Skip to content

IDMEFv2 : JSON Alerts Examples

Jump to bottom
Gilles Lehmann edited this page Nov 22, 2022 · 7 revisions

Table of content (WORK IN PROGRESS)

1 Cyber detection

  • 1.1 Malicious content detected by a system acting as both an analyzer and sensor
  • 1.2 Cyber detection: Unknown IP Protocol detected
  • 1.3 Cyber detection: Enrichment AD
  • 1.4 Enrichment based on Cyber-Threat Intelligence data

2 Physical detection

  • 2.1 First physical intrusion detected by a detector+sensor "all in one"
  • 2.2 First physical intrusion detected by a couple detector + sensor
  • 2.3 Second physical intrusion detected by the same couple
  • 2.4 Multiple physical vectors detected at once by a single sensor
  • 2.5 Separate sensors detect separate vectors during the same timeframe
  • 2.6 Different detections for the same vectors depending on the sensor

2 Physical PTI

  • 2.1 PTI alert created the Monday announcing a storm from Tuesday 16h to Wednesday 20h
  • 2.2 PTI alert update of the same storm on Tuesday morning

4 Cyber Correlation / aggregation: enrichment

  • 4.1 N Alert for Single authentication failed
  • 4.2 Aggregation (condition) of a password brute force attack
  • 4.3 Authentication failure for SSH service
  • 4.4 Authentication failure for HTTP service
  • 4.5 Authentication failure for SMTP service
  • 4.6 Multiple authentication failures (password spraying attack)
  • 4.7 Single authentication failed detected by detector
  • 4.8 Correlator analyze the alert and add CTI on IP source

5 Physical correlation / aggregation

  • 5.1 Physical correlation / aggregation Alert 1 : Drone detection
  • 5.2 Physical correlation / aggregation Alert 2 : Drone detection
  • 5.3 Physical correlation / aggregation Alert 3 : Drone detection
  • 5.4 Aggregation (liste ?) : Drone moving in area
  • 5.5 update of the alert

6 Availability

  • 6.1 Abnormal temperature detected in a server
  • 6.2 Device stopped responding to ICMP PING solicitations
  • 6.3 Alert on external temperature planned to be high AND temperature high in DataCenter

1 Physical detection

1.1 First physical intrusion detected by a couple sensor + analyser

Detection system : A central “CCTV Manager” (analyser) connected to different cameras (sensors)
The sensors send images (data) to the analyser which run “AI” algorythm (method) on it.
The Vector detected is a Human (Category) working toward (or in) the “Front Garden” (Target)
The sensor capture zone is defined by : type, azimuth, elevation, range, horizontal and vertical field of view.

{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fefb1", 
  "Status": "Incident", 
  "Entity": "Springfield Nuclear Power Plant", 
  "CreateTime": "2021-01-18T23:33:05.21Z", 
  "StartTime": "2021-01-18T23:33:04.52Z", 
  "Cause": "Malicious", 
  "Category": [
    "Intrusion.Burglary"
  ], 
  "Severity": "Medium", 
  "Confidence": 0.9, 
  "Description": "Physical intrusion detected", 
  "Analyzer": {
    "IP": "172.10.5.31", 
    "Name": "Cam+ CCTV Manager",
    "Type": "Physical",
    "Model": "Cam Center 42B", 
    "Category": [ "HAR" ], 
    "Data": [ "Images" ], 
    "Method": [ "AI" ], 
    "GeoLocation": "+44.046204,-123.023346,+65.1", 
    "UnLocation": "US SPY" 
  }, 
  "Sensor": [
    {
      "IP": "172.10.5.63", 
      "Hostname": "camera3.Spring-npp.com",
      "Name": "Front door camera",
      "Location": "Front Door",
      "Model": "Cam+ Field 4.6",       
      "CaptureZone": "{\"type\":\"conic-zone\",\"Azimuth\":34.00,\"El\u00e9vation\": 30.00,\"Range\":600.00,\"HFOV\":200.00,\"VFOV\":20.00}"
    }
  ], 
  "Target": [
    {
      "Location": "Front Garden"
    }
  ], 
  "Vector": [
    {
      "Category": [ "Human" ] , 
      "Name": "Unknown", 
      "Size": "Medium" 
    }
  ], 
  "Observable": [ 
    {
      "Name": "PTZRelativePosition", 
      "Reference": "IDMEFv2", 
      "Content": "{\"type\":\"PTZ\",\"Pan\":34.00,\"Tilt\":-30.00,\"Zoom\":18.00}"
    }
  ]
}

