Analyzer
The Analyzer class identifies the analyzer from which the Alert or Heartbeat message originates. Only one analyzer may be encoded for each alert or heartbeat, and that MUST be the analyzer at which the alert or heartbeat originated. Although the IDMEF data model does not prevent the use of hierarchical intrusion detection systems (where alerts get relayed up the tree), it does not provide any way to record the identity of the "relay" analyzers along the path from the originating analyzer to the manager that ultimately receives the alert.
digraph Analyzer { graph [bb="0,0,757,309", rankdir=LR ]; node [label="\N"]; Analyzer [height=2.7361, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cccc52" HREF="/idmef_parser/IDMEFv1/Analyzer.html" TITLE="The Analyzer class identifies the analyzer from which the Alert or Heartbeat message originates. Only one analyzer may be encoded for each alert or heartbeat, and that MUST be the analyzer at which the alert or heartbeat originated. Although the IDMEF data model does not prevent the use of hierarchical intrusion detection systems (where alerts get relayed up the tree), it does not provide any way to record the identity of the "relay" analyzers along the path from the originating analyzer to the manager that ultimately receives the alert. "><FONT FACE="Nimbus Sans L">Analyzer</FONT></td> </tr>" %<tr><td BGCOLOR="#FFFF66" HREF="/idmef_parser/IDMEFv1/Analyzer.html" TITLE="(but see below). A unique identifier for the analyzer; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] analyzerid (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFFF66" HREF="/idmef_parser/IDMEFv1/Analyzer.html" TITLE="An explicit name for the analyzer that may be easier to understand than the analyzerid."><FONT FACE="Nimbus Sans L">[STRING] name (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFFF66" HREF="/idmef_parser/IDMEFv1/Analyzer.html" TITLE="The manufacturer of the analyzer software and/or hardware."><FONT FACE="Nimbus Sans L">[STRING] manufacturer (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFFF66" HREF="/idmef_parser/IDMEFv1/Analyzer.html" TITLE="The model name/number of the analyzer software and/or hardware."><FONT FACE="Nimbus Sans L">[STRING] model (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFFF66" HREF="/idmef_parser/IDMEFv1/Analyzer.html" TITLE="The version number of the analyzer software and/or hardware."><FONT FACE="Nimbus Sans L">[STRING] version (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFFF66" HREF="/idmef_parser/IDMEFv1/Analyzer.html" TITLE="The class of analyzer software and/or hardware."><FONT FACE="Nimbus Sans L">[STRING] class (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFFF66" HREF="/idmef_parser/IDMEFv1/Analyzer.html" TITLE="Operating system name. On POSIX 1003.1 compliant systems, this is the value returned in utsname.sysname by the uname() system call, or the output of the "uname -s" command."><FONT FACE="Nimbus Sans L">[STRING] ostype (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFFF66" HREF="/idmef_parser/IDMEFv1/Analyzer.html" TITLE="Operating system version. On POSIX 1003.1 compliant systems, this is the value returned in utsname.release by the uname() system call, or the output of the "uname -r" command."><FONT FACE="Nimbus Sans L">[STRING] osversion (Optional)</FONT></td></tr>%</table>>, pos="114.5,98.5", shape=plaintext, width=3.1806]; Analyzer -> Analyzer [label="0..1", lp="114.5,222.5", pos="e,137.21,197.09 91.786,197.09 96.101,207.97 103.67,215 114.5,215 121.94,215 127.85,211.68 132.21,206.07"]; "Node" [height=1.5694, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#3daf3d" HREF="/idmef_parser/IDMEFv1/Node.html" TITLE="The Node class is used to identify hosts and other network devices (routers, switches, etc.). "><FONT FACE="Nimbus Sans L">Node</FONT></td> </tr>" %<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Node.html" TITLE="The location of the equipment."><FONT FACE="Nimbus Sans L">[STRING] location (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Node.html" TITLE="The name of the equipment. This information MUST be provided if no Address information is given."><FONT FACE="Nimbus Sans L">[STRING] name (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Node.html" TITLE="A unique identifier for the node; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Node.html" TITLE="The "domain" from which the name information was obtained, if relevant. The permitted values for this attribute are shown in the table below. The default value is "unknown". (See also Section 10 for extensions to the table.)"