System
The System class describes a system or network involved in an event.
digraph System { graph [bb="0,0,1771,879.5", rankdir=LR ]; node [label="\N"]; System [height=4.4861, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#65779e" HREF="/idmef_parser/IODEFv2/System.html" TITLE="The System class describes a system or network involved in an event. "><FONT FACE="Nimbus Sans L">System</FONT></td> </tr>" %<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="The operating system running on the system."><FONT FACE="Nimbus Sans L">[SOFTWARE] OperatingSystem (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="An asset identifier for the System."><FONT FACE="Nimbus Sans L">[STRING] AssetID (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="A free-form text description of the System."><FONT FACE="Nimbus Sans L">[ML_STRING] Description (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="A mechanism by which to extend the data model."><FONT FACE="Nimbus Sans L">[EXTENSION] AdditionalData (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="Classifies the role the host or network played in the incident. These values are maintained in the "System- category" IANA registry per Section 10.2."><FONT FACE="Nimbus Sans L">[ENUM] category (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="A means by which to extend the category attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] ext-category (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="Specifies the interface on which the event(s) on this System originated. If the Node class specifies a network rather than a host, this attribute has no meaning."><FONT FACE="Nimbus Sans L">[STRING] interface (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="An indication of confidence in whether this System was the true target or attacking host. The permitted values for this attribute are shown below. The default value is "unknown"."><FONT FACE="Nimbus Sans L">[ENUM] spoofed (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="Indicates whether this System is a virtual or physical device. The default value is "unknown"."><FONT FACE="Nimbus Sans L">[ENUM] virtual (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="Describes the ownership of this System relative to the victim in the incident. These values are maintained in the "System-ownership" IANA registry per Section 10.2."><FONT FACE="Nimbus Sans L">[ENUM] ownership (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="A means by which to extend the ownership attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] ext-ownership (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="See Section 3.3.1."><FONT FACE="Nimbus Sans L">[ENUM] restriction (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="A means by which to extend the restriction attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] ext-restriction (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#7e95c5" HREF="/idmef_parser/IODEFv2/System.html" TITLE="See Section 3.3.2."><FONT FACE="Nimbus Sans L">[ID] observable-id (0..1)</FONT></td></tr>%</table>>, pos="124.5,407", shape=plaintext, width=3.4583]; "Node" [height=0.69444, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#3daf3d" HREF="/idmef_parser/IODEFv2/Node.html" TITLE="The Node class identifies a system, asset, or network and its location. "><FONT FACE="Nimbus Sans L">Node</FONT></td> </tr>" %<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IODEFv2/Node.html" TITLE="A free-form text description of the physical location of the node. This description may provide a more detailed description of where at the address specified by the PostalAddress class this node is found (e.g., room number, rack number, or slot number in a chassis)."><FONT FACE="Nimbus Sans L">[ML_STRING] Location (0..*)</FONT></td></tr>%</table>>, pos="414,506", shape=plaintext, width=2.7083]; System -> "Node" [label="1..1", lp="278.5,470.5", pos="e,338.01,480.92 249.19,450.88 255.21,452.96 261.17,455.01 267,457 286.89,463.8 308.33,471.02 328.52,477.76"]; Counter [height=0.5, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cc6a51" HREF="/idmef_parser/IODEFv2/Counter.html" TITLE="The Counter class summarizes multiple occurrences of an event or conveys counts or rates of various features. "><FONT FACE="Nimbus Sans L">Counter</FONT></td> </tr>" %</table>>, pos="725,452", shape=plaintext, width=0.98611]; System -> Counter [label="0..