |
      |      |               |                                          |
      |    4 | hijack        | This attack leads to session hijacking   |
      |      |               |                                          |
      |    5 | info_disclose | This attack leads to information         |
      |      |               | disclosure                               |
      |      |               |                                          |
      |    6 | infrastruct   | This is an infrastructure attack         |
      |      |               |                                          |
      |    7 | input_manip   | This is an input manipulation attack     |
      |      |               |                                          |
      |    8 | miss_config   | This attack is possible because of a     |
      |      |               | missconfiguration                        |
      |      |               |                                          |
      |    9 | race          | This attack uses a race condition        |
      |      |               |                                          |
      |   10 | other         | The type doesn't fit to any of the above |
      |      |               | types but is not unknown                 |
      +------+---------------+------------------------------------------+

     attackimpact
        Optional. The impact of this attack. The permitted values are shown
        below.  The default value is "unknown".
        
      +------+--------------+------------------------------------------+
      | Rank | Keyword      | Description                              |
      +------+--------------+------------------------------------------+
      |    O | unknown      | The impact is unknown                    |
      |      |              |                                          |
      |    1 | confidential | The impact leads to loss of              |
      |      |              | confidentiality                          |
      |      |              |                                          |
      |    2 | integrity    | The impact leads to loss of integrity    |
      |      |              |                                          |
      |    3 | available    | The impact leads to loss of availability |
      +------+--------------+------------------------------------------+

     grade
        Required. The grade of this attack. The permitted values are shown
        below.  There's no default value.
        
      +------+--------------+------------------------------------------+
      | Rank | Keyword      | Description                              |
      +------+--------------+------------------------------------------+
      |    O | verified     | The vulnerability has been verified      |
      |      |              |                                          |
      |    1 | myth         | The vulnerability is a myth aka not real |
      |      |              |                                          |
      |    2 | best_practice| The vulnerability gives best practices   |
      |      |              |                                          |
      |    3 | concern      | The vulnerability is concerning          |
      +------+--------------+------------------------------------------+

     web
        Optional. Describes if this vulnerability is web related. The permitted
        values are shown below.  The default value is "unknown".
        
      +------+--------------+------------------------------------------+
      | Rank | Keyword      | Description                              |
      +------+--------------+------------------------------------------+
      |    O | unknown      | It is unknown if this vulnerability is   |
      |      |              | web related                              |
      |      |              |                                          |
      |    1 | yes          | The vulnerability is web related         |
      |      |              |                                          |
      |    2 | no           | The vulnerability is not web related     |
      +------+--------------+------------------------------------------+

The OS Class

   The OS class provides information about the operating system the tool thinks
   is running on the target.

      +-----------------+
      |       OS        | 
      +-----------------+   0..1 +--------------+
      |                 |<>------|  patchlevel  | 
      | ENUM arch       |        +--------------+ 
      | STRING version  |   0..* +--------------+
      |                 |<>------|    hotfix    |
      |                 |        +--------------+
      +-----------------+

The aggregate classes that make up OS are:

   patchlevel
      Zero or one. The OS's patchlevel as provided by the tool.
   hotfix
      Zero or more. The installed hotfixes of the OS. These SHOULD be ordered
      by release date.

   This is represented in the XML DTD as follows:

         <!ENTITY % attvals.arch             "
             ( x86 | x86-64 | amd | amd64 | ppc | mips | sparc | arm | other )
           ">
         <!ELEMENT OS                (
             patchlevel?, hotfix*
           )>
         <!ATTLIST 
             arch                %attvals.arch;         #IMPLIED
             version             CDATA                  #IMPLIED

The OS class has three attributes:

   arch
      Optional. The architecture of the processor the OS runs on. The permitted
      values are shown below. The default value is "unknown".

      +------+---------+-----------------------------------------+
      | Rank | Keyword | Description                             |
      +------+---------+-----------------------------------------+
      |    O | unknown | The processor type is unknown           |
      |      |         |                                         |
      |    1 | x86     | Intel based PC 32 bit processor         |
      |      |         |                                         |
      |    2 | x86-64  | Intel based PC 64 bit processor         |
      |      |         |                                         |
      |    3 | amd     | AMD based PC 32 bit processor           |
      |      |         |                                         |
      |    4 | amd64   | AMD based PC 64 bit processor           |
      |      |         |                                         |
      |    5 | ppc     | Power PC                                |
      |      |         |                                         |
      |    6 | mips    | MIPS processor                          |
      |      |         |                                         |
      |    7 | sparc   | Sun Sparc/UltraSparc processor          |
      |      |         |                                         |
      |    8 | arm     | ARM based processor                     |
      |      |         |                                         |
      |    9 | other   | Any processor not mentioned above       |
      |      |         |                                         |
      +------+---------+-----------------------------------------+

   version
      Optional. The version of the OS.

