Target
The Target class contains information about the possible target(s) of the event(s) that generated an alert. An event may have more than one target (e.g., in the case of a port sweep).
digraph Target { graph [bb="0,0,1290,1131.5", rankdir=LR ]; node [label="\N"]; Target [height=1.2778, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#65779e" HREF="/idmef_parser/IDMEFv2/Target.html" TITLE="The Target class contains information about the possible target(s) of the event(s) that generated an alert. An event may have more than one target (e.g., in the case of a port sweep). "><FONT FACE="Nimbus Sans L">Target</FONT></td> </tr>" %<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IDMEFv2/Target.html" TITLE="A unique identifier for this target, see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IDMEFv2/Target.html" TITLE="An indication of whether the target is, as far as the analyzer can determine, a decoy. The permitted values for this attribute are shown below. The default value is "unknown". (See also Section 10.)"><FONT FACE="Nimbus Sans L">[ENUM] decoy (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IDMEFv2/Target.html" TITLE="May be used by a network-based analyzer with multiple interfaces to indicate which interface this target was seen on."><FONT FACE="Nimbus Sans L">[STRING] interface (Optional)</FONT></td></tr>%</table>>, pos="100,863", shape=plaintext, width=2.7778]; "Node" [height=1.5694, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#3daf3d" HREF="/idmef_parser/IDMEFv2/Node.html" TITLE="The Node class is used to identify hosts and other network devices (routers, switches, etc.). "><FONT FACE="Nimbus Sans L">Node</FONT></td> </tr>" %<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Node.html" TITLE="The location of the equipment."><FONT FACE="Nimbus Sans L">[STRING] location (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Node.html" TITLE="The name of the equipment. This information MUST be provided if no Address information is given."><FONT FACE="Nimbus Sans L">[STRING] name (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Node.html" TITLE="A unique identifier for the node; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Node.html" TITLE="The "domain" from which the name information was obtained, if relevant. The permitted values for this attribute are shown in the table below. The default value is "unknown". (See also Section 10 for extensions to the table.)"><FONT FACE="Nimbus Sans L">[ENUM] category (Optional)</FONT></td></tr>%</table>>, pos="405.5,1054", shape=plaintext, width=2.6389]; Target -> "Node" [label="0..1", lp="229.5,1005.5", pos="e,310.36,1030.2 134.48,909.28 156.01,935.44 185.72,967.02 218,988 243.09,1004.3 272.69,1017.1 300.87,1027"]; User [height=0.98611, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#52a3cc" HREF="/idmef_parser/IDMEFv2/User.html" TITLE="The User class is used to describe users. It is primarily used as a "container" class for the UserId aggregate class, as shown in Figure 16. "><FONT FACE="Nimbus Sans L">User</FONT></td> </tr>" %<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IDMEFv2/User.html" TITLE="A unique identifier for the user; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IDMEFv2/User.html" TITLE="The type of user represented. The permitted values for this attribute are shown below. The default value is "unknown". (See also Section 10.)"><FONT FACE="Nimbus Sans L">[ENUM] category (Optional)</FONT></td></tr>%</table>>, pos="665,955", shape=plaintext, width=2.6389]; Target -> User [label="0..1", lp="229.5,950.5", pos="e,569.74,966.65 166.95,909.12 194.24,925.32 226.89,941.58 259,950 358.49,976.09 476.47,974.07 559.53,967.5"]; Process [height=2.1528, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca352" HREF="/idmef_parser/IDMEFv2/Process.html" TITLE="The Process class is used to describe processes being executed on sources, targets, and analyzers. "><FONT FACE="Nimbus Sans L">Process</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv2/Process.html" TITLE="The name of the program being executed. This is a short name; path and argument information are provided elsewhere."><FONT FACE="Nimbus Sans L">[STRING] name (1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv2/Process.html" TITLE="The process identifier of the process."><FONT FACE="Nimbus Sans L">[INTEGER] pid (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv2/Process.html" TITLE="The full path of the program being executed."><FONT FACE="Nimbus Sans L">[STRING] path (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv2/Process.html" TITLE="A command-line argument to the program. Multiple arguments may be specified (they are assumed to have occurred in the same order they are provided) with multiple uses of arg."><FONT FACE="Nimbus Sans L">[STRING] arg (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv2/Process.html" TITLE="An environment string associated with the process; generally of the format "VARIABLE=value". Multiple environment strings may be specified with multiple uses of env."