*", lp="414,443.5", pos="e,689.28,449.32 249.29,416.35 382.99,426.37 588.22,441.75 679.04,448.56"]; NodeRole [height=0.98611, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#3daf3d" HREF="/idmef_parser/IODEFv2/NodeRole.html" TITLE="The NodeRole class describes the function performed by or role of a particular system, asset, or network. "><FONT FACE="Nimbus Sans L">NodeRole</FONT></td> </tr>" %<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IODEFv2/NodeRole.html" TITLE="A free-form text description of the role of the system."><FONT FACE="Nimbus Sans L">[ML_STRING] Description (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#4cdb4c" HREF="/idmef_parser/IODEFv2/NodeRole.html" TITLE="A means by which to extend the category attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] category (0..1)</FONT></td></tr>%</table>>, pos="414,371", shape=plaintext, width=2.9444]; System -> NodeRole [label="0..*", lp="278.5,396.5", pos="e,307.7,384.22 249.37,391.47 265.32,389.49 281.59,387.47 297.39,385.5"]; Service [height=2.7361, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#cca3a3" HREF="/idmef_parser/IODEFv2/Service.html" TITLE="The Service class describes a network service. The service is described by a protocol, port, protocol header field, and application providing or using the service. "><FONT FACE="Nimbus Sans L">Service</FONT></td> </tr>" %<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IODEFv2/Service.html" TITLE="A port number."><FONT FACE="Nimbus Sans L">[INTEGER] Port (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IODEFv2/Service.html" TITLE="A list of port numbers."><FONT FACE="Nimbus Sans L">[PORTLIST] Portlist (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IODEFv2/Service.html" TITLE="A transport-layer (Layer 4) protocol- specific code field (e.g., ICMP code field)."><FONT FACE="Nimbus Sans L">[INTEGER] ProtoCode (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IODEFv2/Service.html" TITLE="A transport-layer (Layer 4) protocol- specific type field (e.g., ICMP type field)."><FONT FACE="Nimbus Sans L">[INTEGER] ProtoType (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IODEFv2/Service.html" TITLE="A transport-layer (Layer 4) protocol- specific flag field (e.g., TCP flag field)."><FONT FACE="Nimbus Sans L">[INTEGER] ProtoField (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IODEFv2/Service.html" TITLE="The application acting as either the client or the server for the service."><FONT FACE="Nimbus Sans L">[SOFTWARE] Application (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IODEFv2/Service.html" TITLE="The IANA-assigned IP protocol number per [IANA.Protocols]. The attribute MUST be set if a Port, Portlist, ProtoCode, ProtoType, or ProtoField class is present."><FONT FACE="Nimbus Sans L">[INTEGER] ip-protocol (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#FFCCCC" HREF="/idmef_parser/IODEFv2/Service.html" TITLE="See Section 3.3.2."><FONT FACE="Nimbus Sans L">[ID] observable-id (0..1)</FONT></td></tr>%</table>>, pos="414,219", shape=plaintext, width=2.9444]; System -> Service [label="0..*", lp="278.5,320.5", pos="e,307.7,288.03 249.37,325.91 265.92,315.16 282.83,304.18 299.2,293.55"]; DomainData [height=2.7361, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/DomainData.html" TITLE="The DomainData class describes a domain name and metadata associated with this domain. "><FONT FACE="Nimbus Sans L">DomainData</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/DomainData.html" TITLE="The domain name of a system."><FONT FACE="Nimbus Sans L">[STRING] Name (1..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/DomainData.html" TITLE="A timestamp of when the domain listed in the Name class was resolved."><FONT FACE="Nimbus Sans L">[DATETIME] DateDomainWasChecked (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/DomainData.html" TITLE="A timestamp of when domain listed in the Name class was registered."><FONT FACE="Nimbus Sans L">[DATETIME] RegistrationDate (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/DomainData.html" TITLE="A timestamp of when the domain listed in the Name class is set to expire."><FONT FACE="Nimbus Sans L">[DATETIME] ExpirationDate (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/DomainData.html" TITLE="Additional DNS records associated with this domain."><FONT FACE="Nimbus Sans L">[EXTENSION] RelatedDNS (0..*)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/DomainData.html" TITLE="A means by which to extend the system-status attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] system-status (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/DomainData.html" TITLE="A means by which to extend the domain-status attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] domain-status (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/DomainData.html" TITLE="See Section 3.3.2."