The Rule Class

   This is an optional class to define policy rules defined by firewalls for a
   specific target. This supports finding holes in a firewall's policy (by
   correlating with other analyzers' findings) as well as filtering unwanted
   probes the firewall blocks anyway although reported by an analyzer.

      +------------------+ 
      |     Rule         | 
      +------------------+
      | STRING ident     |
      | ENUM log         |
      | ENUM action      |     0..*  +---------+ 
      | STRING interface |<>---------|   Node  | 
      |                  |           +---------+ 
      |                  |     0..*  +---------+
      |                  |<>---------|   User  |
      |                  |           +---------+
      |                  |     0..*  +---------+
      |                  |<>---------| Service |
      |                  |           +---------+
      |                  |     0..*  +---------+
      |                  |<>---------|   Nat   |
      |                  |           +---------+
      |                  |           +---------+
      |                  |<>---------|  fwtype |
      |                  |           +---------+
      |                  |           +-----------+
      |                  |<>---------| fwversion |
      |                  |           +-----------+
      +------------------+

The aggregate classes that make up Rule are:

   fwtype
      Exactly one. The rule's type definition, the firewall type.
   fwversion
      Exactly one. The rule's type definition, the firewall version.
   Node
      Zero or more.  The source(s) defined in the policy.
   User
      Zero or more. The User(s) defined in the policy if it's a user based
      rule.
   Nat
      Zero or more. Detailed information about Network Address Translation
      (NAT) rules.

   One of the classes Node and User MUST be set but not both.
   If a Nat class is provided none of the classes Node, User and Service have
   to be set. In all other cases a Service class MUST be provided.

   This is represented in the XML DTD as follows:

         <!ENTITY % attvals.log             "
             ( unknown | none | log | user | other  )
           ">
         <!ENTITY % attvals.action             "
             ( accept | drop | reject | accounting  )
           ">
         <!ELEMENT Rule                (
             (((Node* | User*), Service*) | Nat*), fwtype, fwversion
           )>
         <!ATTLIST 
             ident		 CDATA			#IMPLIED
             log                 %attvals.log;          'unknown'
             action              %attvals.action        #IMPLIED
             interface		 CDATA			#IMPLIED

The Rule class has three attributes:

   ident
      Optional. A unique identifier for this Policy, see Section 4.2.9.
   log
      Required. Defines if there was logging enabled and when what exactly.
      The permitted values are shown below. The default value is "unknown".
      
      +------+--------------+------------------------------------------+
      | Rank | Keyword      | Description                              |
      +------+--------------+------------------------------------------+
      |    O | unknown      | The logging is unknown                   |
      |      |              |                                          |
      |    1 | none         | The logging is disabled for this rule    |
      |      |              |                                          |
      |    2 | log          | Normal logging, e.g. syslog or firewall  |     
      |      |              | default logging                          |
      |      |              |                                          |
      |    3 | user         | The logging is user-defined              |
      |      |              |                                          |
      |    4 | other        | The logging is something else (email,    |     
      |      |              | snmp, ...)                               |
      +------+--------------+------------------------------------------+

   action
      Required. The action defined on this specific rule. The permitted values
      are shown below. There is no default value.

      +------+--------------+------------------------------------------+
      | Rank | Keyword      | Description                              |
      +------+--------------+------------------------------------------+
      |    O | accept       | The rule allows access                   |
      |      |              |                                          |
      |    1 | drop         | The rule drops any packet without sending|
      |      |              | information back                         |
      |      |              |                                          |
      |    2 | reject       | The rule drops any packet and sends back |     
      |      |              | icmp unreachable or tcp reset packets    |
      |      |              |                                          |
      |    3 | accounting   | The rule only counts matches             |
      +------+--------------+------------------------------------------+
      
    interface
       Optional. The interface this rule is bound to such as "eth0" with Linux,
       or "any".