1.2 First physical intrusion detected by a couple detector + sensor

{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fefb1", 
  "Description": "Physical intrusion detected", 
  "Cause": "Malicious", 
  "Category": [
    "Intrusions.Burglary"
  ], 
  "Severity": "Medium", 
  "Confidence": 0.9, 
  "CreateTime": "2021-01-18T23:33:05.21Z", 
  "StartTime": "2021-01-18T23:33:04.52Z", 
  "Analyzer": {
    "IP": "1.1.1.1", 
    "Name": "Motion detector", 
    "Hostname": "analyzer.acme.eu", 
    "Model": "MD 9.9.3", 
    "Category": [
      "MWIR", 
      "HAR"
    ], 
    "Data": [
      "Images", 
      "Thermic"
    ], 
    "Method": [
      "Movement", 
      "Heat"
    ]
  }, 
  "Sensor": [
    {
      "IP": "1.1.1.2", 
      "Name": "Infrared camera 42", 
      "Model": "IC 3.5.2", 
      "UnLocation": "GR ATH", 
      "Location": "Front Door"
    }
  ], 
  "Vector": [
    {
      "Category": [
        "human"
      ], 
      "Attachment": [
        "attach1"
      ], 
      "Observable": [
        "obs1"
      ]
    }
  ], 
  "Attachment": [
    {
      "Name": "attach1", 
      "FileName": "img2021011823330521.jpg", 
      "ExternalURI": "https://data.acme.eu/img2021011823330521.jpg", 
      "ContentType": "image/jpeg"
    }
  ], 
  "Observable": [
    {
      "Name": "obs1", 
      "Content": "{\"Xmin\": 34, \"Xmax\": 120, \"Ymin\": 101, \"Ymax\": 369}"
    }
  ]
}

1.3 Second physical intrusion detected by the same couple

{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fefb2", 
  "Cause": "Malicious", 
  "Category": [
    "Intrusions.Burglary"
  ], 
  "Severity": "Medium", 
  "Confidence": 0.9, 
  "Description": "Physical intrusion detected", 
  "CreateTime": "2021-01-18T23:34:05.21Z", 
  "StartTime": "2021-01-18T23:34:04.52Z", 
  "Analyzer": {
    "IP": "1.1.1.1", 
    "Name": "Motion detector"
  }, 
  "Sensor": [
    {
      "IP": "1.1.1.2", 
      "Name": "Infrared camera 42"
    }
  ], 
  "Vector": [
    {
      "Category": [
        "human"
      ], 
      "Attachment": [
        "attach1"
      ], 
      "Observable": [
        "obs1"
      ]
    }
  ], 
  "Attachment": [
    {
      "Name": "attach1", 
      "FileName": "img2021011823340521.jpg", 
      "ExternalURI": "https://data.acme.eu/img2021011823340521.jpg", 
      "ContentType": "image/jpeg"
    }
  ], 
  "Observable": [
    {
      "Name": "obs1", 
      "Content": "{\"Xmin\": 22, \"Xmax\": 100, \"Ymin\": 501, \"Ymax\": 692}"
    }
  ]
}

1.4 Multiple physical vectors detected at once by a single sensor

A security camera filmed 2 persons intruding into facility grounds. The camera's management server detects the intruders and sends an alert with a link to a still image where both intruders are visible.

{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fef00", 
  "Status": "Incident", 
  "Entity": "ACME", 
  "CreateTime": "2021-01-18T23:33:05.21Z", 
  "StartTime": "2021-01-18T23:33:04.52Z", 
  "Category": [
    "Other.Undetermined"
  ], 
  "Confidence": 0.8, 
  "Severity": "Low", 
  "Description": "Several ground objects detected near the main building", 
  "Analyzer": {
    "IP": "172.10.5.1", 
    "Name": "Security Center", 
    "Hostname": "sec-center.example.com", 
    "Type": "Physical", 
    "Model": "Security Center v5.7", 
    "UnLocation": "GR ATH", 
    "Location": "Security Office"
  }, 
  "Sensor": {
    "IP": "172.10.5.31", 
    "Name": "Front door camera", 
    "Hostname": "camera1.example.com", 
    "Model": "Netatmo 42B", 
    "GeoLocation": "+48.75726,+2.299528,+65.1", 
    "UnLocation": "GR ATH", 
    "Location": "Front Door"
  }, 
  "Target": [
    {
      "Location": "Northern Hallway"
    }
  ], 
  "Vector": [
    {
      "Category": [
        "man"
      ], 
      "Name": "Intruder #1", 
      "Size": "medium", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "GeoRadius": 42.5, 
      "Location": "Northern Hallway", 
      "Attachment": [
        "attach1"
      ]
    }, 
    {
      "Category": [
        "human"
      ], 
      "Name": "Intruder #2", 
      "Size": "medium", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "GeoRadius": 42.5, 
      "Location": "Northern Hallway", 
      "Attachment": [
        "attach1"
      ]
    }
  ], 
  "Attachment": [
    {
      "Name": "attach1", 
      "FileName": "c1-2021.04.12-64216343.jpg", 
      "Hash": "sha-256: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b", 
      "Size": 2132078, 
      "ExternalURI": "https://sec-center.example.com/archive?sensor=c1&ref=2021.04.12-64216343", 
      "Note": "Still image from 'Front Door Camera' depicting Intruder #1 and Intruder #2", 
      "ContentType": "image/jpeg"
    }
  ]
}