><FONT FACE="Nimbus Sans L">[ID] observable-id (0..1)</FONT></td></tr>%</table>>, pos="725,643", shape=plaintext, width=4.0556]; "Node" -> DomainData [label="0..*", lp="549.5,577.5", pos="e,578.99,578.68 471.04,531.13 499.05,543.47 534.3,558.99 569.55,574.52"]; Address [height=0.5, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#3daf3d" HREF="/idmef_parser/IODEFv2/Address.html" TITLE="The Address class represents a hardware (Layer 2), network (Layer 3), or application (Layer 7) address. "><FONT FACE="Nimbus Sans L">Address</FONT></td> </tr>" %</table>>, pos="1361.5,821", shape=plaintext, width=1]; "Node" -> Address [label="0..*", lp="900.5,854.5", pos="e,1325.1,828.03 422.54,531.25 441.46,582.82 492.24,699.74 579,751 823.14,895.25 1186.8,851.37 1314.9,829.79"]; PostalAddress [height=1.5694, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#52a3cc" HREF="/idmef_parser/IODEFv2/PostalAddress.html" TITLE="The PostalAddress class specifies a postal address and associated annotation. "><FONT FACE="Nimbus Sans L">PostalAddress</FONT></td> </tr>" %<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/PostalAddress.html" TITLE="A postal address."><FONT FACE="Nimbus Sans L">[POSTAL] PAddress (1..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/PostalAddress.html" TITLE="A free-form text description of the address."><FONT FACE="Nimbus Sans L">[ML_STRING] Description (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/PostalAddress.html" TITLE="Categorizes the type of address described in the PAddress class. These values are maintained in the "PostalAddress-type" IANA registry per Section 10.2."><FONT FACE="Nimbus Sans L">[ENUM] type (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/PostalAddress.html" TITLE="A means by which to extend the type attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] ext-type (0..1)</FONT></td></tr>%</table>>, pos="1657,506", shape=plaintext, width=2.9444]; "Node" -> PostalAddress [label="0..1", lp="1055,513.5", pos="e,1550.7,506 511.7,506 572.97,506 653.59,506 725,506 725,506 725,506 1361.5,506 1420.5,506 1486.2,506 1540.6,506"]; "Node" -> Counter [label="0..*", lp="549.5,484.5", pos="e,689.34,455.73 511.62,482.24 520.52,480.35 529.41,478.57 538,477 585.85,468.23 641.13,461.22 679.11,456.88"]; Nameservers [height=0.69444, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/Nameservers.html" TITLE="The Nameservers class describes the nameservers associated with a given domain. "><FONT FACE="Nimbus Sans L">Nameservers</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/Nameservers.html" TITLE="The domain name of the nameserver."><FONT FACE="Nimbus Sans L">[STRING] Server (1..1)</FONT></td></tr>%</table>>, pos="1055,739", shape=plaintext, width=2.2361]; DomainData -> Nameservers [label="0..*", lp="900.5,703.5", pos="e,974.11,715.47 871.18,685.53 902.94,694.76 935.63,704.27 964.48,712.67"]; DomainContacts [height=0.69444, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/DomainContacts.html" TITLE="The DomainContacts class describes the contact information for a given domain provided either by the registrar or through a whois query. "><FONT FACE="Nimbus Sans L">DomainContacts</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/DomainContacts.html" TITLE="A domain name already cited in this document or through previous exchange that contains the identical contact information as the domain name in question. The domain contact information associated with this domain should be used instead of an explicit definition with the Contact class."><FONT FACE="Nimbus Sans L">[STRING] SameDomainContact (0..1)</FONT></td></tr>%</table>>, pos="1055,643", shape=plaintext, width=3.4722]; DomainData -> DomainContacts [label="0..1", lp="900.5,650.5", pos="e,929.84,643 871.18,643 887.24,643 903.53,643 919.44,643"]; Nameservers -> Address [label="1..*", lp="1209.5,773.5", pos="e,1325.4,820.22 1135.9,738.83 1164.7,742.07 1196.1,749.67 1221,766 1233.4,774.11 1226.9,785.55 1239,794 1261.2,809.46 1290.7,816.27 \ 1315.2,819.19"]; Contact [height=3.0278, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#52a3cc" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="The Contact class describes contact information for organizations and personnel involved in the incident. This class allows for the naming of the involved party, specifying contact information for them, and identifying their role in the incident. "><FONT FACE="Nimbus Sans L">Contact</FONT></td> </tr>" %<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="The name of the contact. The contact may either be an organization or a person. The type attribute disambiguates the semantics."