The Nat Class

   The Nat class provides detailed information about the Network Address
   Tranlsation (NAT) rules. It is intended to gain knowledge about which ip
   addresses and/or ports are affected by an attack behind the NAT'ing device.

      +--------------+ 
      |     Nat      | 
      +--------------+           +----------+ 
      | STRING ident |<>---------|  OrgSrc  | 
      |              |           +----------+  
      |              |           +----------+ 
      |              |<>---------|  OrgTgt  | 
      |              |           +----------+ 
      |              |           +----------+
      |              |<>---------| TransSrc |
      |              |           +----------+
      |              |           +----------+
      |              |<>---------| TransTgt |
      |              |           +----------+
      +--------------+

The aggregate classes that make up Nat are:

   OrgSrc
      Exactly one. The original source address(es).
   OrgTgt
      Exactly one. The original target address(es)
   TransSrc
      Exactly one. The translated source address.
   TransTgt
      Exactly one. The translated target address.

   This is represented in the XML DTD as follows:

         <!ELEMENT Nat                      (
             OrgSrc, OrgTgt, TransSrc, TransTgt
           )>
         <!ATTLIST Nat
             ident               CDATA                   #IMPLIED

The Nat class has one attribute:

   ident
      Optional. A unique identifier for this Nat rule, see Section 4.2.9.

The OrgSrc Class

   The OrgSrc class defines the source node(s) which have to be NAT'ed.
   
      +--------------+ 
      |    OrgSrc    | 
      +--------------+      1..* +----------+ 
      |              |<>---------|   Node   | 
      |              |           +----------+ 
      +--------------+

The aggregate classes that make up OrgSrc are:

   Node
      One or more. The source node(s) to be NAT'ed

   This is represented in the XML DTD as follows:

         <!ELEMENT OrgSrc                        (
             Node+
           )>

The OrgSrc class has no attributes.

The OrgTgt Class

   The OrgTgt class defines the target node(s) and port which have to be NAT'ed.
   
      +--------------+ 
      |    OrgTgt    | 
      +--------------+      1..* +----------+ 
      |              |<>---------|   Node   | 
      |              |           +----------+ 
      |              |           +----------+ 
      |              |<>---------|  Service | 
      |              |           +----------+ 
      +--------------+

The aggregate classes that make up OrgTgt are:

   Node
      One or more. The target node(s) to be NAT'ed
   Service
      Exactly one. The target service definition to be NAT'ed

   This is represented in the XML DTD as follows:

         <!ELEMENT OrgTgt                        (
             Node+, Service
           )>

The OrgTgt class has no attributes.

The TransSrc Class

   This class defines the translated source node for NAT'ing.

      +--------------+ 
      |   TransSrc   | 
      +--------------+           +----------+ 
      |              |<>---------|   Node   | 
      |              |           +----------+ 
      +--------------+

The aggregate classes that make up TransSrc are:

   Node
      Exactly one. The translated source node for NAT'ing

   This is represented in the XML DTD as follows:

         <!ELEMENT TransSrc                        (
             Node
           )>

The TransSrc class has no attributes.

The TransTgt Class

   The TransTgt class defines the target node and port for NAT'ing.
   
      +--------------+ 
      |   TransTgt   | 
      +--------------+           +----------+ 
      |              |<>---------|   Node   | 
      |              |           +----------+ 
      |              |           +----------+ 
      |              |<>---------|  Service | 
      |              |           +----------+ 
      +--------------+

The aggregate classes that make up TransTgt are:

   Node
      Exactly one. The target node for NAT'ing
   Service
      Exactly one. The target service definition to be NAT'ed to

   This is represented in the XML DTD as follows:

         <!ELEMENT TransTgt                        (
             Node, Service
           )>

The TransTgt class has no attributes.