 

1.5 Separate sensors detect separate vectors during the same timeframe

Three separate sensors (3 cameras) detect one vector each. These detections occurred during the same timeframe. Therefore, a correlation engine dedicated to physical sensors could try to infer an incident (e.g. protesters marching toward a building) from these individual alerts.

{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fef90", 
  "Status": "Incident", 
  "Entity": "ACME", 
  "CreateTime": "2021-01-19T23:33:05.21Z", 
  "StartTime": "2021-01-19T23:33:04.52Z", 
  "Category": [
    "Other.Undetermined"
  ], 
  "Confidence": 0.9, 
  "Severity": "Low", 
  "Description": "Single object detected near the facilities", 
  "Analyzer": {
    "IP": "172.10.5.1", 
    "Name": "Security Center", 
    "Hostname": "sec-center.example.com", 
    "Type": "Physical", 
    "Model": "Security Center v5.7", 
    "UnLocation": "GR ATH", 
    "Location": "Security Office"
  }, 
  "Sensor": [
    {
      "IP": "172.10.5.31", 
      "Name": "Front door camera", 
      "Hostname": "camera1.example.com", 
      "Model": "Netatmo 42B", 
      "GeoLocation": "+48.75726,+2.299528,+65.1", 
      "UnLocation": "GR ATH", 
      "Location": "Front Door"
    }
  ], 
  "Target": [
    {
      "Location": "Entryway"
    }
  ], 
  "Vector": [
    {
      "Category": [
        "man"
      ], 
      "Name": "Detected #1", 
      "Size": "Medium", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.09", 
      "GeoRadius": 42.5, 
      "Location": "Entryway", 
      "Attachment": [
        "attach1"
      ]
    }
  ], 
  "Attachment": [
    {
      "Name": "attach1", 
      "FileName": "c1-2021.01.19-64216341.jpg", 
      "Hash": "sha-256: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b", 
      "Size": 2132078, 
      "ExternalURI": "https://sec-center.example.com/archive?sensor=c1&ref=2021.01.19-64216341", 
      "Note": "Still image showing vector #1", 
      "ContentType": "image/jpeg"
    }
  ]
}
{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fef91", 
  "Status": "Incident", 
  "Entity": "ACME", 
  "CreateTime": "2021-01-19T23:33:06.21Z", 
  "StartTime": "2021-01-19T23:33:05.52Z", 
  "Category": [
    "Other.Undetermined"
  ], 
  "Confidence": 0.9, 
  "Severity": "Low", 
  "Description": "Single object detected near the facilities", 
  "Analyzer": {
    "IP": "172.10.5.1", 
    "Name": "Security Center", 
    "Hostname": "sec-center.example.com", 
    "Type": "Physical", 
    "Model": "Security Center v5.7", 
    "UnLocation": "GR ATH", 
    "Location": "Security Office"
  }, 
  "Sensor": [
    {
      "IP": "172.10.5.32", 
      "Name": "Northern hallway camera", 
      "Hostname": "camera2.example.com", 
      "Model": "Netatmo 42B", 
      "GeoLocation": "+48.75726,+2.299529,+65.1", 
      "UnLocation": "GR ATH", 
      "Location": "Northern Hallway"
    }
  ], 
  "Target": [
    {
      "Location": "Northern Hallway"
    }
  ], 
  "Vector": [
    {
      "Category": [
        "human"
      ], 
      "Name": "Detected #1", 
      "Size": "medium", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "GeoRadius": 42.5, 
      "Location": "Entryway", 
      "Attachment": [
        "attach1"
      ]
    }
  ], 
  "Attachment": [
    {
      "Name": "attach1", 
      "FileName": "c1-2021.01.19-64216342.jpg", 
      "Hash": "sha-256: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b", 
      "Size": 2132078, 
      "ExternalURI": "https://sec-center.example.com/archive?sensor=c1&ref=2021.01.19-64216342", 
      "Note": "Still image showing vector #1", 
      "ContentType": "image/jpeg"
    }
  ]
}
{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fef83", 
  "Status": "Incident", 
  "Entity": "ACME", 
  "CreateTime": "2021-01-19T23:33:07.21Z", 
  "StartTime": "2021-01-19T23:33:06.52Z", 
  "Category": [
    "Other.Undetermined"
  ], 
  "Confidence": 0.9, 
  "Severity": "Low", 
  "Description": "Single object detected near the facilities", 
  "Analyzer": {
    "IP": "172.10.5.1", 
    "Name": "Security Center", 
    "Hostname": "sec-center.example.com", 
    "Type": "Physical", 
    "Model": "Security Center v5.7", 
    "UnLocation": "GR ATH", 
    "Location": "Security Office"
  }, 
  "Sensor": [
    {
      "IP": "172.10.5.33", 
      "Name": "Back door camera", 
      "Hostname": "camera3.example.com", 
      "Model": "Netatmo 42B", 
      "GeoLocation": "+48.75727,+2.299528,+65.12", 
      "UnLocation": "GR ATH", 
      "Location": "Back Door"
    }
  ], 
  "Target": [
    {
      "Location": "Back Door"
    }
  ], 
  "Vector": [
    {
      "Category": [
        "woman"
      ], 
      "Name": "Detected #1", 
      "Size": "Medium", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "GeoRadius": 42.5, 
      "Location": "Entryway", 
      "Attachment": [
        "attach1"
      ]
    }
  ], 
  "Attachment": [
    {
      "Name": "attach1", 
      "FileName": "c1-2021.01.19-64216343.jpg", 
      "Hash": "sha-256: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b", 
      "Size": 2132078, 
      "ExternalURI": "https://sec-center.example.com/archive?sensor=c1&ref=2021.01.19-64216343", 
      "Note": "Still image showing vector #1", 
      "ContentType": "image/jpeg"
    }
  ]
}