><FONT FACE="Nimbus Sans L">[ML_STRING] ContactName (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="The title for the individual named in the ContactName."><FONT FACE="Nimbus Sans L">[ML_STRING] ContactTitle (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="A free-form text description of the contact."><FONT FACE="Nimbus Sans L">[ML_STRING] Description (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="The timezone in which the contact resides."><FONT FACE="Nimbus Sans L">[TIMEZONE] Timezone (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="A mechanism by which to extend the data model."><FONT FACE="Nimbus Sans L">[EXTENSION] AdditionalData (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="A means by which to extend the role attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] role (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="A means by which to extend the type attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] type (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="See Section 3.3.1."><FONT FACE="Nimbus Sans L">[ENUM] restriction (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Contact.html" TITLE="A means by which to extend the restriction attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] ext-restriction (0..1)</FONT></td></tr>%</table>>, pos="1361.5,643", shape=plaintext, width=3.2361]; DomainContacts -> Contact [label="1..*", lp="1209.5,650.5", pos="e,1244.7,643 1180.1,643 1198,643 1216.5,643 1234.5,643"]; Contact -> Contact [label="0..*", lp="1361.5,777.5", pos="e,1384.7,752.29 1338.3,752.29 1342.9,763.12 1350.7,770 1361.5,770 1368.9,770 1374.9,766.75 1379.5,761.19"]; RegistryHandle [height=0.5, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#52a3cc" HREF="/idmef_parser/IODEFv2/RegistryHandle.html" TITLE="The RegistryHandle class represents a handle into an Internet registry or community-specific database. "><FONT FACE="Nimbus Sans L">RegistryHandle</FONT></td> </tr>" %</table>>, pos="1657,730", shape=plaintext, width=1.5972]; Contact -> RegistryHandle [label="0..*", lp="1513.5,704.5", pos="e,1599.3,717.37 1478.2,683.23 1499.7,690.15 1521.9,697.03 1543,703 1557.9,707.23 1574.1,711.33 1589.4,715.01"]; Contact -> PostalAddress [label="0..*", lp="1513.5,581.5", pos="e,1550.7,555.3 1478.3,588.85 1499.1,579.21 1520.7,569.17 1541.5,559.55"]; Email [height=1.5694, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#52a3cc" HREF="/idmef_parser/IODEFv2/Email.html" TITLE="The Email class specifies an email address and associated annotation. "><FONT FACE="Nimbus Sans L">Email</FONT></td> </tr>" %<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Email.html" TITLE="An email address."><FONT FACE="Nimbus Sans L">[EMAIL] EmailTo (1..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Email.html" TITLE="A free-form text description of the email address."><FONT FACE="Nimbus Sans L">[ML_STRING] Description (0..*)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Email.html" TITLE="Categorizes the type of email address described in the EmailTo class. These values are maintained in the "Email- type" IANA registry per Section 10.2."><FONT FACE="Nimbus Sans L">[ENUM] type (0..1)</FONT></td></tr>%<tr><td BGCOLOR="#66CCFF" HREF="/idmef_parser/IODEFv2/Email.html" TITLE="A means by which to extend the type attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] ext-type (0..1)</FONT></td></tr>%</table>>, pos="1657,637", shape=plaintext, width=2.9444]; Contact -> Email [label="0..*", lp="1513.5,647.5", pos="e,1550.7,639.16 1478.3,640.63 1498.7,640.21 1520,639.78 1540.4,639.37"]; Telephone [height=1.5694, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/Telephone.html" TITLE="The Telephone class describes a telephone number and associated annotation. "><FONT FACE="Nimbus Sans L">Telephone</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/Telephone.html" TITLE="A telephone number."><FONT FACE="Nimbus Sans L">[PHONE] TelephoneNumber (1..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/Telephone.html" TITLE="A free-form text description of the phone number."><FONT FACE="Nimbus Sans L">[ML_STRING] Description (0..*)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/Telephone.html" TITLE="Categorizes the type of telephone number described in the TelephoneNumber class. These values are maintained in the "Telephone-type" IANA registry per Section 10.2."><FONT FACE="Nimbus Sans L">[ENUM] type (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/Telephone.html" TITLE="A means by which to extend the type attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] ext-type (0..1)</FONT></td></tr>%</table>>, pos="1657,823", shape=plaintext, width=3.1667]; Contact -> Telephone [label="0..