><FONT FACE="Nimbus Sans L">[STRING] env (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC66" HREF="/idmef_parser/IDMEFv2/Process.html" TITLE="A unique identifier for the process; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%</table>>, pos="405.5,863", shape=plaintext, width=2.4722]; Target -> Process [label="0..1", lp="229.5,870.5", pos="e,316.32,863 200.03,863 234.02,863 271.97,863 305.92,863"]; Service [height=2.7361, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca3a3" HREF="/idmef_parser/IDMEFv2/Service.html" TITLE="The Service class describes network services on sources and targets. It can identify services by name, port, and protocol. When Service occurs as an aggregate class of Source, it is understood that the service is one from which activity of interest is originating; and that the service is "attached" to the Node, Process, and User information also contained in Source. Likewise, when Service occurs as an aggregate class of Target, it is understood that the service is one to which activity of interest is being directed; and that the service is "attached" to the Node, Process, and User information also contained in Target. If Service occurs in both Source and Target, then information in both locations should be the same. If information is the same in both locations and implementers wish to carry it in only one location, they should specify it as an aggregate of the Target class. "><FONT FACE="Nimbus Sans L">Service</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/Service.html" TITLE="The name of the service. Whenever possible, the name from the IANA list of well-known ports SHOULD be used."><FONT FACE="Nimbus Sans L">[STRING] name (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/Service.html" TITLE="The port number being used."><FONT FACE="Nimbus Sans L">[INTEGER] port (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/Service.html" TITLE="A list of port numbers being used; see Section 3.2.8 for formatting rules. If a portlist is given, the iana_protocol_number and iana_protocol_name MUST apply to all the elements of the list."><FONT FACE="Nimbus Sans L">[PORTLIST] portlist (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/Service.html" TITLE="Additional information about the protocol being used. The intent of the protocol field is to carry additional information related to the protocol being used when the <Service> attributes iana_protocol_number or/and iana_protocol_name are filed."><FONT FACE="Nimbus Sans L">[STRING] protocol (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/Service.html" TITLE="A unique identifier for the service; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/Service.html" TITLE="The IP version number."><FONT FACE="Nimbus Sans L">[INTEGER] ip_version (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/Service.html" TITLE="The IANA protocol number."><FONT FACE="Nimbus Sans L">[INTEGER] iana_protocol_number (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/Service.html" TITLE="The IANA protocol name."><FONT FACE="Nimbus Sans L">[STRING] iana_protocol_name (Optional)</FONT></td></tr>%</table>>, pos="405.5,669", shape=plaintext, width=4.0694]; Target -> Service [label="0..1", lp="229.5,790.5", pos="e,258.87,762.11 172.79,816.78 196.2,801.91 223.1,784.83 250.11,767.68"]; File [height=3.3194, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca300" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="The File class provides specific information about a file or other file-like object that has been created, deleted, or modified on the target. The description can provide either the file settings prior to the event or the file settings at the time of the event, as specified using the "category" attribute. "><FONT FACE="Nimbus Sans L">File</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="The name of the file to which the alert applies, not including the path to the file."><FONT FACE="Nimbus Sans L">[STRING] name (1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="The full path to the file, including the name. The path name should be represented in as "universal" a manner as possible, to facilitate processing of the alert."><FONT FACE="Nimbus Sans L">[STRING] path (1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="Time the file was created. Note that this is *not* the Unix "st_ctime" file attribute (which is not file creation time). The Unix "st_ctime" attribute is contained in the "Inode" class."><FONT FACE="Nimbus Sans L">[DATETIME] create-time (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="Time the file was last modified."><FONT FACE="Nimbus Sans L">[DATETIME] modify-time (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="Time the file was last accessed."><FONT FACE="Nimbus Sans L">[DATETIME] access-time (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="The size of the data, in bytes. Typically what is meant when referring to file size. On Unix UFS file systems, this value corresponds to stat.st_size. On Windows NTFS, this value corresponds to Valid Data Length (VDL)."