AlternativeID

The AlternativeID class lists the tracking numbers used by CSIRTs, other than the one generating the document, to refer to the identical activity described in the IODEF document. A tracking number listed as an AlternativeID references the same incident detected by another CSIRT. The tracking numbers of the CSIRT that generated the IODEF document must never be considered an AlternativeID.

AlternativeID AlternativeID AlternativeID [ENUM] restriction (0..1) [STRING] ext-restriction (0..1) IncidentID IncidentID AlternativeID->IncidentID 1..*

digraph AlternativeID { graph [bb="0,0,342,71", rankdir=LR ]; node [label="\N"]; AlternativeID [height=0.98611, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#90ac3d" HREF="/idmef_parser/IODEFv2/AlternativeID.html" TITLE="The AlternativeID class lists the tracking numbers used by CSIRTs, other than the one generating the document, to refer to the identical activity described in the IODEF document. A tracking number listed as an AlternativeID references the same incident detected by another CSIRT. The tracking numbers of the CSIRT that generated the IODEF document must never be considered an AlternativeID. "><FONT FACE="Nimbus Sans L">AlternativeID</FONT></td> </tr>" %<tr><td BGCOLOR="#b4d74c" HREF="/idmef_parser/IODEFv2/AlternativeID.html" TITLE="See Section 3.3.1."><FONT FACE="Nimbus Sans L">[ENUM] restriction (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#b4d74c" HREF="/idmef_parser/IODEFv2/AlternativeID.html" TITLE="A means by which to extend the restriction attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] ext-restriction (0..1)</FONT></td></tr>%</table>>, pos="100,35.5", shape=plaintext, width=2.7778]; IncidentID [height=0.5, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#90ac3d" HREF="/idmef_parser/IODEFv2/IncidentID.html" TITLE="The IncidentID class represents a tracking number that is unique in the context of the CSIRT. It serves as an identifier for an incident or a document identifier when sharing indicators. This identifier would serve as an index into a CSIRT&#39;s incident handling or knowledge management system. "><FONT FACE="Nimbus Sans L">IncidentID</FONT></td> </tr>" %</table>>, pos="300.5,35.5", shape=plaintext, width=1.1528]; AlternativeID -> IncidentID [label="1..*", lp="229.5,43", pos="e,258.96,35.5 200.25,35.5 217.11,35.5 233.98,35.5 248.93,35.5"]; }


Aggregates

IncidentID (1..*)

The tracking number of another CSIRT. See Section 3.4.

restriction (0..1)

See Section 3.3.1.

ext-restriction (0..1)

A means by which to extend the restriction attribute. See Section 5.1.1.



IDMEFv1


IDMEFv2


IODEFv1


IODEFv2