*", lp="1513.5,751.5", pos="e,1558.6,766.34 1478.3,717.21 1499.7,730.59 1522,744.31 1543,757 1545.2,758.34 1547.5,759.7 1549.8,761.06"]; ServiceName [height=1.2778, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/ServiceName.html" TITLE="The ServiceName class identifies an application protocol. It can be described by referencing an IANA-registered protocol, by referencing a URL, or with free-form text. "><FONT FACE="Nimbus Sans L">ServiceName</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/ServiceName.html" TITLE="The name of the service per the "Service Name" field of the registry [IANA.Ports]."><FONT FACE="Nimbus Sans L">[STRING] IANAService (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/ServiceName.html" TITLE="A URL to a resource describing the service."><FONT FACE="Nimbus Sans L">[URL] URL (0..*)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/ServiceName.html" TITLE="A free-form text description of the service."><FONT FACE="Nimbus Sans L">[ML_STRING] Description (0..*)</FONT></td></tr>%</table>>, pos="725,46", shape=plaintext, width=2.9444]; Service -> ServiceName [label="0..1", lp="549.5,131.5", pos="e,618.68,82.31 520.12,137.05 539.18,124.1 559.27,111.54 579,101 588.7,95.819 599,90.897 609.46,86.283"]; ApplicationHeader [height=0.69444, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/ApplicationHeader.html" TITLE="The ApplicationHeader class describes arbitrary fields from a protocol header and its corresponding value. "><FONT FACE="Nimbus Sans L">ApplicationHeader</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/ApplicationHeader.html" TITLE="A field name and value in a protocol header. The name attribute MUST be set to the field name. The field value MUST be set in the element content."><FONT FACE="Nimbus Sans L">[EXTENSION] ApplicationHeaderField (1..*)</FONT></td></tr>%</table>>, pos="725,371", shape=plaintext, width=3.9444]; Service -> ApplicationHeader [label="0..1", lp="549.5,334.5", pos="e,601.56,345.95 520.38,304.08 539.17,316.44 559.11,328 579,337 583.18,338.89 587.48,340.68 591.86,342.38"]; EmailData [height=3.0278, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="The EmailData class describes headers from an email message and cryptographic hashes and signatures applied to it. "><FONT FACE="Nimbus Sans L">EmailData</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="The value of the "To:" header field (Section 3.6.3 of [RFC5322]) in an email."><FONT FACE="Nimbus Sans L">[EMAIL] EmailTo (0..*)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="The value of the "From:" header field (Section 3.6.2 of [RFC5322]) in an email."><FONT FACE="Nimbus Sans L">[EMAIL] EmailFrom (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="The value of the "Subject:" header field in an email. See Section 3.6.5 of [RFC5322]."><FONT FACE="Nimbus Sans L">[STRING] EmailSubject (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="The value of the "X-Mailer:" header field in an email."><FONT FACE="Nimbus Sans L">[STRING] EmailX-Mailer (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="The header name and value of an arbitrary header field of the email message. The name attribute MUST be set to the header name. The header value MUST be set in the element body. The dtype attribute MUST be set to "string"."><FONT FACE="Nimbus Sans L">[EXTENSION] EmailHeaderField (0..*)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="The headers of an email message."><FONT FACE="Nimbus Sans L">[STRING] EmailHeaders (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="The body of an email message."><FONT FACE="Nimbus Sans L">[STRING] EmailBody (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="The headers and body of an email message."><FONT FACE="Nimbus Sans L">[STRING] EmailMessage (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/EmailData.html" TITLE="See Section 3.3.2."><FONT FACE="Nimbus Sans L">[ID] observable-id (0..1)</FONT></td></tr>%</table>>, pos="725,219", shape=plaintext, width=3.5139]; Service -> EmailData [label="0..1", lp="549.5,226.5", pos="e,598.38,219 520.16,219 542.08,219 565.46,219 588.29,219"]; HashData [height=0.98611, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/HashData.html" TITLE="The HashData class describes different types of hashes on a given object (e.g., file, part of a file, email). "><FONT FACE="Nimbus Sans L">HashData</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/HashData.html" TITLE="An identifier that references a subset of the object being hashed. The semantics of this identifier are specified by the scope attribute."