 

1.6 Different detections for the same vectors depending on the sensor

Separate sensors (a heat detector, a sound detector and a camera) detect the same vectors (2 men & 1 woman). Due to the way it works, the heat detector cannot identify each vector individually (it only detects a massive heat source compared to the surrounding environment). The sound detector detects only 2 vectors (2 men speaking to each other while the woman stayed quiet). The camera detects all 3 of them successfully.

{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fef81", 
  "Status": "Incident", 
  "Entity": "ACME", 
  "CreateTime": "2021-01-18T23:33:05.21Z", 
  "StartTime": "2021-01-18T23:33:04.52Z", 
  "Category": [
    "Other.Undetermined"
  ], 
  "Severity": "Low", 
  "Confidence": 0.9, 
  "Description": "Heat source detected in closed building", 
  "Analyzer": {
    "IP": "172.10.5.1", 
    "Name": "Security Center", 
    "Hostname": "sec-center.example.com", 
    "Type": "Physical", 
    "Model": "Security Center v5.7", 
    "UnLocation": "GR ATH", 
    "Location": "Security Office"
  }, 
  "Sensor": [
    {
      "IP": "172.10.5.32", 
      "Name": "Heat sensor #1", 
      "Hostname": "heat1.example.com", 
      "Model": "Heatty 123", 
      "GeoLocation": "+48.75726,+2.299528,+65.1", 
      "UnLocation": "GR ATH", 
      "Location": "Northern Hallway"
    }
  ], 
  "Target": [
    {
      "Location": "Northern Hallway"
    }
  ], 
  "Vector": [
    {
      "Category": [
        "High temperature"
      ], 
      "Name": "Heat source", 
      "Size": "large", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "GeoRadius": 37, 
      "Location": "Northern Hallway"
    }
  ]
}
{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fef82", 
  "Status": "Incident", 
  "Entity": "ACME", 
  "CreateTime": "2021-01-18T23:33:05.21Z", 
  "StartTime": "2021-01-18T23:33:04.52Z", 
  "Category": [
    "Other.Undetermined"
  ], 
  "Confidence": 0.7, 
  "Severity": "Low", 
  "Description": "Human voices detected in closed building", 
  "Analyzer": {
    "IP": "172.10.5.1", 
    "Name": "Security Center", 
    "Hostname": "sec-center.example.com", 
    "Type": "Physical", 
    "Model": "Security Center v5.7", 
    "UnLocation": "GR ATH", 
    "Location": "Security Office"
  }, 
  "Sensor": [
    {
      "IP": "172.10.5.32", 
      "Name": "Sound detector #1", 
      "Hostname": "sound1.example.com", 
      "Model": "Soundly 123", 
      "GeoLocation": "+48.75726,+2.299528,+65.1", 
      "UnLocation": "GR ATH", 
      "Location": "Northern Hallway"
    }
  ], 
  "Target": [
    {
      "Location": "Northern Hallway"
    }
  ], 
  "Vector": [
    {
      "Category": [
        "man"
      ], 
      "Name": "Man #1", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "Location": "Northern Hallway", 
      "Attachment": [
        "attach1"
      ]
    }, 
    {
      "Category": [
        "man"
      ], 