Examples

   Nessus scan result for MySQL Server version

   <?xml version="1.0" encoding="UTF-8"?>

   <idmef:IDMEF-Message xmlns:idmef="http://iana.org/idmef"
                        version="1.0">
     <idmef:Asset ident="neptun-nessus-check1">
       <idmef:Analyzer analyzerid="hq-nessus01">
         <idmef:Node category="dns">
           <idmef:location>Headquarters Scan Network</idmef:location>
           <idmef:name>nessus01.example.com</idmef:name>
         </idmef:Node>
       </idmef:Analyzer>
       <idmef:Target ident="d1c2b3a4">
         <idmef:Node ident="d1c2b3a4-001" category="dns">
           <idmef:Address category="ipv4-addr-hex">
             <idmef:address>0xde796f70</idmef:address>
           </idmef:Address>
         </idmef:Node>
       </idmef:Target>
       <idmef:Tool name="nessus" version="2.2.5" class="vulnerability-scanner"
                   ostype="Linux" osversion="2.6.12-1.1398_FC4smp">
         <idmef:url>http://www.nessus.org</idmef:url>
         <idmef:Result severity="info" version="1.14" type="automatic">
           <idmef:Vulnerability ident="10719" exploitable="unavailable"
                                grade="verified" web="no">
           </idmef:Vulnerability>
           <idmef:CreateTime ntpstamp="0xc694c70c.0xfc87980f">
             2005-07-29T15:17:32Z
           </idmef:CreateTime>
           <idmef:Reference origin="vendor-specific">
             <idmef:name>10719</idmef:name>
             <idmef:url>
               http://www.nessus.org/plugins/index.php?view=single&id=10719
             </idmef:url>
           </idmef:Reference>
           <idmef:summary>
             MySQL Server version
           </idmef:summary>
           <idmef:description>
             This detects MySQL Server's version by connecting to the server and
             processing the buffer received.  This information gives potential
             attackers additional information about the system they are attacking.
             Versions should be omitted where possible.
           </idmef:description>
         </idmef:Result>
       </idmef:Tool>
     </idmef:Asset>
   </idmef:IDMEF-Message>

   Nmap Operating System Guess

   <?xml version="1.0" encoding="UTF-8"?>

   <idmef:IDMEF-Message xmlns:idmef="http://iana.org/idmef"
                        version="1.0">
     <idmef:Asset ident="neptun-nmap01">
       <idmef:Analyzer analyzerid="hq-nmap01">
         <idmef:Node category="dns">
           <idmef:location>Headquarters Scan Network</idmef:location>
           <idmef:name>nmap01.example.com</idmef:name>
         </idmef:Node>
       </idmef:Analyzer>
       <idmef:Target ident="d1c2b3a4">
         <idmef:Node ident="d1c2b3a4-001" category="dns">
           <idmef:Address category="ipv4-addr">
             <idmef:address>192.168.0.123</idmef:address>
           </idmef:Address>
         </idmef:Node>
       </idmef:Target>
       <idmef:Tool name="nmap" version="3.81" class="portscanner"
                   ostype="Linux" osversion="2.6.12-1.1398_FC4smp">
         <idmef:url>http://www.nmap.org</idmef:url>
         <idmef:arg>-O</idmef:arg>
         <idmef:arg>192.168.0.123</idmef:arg>
         <idmef:Result severity="info" type="automatic">
           <idmef:OS arch="x86" version="2.4.22 - 2.6.3">
             Linux
           </idmef:OS>
           <idmef:CreateTime ntpstamp="0xc694c70c.0xfc87980f">
             2005-07-29T15:17:32Z
           </idmef:CreateTime>
           <idmef:summary>
             Operating System guess
           </idmef:summary>
         </idmef:Result>
       </idmef:Tool>
     </idmef:Asset>
   </idmef:IDMEF-Message>

---

From: "Anton Chuvakin, Ph.D." <[email-masked]>
Date: Fri, 26 Aug 2005 11:27:53 -0400 (EDT)

All,

> I'd like to propose inclusion of additional information within IDMEF:

Here are some comments on the asset document. To make the OS info actually 
useful (which, given the circumstances with IDMEF, might well be an 
optional requirement...), one needs to go beyond arch+version. This level 
of granularity is insufficient for most of the automated correlation 
tasks. What is needed is a well-formed set of OS descriptors, such as:

vendor: MS
os_family: Windows
os_version: 5.1
os_name: 2003
os_service_pack: SP1

All of the above should be normalized.

More comments to follow.

Best,
-- 
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA
Security Strategist
Product Management Group
netForensics -  http://www.netForensics.com
732-393-6071
**************************************************************************************************
The contents of this email and any attachments are confidential.
They are intended for the named recipient(s) only.
If you have received this email in error please notify the system manager or  the 
sender immediately and do not disclose the contents to anyone or make copies.

** This e-mail  has been scanned for viruses, vandals and malicious content. **
**************************************************************************************************