><FONT FACE="Nimbus Sans L">[STRING] HashTargetID (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/HashData.html" TITLE="A means by which to extend the scope attribute. See Section 5.1.1."><FONT FACE="Nimbus Sans L">[STRING] scope (0..1)</FONT></td></tr>%</table>>, pos="1055,269", shape=plaintext, width=2.8194]; EmailData -> HashData [label="0..*", lp="900.5,254.5", pos="e,953.25,253.58 851.64,238.19 881.85,242.77 913.88,247.62 943.36,252.08"]; SignatureData [height=0.69444, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/SignatureData.html" TITLE="The SignatureData class describes different types of digital signatures on an object. "><FONT FACE="Nimbus Sans L">SignatureData</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/SignatureData.html" TITLE="A given signature. See Section 4.2 of [W3C.XMLSIG]."><FONT FACE="Nimbus Sans L">[] Signature (1..*)</FONT></td></tr>%</table>>, pos="1055,190", shape=plaintext, width=1.7222]; EmailData -> SignatureData [label="0..*", lp="900.5,212.5", pos="e,992.76,195.47 851.64,207.87 896.03,203.97 944.33,199.73 982.72,196.35"]; Hash [height=0.98611, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/Hash.html" TITLE="The Hash class describes a cryptographic hash value; the algorithm and application used to generate it; and the canonicalization method applied to the object being hashed. "><FONT FACE="Nimbus Sans L">Hash</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/Hash.html" TITLE="The canonicalization method used on the object being hashed. See Section 4.3.1 of [W3C.XMLSIG]."><FONT FACE="Nimbus Sans L">[] (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/Hash.html" TITLE="The application used to calculate the hash."><FONT FACE="Nimbus Sans L">[SOFTWARE] Application (0..1)</FONT></td></tr>%</table>>, pos="1361.5,319", shape=plaintext, width=2.9444]; HashData -> Hash [label="0..*", lp="1209.5,302.5", pos="e,1255.4,301.69 1156.6,285.58 1185,290.21 1216,295.27 1245.2,300.03"]; FuzzyHash [height=1.2778, label=<<table BORDER="0" CELLBORDER="1" CELLSPACING="0"> <tr> <td BGCOLOR="#CECECE" HREF="/idmef_parser/IODEFv2/FuzzyHash.html" TITLE="The FuzzyHash class describes a fuzzy hash and the application used to generate it. "><FONT FACE="Nimbus Sans L">FuzzyHash</FONT></td> </tr>" %<tr><td HREF="/idmef_parser/IODEFv2/FuzzyHash.html" TITLE="The computed fuzzy hash value."><FONT FACE="Nimbus Sans L">[EXTENSION] FuzzyHashValue (1..*)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/FuzzyHash.html" TITLE="The application used to calculate the hash."><FONT FACE="Nimbus Sans L">[SOFTWARE] Application (0..1)</FONT></td></tr>%<tr><td HREF="/idmef_parser/IODEFv2/FuzzyHash.html" TITLE="Mechanism by which to extend the data model."><FONT FACE="Nimbus Sans L">[EXTENSION] AdditionalData (0..*)</FONT></td></tr>%</table>>, pos="1361.5,219", shape=plaintext, width=3.4028]; HashData -> FuzzyHash [label="0..*", lp="1209.5,253.5", pos="e,1238.8,239.01 1156.6,252.42 1179.8,248.65 1204.7,244.59 1228.9,240.64"]; }
Aggregates
Node (1..1)
A host or network involved in the incident. See Section 3.18.
NodeRole (0..*)
The intended purpose of the system. See Section 3.18.2.
Service (0..*)
A network service running on the system. See Section 3.20.
OperatingSystem (0..*)
The operating system running on the system.
Counter (0..*)
A counter with which to summarize properties of this host or network. See Section 3.18.3.
AssetID (0..*)
An asset identifier for the System.
Description (0..*)
A free-form text description of the System.
AdditionalData (0..*)
A mechanism by which to extend the data model.
category (0..1)
Classifies the role the host or network played in the incident. These values are maintained in the "System- category" IANA registry per Section 10.2.
ext-category (0..1)
A means by which to extend the category attribute. See Section 5.1.1.
interface (0..1)
Specifies the interface on which the event(s) on this System originated. If the Node class specifies a network rather than a host, this attribute has no meaning.
spoofed (0..1)
An indication of confidence in whether this System was the true target or attacking host. The permitted values for this attribute are shown below. The default value is "unknown".
virtual (0..1)
Indicates whether this System is a virtual or physical device. The default value is "unknown".
ownership (0..1)
Describes the ownership of this System relative to the victim in the incident. These values are maintained in the "System-ownership" IANA registry per Section 10.2.
ext-ownership (0..1)
A means by which to extend the ownership attribute. See Section 5.1.1.
restriction (0..1)
See Section 3.3.1.
ext-restriction (0..1)
A means by which to extend the restriction attribute. See Section 5.1.1.
observable-id (0..1)
See Section 3.3.2.