      "Name": "Man #2", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "Location": "Northern Hallway", 
      "Attachment": [
        "attach1"
      ]
    }
  ], 
  "Attachment": [
    {
      "Name": "attach1", 
      "FileName": "s1-2021.04.12-987449.wav", 
      "Hash": "sha-256: 02aa4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805dbea8602", 
      "Size": 210986, 
      "ExternalURI": "https://sec-center.example.com/archive?sensor=s1&ref= 2021.04.12-987449", 
      "Note": "Audio recording where 2 human voices can be heard", 
      "ContentType": "audio/x-wav"
    }
  ]
}
{
  "Version": "2.0.3", 
  "ID": "e5f9bbae-163e-42f9-a2f2-0daaf78fef83", 
  "Status": "Incident", 
  "Entity": "ACME", 
  "CreateTime": "2021-01-18T23:33:05.21Z", 
  "StartTime": "2021-01-18T23:33:04.52Z", 
  "Category": [
    "Other.Undetermined"
  ], 
  "Confidence": 0.9, 
  "Severity": "Medium", 
  "Description": "Several ground objects detected near the main building", 
  "Analyzer": {
    "IP": "172.10.5.1", 
    "Name": "Security Center", 
    "Hostname": "sec-center.example.com", 
    "Type": "Physical", 
    "Model": "Security Center v5.7", 
    "UnLocation": "GR ATH", 
    "Location": "Security Office"
  }, 
  "Sensor": [
    {
      "IP": "172.10.5.31", 
      "Name": "Front door camera", 
      "Hostname": "camera1.example.com", 
      "Model": "Netatmo 42B", 
      "GeoLocation": "+48.75726,+2.299528,+65.1", 
      "UnLocation": "GR ATH", 
      "Location": "Front Door"
    }
  ], 
  "Target": [
    {
      "Location": "Northern Hallway"
    }
  ], 
  "Vector": [
    {
      "Category": [
        "man"
      ], 
      "Name": "Intruder #1", 
      "Size": "Medium", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "GeoRadius": 42.5, 
      "Location": "Northern Hallway", 
      "Attachment": [
        "attach1"
      ]
    }, 
    {
      "Category": [
        "man"
      ], 
      "Name": "Intruder #2", 
      "Size": "Medium", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "GeoRadius": 42.5, 
      "Location": "Northern Hallway", 
      "Attachment": [
        "attach1"
      ]
    }, 
    {
      "Category": [
        "woman"
      ], 
      "Name": "Intruder #3", 
      "Size": "small", 
      "UnLocation": "GR ATH", 
      "GeoLocation": "+48.75726, +2.299528, +65.1", 
      "GeoRadius": 42.5, 
      "Location": "Northern Hallway", 
      "Attachment": [
        "attach1"
      ]
    }
  ], 
  "Attachment": [
    {
      "Name": "attach1", 
      "FileName": "c1-2021.04.12-64216343.jpg", 
      "Hash": "sha-256: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b", 
      "Size": 2132078, 
      "ExternalURI": "https://sec-center.example.com/archive?sensor=c1&ref=2021.04.12-64216343", 
      "Note": "Still image from 'Front Door Camera' depicting Intruder #1, Intruder #2 and Intruder #3", 
      "ContentType": "image/jpeg"
    }
  ]
}

Clone this wiki locally