><FONT FACE="Nimbus Sans L">[INTEGER] data-size (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="The physical space on disk consumed by the file, in bytes. On Unix UFS file systems, this value corresponds to 512 * stat.st_blocks. On Windows NTFS, this value corresponds to End of File (EOF)."><FONT FACE="Nimbus Sans L">[INTEGER] disk-size (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="A unique identifier for this file; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="The type of file system the file resides on. This attribute governs how path names and other attributes are interpreted."><FONT FACE="Nimbus Sans L">[ENUM] category (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/File.html" TITLE="The type of file, as a mime-type."><FONT FACE="Nimbus Sans L">[STRING] file-type (0..1)</FONT></td></tr>%</table>>, pos="405.5,402", shape=plaintext, width=2.9028]; Target -> File [label="0..1", lp="229.5,631.5", pos="e,300.68,508.29 119.72,816.87 146.86,755.74 199.21,645.72 259,561 269.69,545.85 281.71,530.63 294.14,515.93"]; Address [height=2.1528, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#3daf3d" HREF="/idmef_parser/IDMEFv2/Address.html" TITLE="The Address class is used to represent network, hardware, and application addresses. "><FONT FACE="Nimbus Sans L">Address</FONT></td> </tr>" %<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Address.html" TITLE="The address information. The format of this data is governed by the category attribute."><FONT FACE="Nimbus Sans L">[STRING] address (1)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Address.html" TITLE="The network mask for the address, if appropriate."><FONT FACE="Nimbus Sans L">[STRING] netmask (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Address.html" TITLE="A unique identifier for the address; see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Address.html" TITLE="The type of address represented. The permitted values for this attribute are shown below. The default value is "unknown". (See also Section 10.)"><FONT FACE="Nimbus Sans L">[ENUM] category (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Address.html" TITLE="The name of the Virtual LAN to which the address belongs."><FONT FACE="Nimbus Sans L">[STRING] vlan-name (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IDMEFv2/Address.html" TITLE="The number of the Virtual LAN to which the address belongs."><FONT FACE="Nimbus Sans L">[INTEGER] vlan-num (Optional)</FONT></td></tr>%</table>>, pos="923,1054", shape=plaintext, width=2.9861]; "Node" -> Address [label="0..*", lp="665,1061.5", pos="e,815.4,1054 500.72,1054 586.54,1054 713.02,1054 805.18,1054"]; UserId [height=1.8611, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#52a3cc" HREF="/idmef_parser/IDMEFv2/UserId.html" TITLE="The UserId class provides specific information about a user. More than one UserId can be used within the User class to indicate attempts to transition from one user to another, or to provide complete information about a user's (or process') privileges. "><FONT FACE="Nimbus Sans L">UserId</FONT></td> </tr>" %<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IDMEFv2/UserId.html" TITLE="A user or group name."><FONT FACE="Nimbus Sans L">[STRING] name (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IDMEFv2/UserId.html" TITLE="A user or group number."><FONT FACE="Nimbus Sans L">[INTEGER] number (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IDMEFv2/UserId.html" TITLE="A unique identifier for the user id, see Section 3.2.9."><FONT FACE="Nimbus Sans L">[STRING] ident (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IDMEFv2/UserId.html" TITLE="The type of user information represented. The permitted values for this attribute are shown below. The default value is "original-user". (See also Section 10.)"><FONT FACE="Nimbus Sans L">[ENUM] type (Optional)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IDMEFv2/UserId.html" TITLE="The tty the user is using."><FONT FACE="Nimbus Sans L">[STRING] tty (Optional)</FONT></td></tr>%</table>>, pos="1201,735", shape=plaintext, width=2.4722]; User -> UserId [label="1..*", lp="923,958.5", pos="e,1167.7,802.22 760.1,952.93 862.35,949.23 1017.1,938.88 1068,910 1108.1,887.25 1140,847 1162.5,810.83"]; WebService [height=1.5694, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca3a3" HREF="/idmef_parser/IDMEFv2/WebService.html" TITLE="The WebService class carries additional information related to web traffic. "><FONT FACE="Nimbus Sans L">WebService</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/WebService.html" TITLE="The URL in the request."><FONT FACE="Nimbus Sans L">[STRING] url (1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/WebService.html" TITLE="The CGI script in the request, without arguments."