><FONT FACE="Nimbus Sans L">[ENUM] category (Optional)</FONT></td></tr>%</table>>, pos="385.5,231.5", shape=plaintext, width=2.7083]; Analyzer -> "Node" [label="0..1", lp="258.5,181", pos="e,287.65,183.48 229.04,154.71 245.49,162.79 262.37,171.07 278.66,179.07"]; Process [height=2.1528, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca352" HREF="/idmef_parser/IDMEFv1/Process.html" TITLE="The Process class is used to describe processes being executed on sources, targets, and analyzers. "><FONT FACE="Nimbus Sans L">Process</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv1/Process.html" TITLE="The name of the program being executed. This is a short name; path and argument information are provided elsewhere."><FONT FACE="Nimbus Sans L">[STRING] name (Required)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv1/Process.html" TITLE="The process identifier of the process."><FONT FACE="Nimbus Sans L">[INTEGER] pid (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv1/Process.html" TITLE="The full path of the program being executed."><FONT FACE="Nimbus Sans L">[STRING] path (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv1/Process.html" TITLE="A command-line argument to the program. Multiple arguments may be specified (they are assumed to have occurred in the same order they are provided) with multiple uses of arg."><FONT FACE="Nimbus Sans L">[STRING] arg (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv1/Process.html" TITLE="An environment string associated with the process; generally of the format "VARIABLE=value". Multiple environment strings may be specified with multiple uses of env."><FONT FACE="Nimbus Sans L">[STRING] env (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv1/Process.html" TITLE="A unique identifier for the process; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%</table>>, pos="385.5,79.5", shape=plaintext, width=2.5972]; Analyzer -> Process [label="0..1", lp="258.5,97", pos="e,291.86,86.065 229.04,90.47 246.55,89.242 264.53,87.981 281.79,86.771"]; Address [height=2.1528, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#3daf3d" HREF="/idmef_parser/IDMEFv1/Address.html" TITLE="The Address class is used to represent network, hardware, and application addresses. "><FONT FACE="Nimbus Sans L">Address</FONT></td> </tr>" %<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Address.html" TITLE="The address information. The format of this data is governed by the category attribute."><FONT FACE="Nimbus Sans L">[STRING] address (Required)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Address.html" TITLE="The network mask for the address, if appropriate."><FONT FACE="Nimbus Sans L">[STRING] netmask (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Address.html" TITLE="A unique identifier for the address; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Address.html" TITLE="The type of address represented. The permitted values for this attribute are shown below. The default value is "unknown". (See also Section 10.)"><FONT FACE="Nimbus Sans L">[ENUM] category (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Address.html" TITLE="The name of the Virtual LAN to which the address belongs."><FONT FACE="Nimbus Sans L">[STRING] vlan-name (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv1/Address.html" TITLE="The number of the Virtual LAN to which the address belongs."><FONT FACE="Nimbus Sans L">[INTEGER] vlan-num (Optional)</FONT></td></tr>%</table>>, pos="649.5,231.5", shape=plaintext, width=2.9861]; "Node" -> Address [label="0..*", lp="512.5,239", pos="e,541.68,231.5 483.05,231.5 498.87,231.5 515.39,231.5 531.62,231.5"]; }
Aggregates
Node (0..1)
Information about the host or device on which the analyzer resides (network address, network name, etc.).
Process (0..1)
Information about the process in which the analyzer is executing.
Analyzer (0..1)
Information about the analyzer from which the message may have gone through. The idea behind this mechanism is that when a manager receives an alert and wants to forward it to another analyzer, it needs to substitute the original analyzer
Attributes
analyzerid (Optional)
(but see below). A unique identifier for the analyzer; see Section 3.2.9.
name (Optional)
An explicit name for the analyzer that may be easier to understand than the analyzerid.
manufacturer (Optional)
The manufacturer of the analyzer software and/or hardware.
model (Optional)
The model name/number of the analyzer software and/or hardware.
version (Optional)
The version number of the analyzer software and/or hardware.
class (Optional)
The class of analyzer software and/or hardware.
ostype (Optional)
Operating system name. On POSIX 1003.1 compliant systems, this is the value returned in utsname.sysname by the uname() system call, or the output of the "uname -s" command.
osversion (Optional)
Operating system version. On POSIX 1003.1 compliant systems, this is the value returned in utsname.release by the uname() system call, or the output of the "uname -r" command.