><FONT FACE="Nimbus Sans L">[STRING] cgi (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/WebService.html" TITLE="The HTTP method (PUT, GET) used in the request."><FONT FACE="Nimbus Sans L">[STRING] http-method (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/WebService.html" TITLE="The arguments to the CGI script."><FONT FACE="Nimbus Sans L">[STRING] arg (0..*)</FONT></td></tr>%</table>>, pos="923,844", shape=plaintext, width=2.6806]; Service -> WebService [arrowtail=invempty, dir=back, pos="s,552.06,718.56 561.67,721.81 647.78,750.93 751.98,786.17 826.31,811.3"]; SNMPService [height=2.7361, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca3a3" HREF="/idmef_parser/IDMEFv2/SNMPService.html" TITLE="The SNMPService class carries additional information related to SNMP traffic. The aggregate classes composing SNMPService must be interpreted as described in RFC 3411 [15] and RFC 3584 [16]. "><FONT FACE="Nimbus Sans L">SNMPService</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/SNMPService.html" TITLE="The object identifier in the request."><FONT FACE="Nimbus Sans L">[STRING] oid (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/SNMPService.html" TITLE="The SNMP version, typically 0 for SNMPv1, 1 for SNMPv2c, 2 for SNMPv2u and SNMPv2*, and 3 for SNMPv3; see RFC 3411 [15] Section 5 for appropriate values."><FONT FACE="Nimbus Sans L">[INTEGER] messageProcessingModel (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/SNMPService.html" TITLE="The identification of the security model in use, typically 0 for any, 1 for SNMPv1, 2 for SNMPv2c, and 3 for USM; see RFC 3411 [15] Section 5 for appropriate values."><FONT FACE="Nimbus Sans L">[INTEGER] securityModel (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/SNMPService.html" TITLE="The object's security name; see RFC 3411 [15] Section 3.2.2."><FONT FACE="Nimbus Sans L">[STRING] securityName (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/SNMPService.html" TITLE="The security level of the SNMP request; see RFC 3411 [15] Section 3.4.3."><FONT FACE="Nimbus Sans L">[INTEGER] securityLevel (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/SNMPService.html" TITLE="The object's context name; see RFC 3411 [15] Section 3.3.3."><FONT FACE="Nimbus Sans L">[STRING] contextName (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/SNMPService.html" TITLE="The object's context engine identifier; see RFC 3411 [15] Section 3.3.2."><FONT FACE="Nimbus Sans L">[STRING] contextEngineID (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IDMEFv2/SNMPService.html" TITLE="The command sent to the SNMP server (GET, SET, etc.)."><FONT FACE="Nimbus Sans L">[STRING] command (0..1)</FONT></td></tr>%</table>>, pos="923,671", shape=plaintext, width=4.0278]; Service -> SNMPService [arrowtail=invempty, dir=back, pos="s,552.06,669.57 562.09,669.61 630.64,669.87 710.58,670.18 777.77,670.44"]; FileAccess [height=0.69444, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca300" HREF="/idmef_parser/IDMEFv2/FileAccess.html" TITLE="The FileAccess class represents the access permissions on a file. The representation is intended to be useful across operating systems. "><FONT FACE="Nimbus Sans L">FileAccess</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/FileAccess.html" TITLE="Level of access allowed. The permitted values are shown below. There is no default value. (See also Section 10.)"><FONT FACE="Nimbus Sans L">[ENUM] Permission (1..*)</FONT></td></tr>%</table>>, pos="923,529", shape=plaintext, width=2.4028]; File -> FileAccess [label="0..*", lp="665,501.5", pos="e,836.31,511.21 510.09,433.6 529.93,439.29 550.55,444.99 570,450 656.26,472.21 755.29,494.06 826.46,509.13"]; Linkage [height=1.2778, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca300" HREF="/idmef_parser/IDMEFv2/Linkage.html" TITLE="The Linkage class represents file system connections between the file described in the <File> element and other objects in the file system. For example, if the <File> element is a symbolic link or shortcut, then the <Linkage> element should contain the name of the object the link points to. Further information can be provided about the object in the <Linkage> element with another <File> element, if appropriate. "><FONT FACE="Nimbus Sans L">Linkage</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Linkage.html" TITLE="The name of the file system object, not including the path."><FONT FACE="Nimbus Sans L">[STRING] name (1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Linkage.html" TITLE="The full path to the file system object, including the name. The path name should be represented in as "universal" a manner as possible, to facilitate processing of the alert."><FONT FACE="Nimbus Sans L">[STRING] path (1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Linkage.html" TITLE="Section 10.)"><FONT FACE="Nimbus Sans L">[ENUM] category (Optional)</FONT></td></tr>%</table>>, pos="923,440", shape=plaintext, width=2.6389]; File -> Linkage [label="0..*", lp="665,438.5", pos="e,827.8,434.96 510.32,412.74 530.13,414.62 550.69,416.46 570,418 653.13,424.63 747.42,430.42 817.62,434.39"]; Inode [height=2.1528, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca300" HREF="/idmef_parser/IDMEFv2/Inode.html" TITLE="The Inode class is used to represent the additional information contained in a Unix file system i-node. "><FONT FACE="Nimbus Sans L">Inode</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Inode.html" TITLE="The time of the last inode change, given by the st_ctime element of "struct stat"."><FONT FACE="Nimbus Sans L">[DATETIME] change-time (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Inode.html" TITLE="The inode number."><FONT FACE="Nimbus Sans L">[INTEGER] number (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Inode.html" TITLE="The major device number of the device the file resides on."><FONT FACE="Nimbus Sans L">[INTEGER] major-device (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Inode.html" TITLE="The minor device number of the device the file resides on."><FONT FACE="Nimbus Sans L">[INTEGER] minor-device (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Inode.html" TITLE="The major device of the file itself, if it is a character special device."><FONT FACE="Nimbus Sans L">[INTEGER] c-major-device (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Inode.html" TITLE="The minor device of the file itself, if it is a character special device."><FONT FACE="Nimbus Sans L">[INTEGER] c-minor-device (0..1)</FONT></td></tr>%</table>>, pos="923,298", shape=plaintext, width=3.0278]; File -> Inode [label="0..1", lp="665,376.5", pos="e,813.97,319.91 510.22,380.95 595.34,363.85 715.42,339.72 804.13,321.89"]; Checksum [height=1.2778, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca300" HREF="/idmef_parser/IDMEFv2/Checksum.html" TITLE="The Checksum class represents checksum information associated with the file. This checksum information can be provided by file integrity checkers, among others. "><FONT FACE="Nimbus Sans L">Checksum</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Checksum.html" TITLE="The value of the checksum."><FONT FACE="Nimbus Sans L">[STRING] value (1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Checksum.html" TITLE="The key to the checksum, if appropriate."><FONT FACE="Nimbus Sans L">[STRING] key (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCC00" HREF="/idmef_parser/IDMEFv2/Checksum.html" TITLE="default value. (See also Section 10.)"><FONT FACE="Nimbus Sans L">[ENUM] algorithm (Required)</FONT></td></tr>%</table>>, pos="923,156", shape=plaintext, width=2.75]; File -> Checksum [label="0..*", lp="665,318.5", pos="e,823.83,192.2 510.12,343.75 583.83,303.86 685.49,251.12 778,211 789.71,205.92 802.06,200.84 814.4,195.92"]; Stream [height=1.2778, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IDMEFv2/Stream.html" TITLE="The Stram class contains specific information about the content of a file"><FONT FACE="Nimbus Sans L">Stream</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IDMEFv2/Stream.html" TITLE=""><FONT FACE="Nimbus Sans L">[ENUM] offsetunit (Optional)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IDMEFv2/Stream.html" TITLE="Amount of units (determined by the offsetunit attribute) to seek into the File"><FONT FACE="Nimbus Sans L">[INTEGER] offset (Optional)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IDMEFv2/Stream.html" TITLE="Content of the file"><FONT FACE="Nimbus Sans L">[DATA] Data (Required)</FONT></td></tr>%</table>>, pos="923,46", shape=plaintext, width=2.6806]; File -> Stream [label="0..1", lp="665,209.5", pos="e,826.43,73.995 489.83,282.29 513.59,253.71 540.95,224.88 570,202 643.67,143.96 742.3,102.76 816.58,77.326"]; FileAccess -> UserId [label=1, lp="1090,588.5", pos="e,1164.4,667.74 1009.7,539.25 1029.9,544.3 1050.6,551.81 1068,563 1105.2,586.9 1136.2,624.92 1158.8,659.14"]; Linkage -> File [label=1, lp="665,410.5", pos="e,510.17,396.27 827.93,414.72 805.79,409.87 782.2,405.52 760,403 680.29,393.95 589.86,393.86 520.28,395.95"]; }
Aggregates
Node (0..1)
Information about the host or device at which the event(s) (network address, network name, etc.) is being directed.
User (0..1)
Information about the user at which the event(s) is being directed.
Process (0..1)
Information about the process at which the event(s) is being directed.
Service (0..1)
Information about the network service involved in the event(s).
File (0..1)
Information about file(s) involved in the event(s).
Attributes
ident (Optional)
A unique identifier for this target, see Section 3.2.9.
decoy (Optional)
An indication of whether the target is, as far as the analyzer can determine, a decoy. The permitted values for this attribute are shown below. The default value is "unknown". (See also Section 10.)
Rank Keyword Description 0 unknown Accuracy of target information unknown 1 yes Target is believed to be a decoy 2 no Target is believed to be "real"
interface (Optional)
May be used by a network-based analyzer with multiple interfaces to indicate which interface this target was seen on.