-
Notifications
You must be signed in to change notification settings - Fork 1
IDMEFv2 : Target Class Comments
The Target class describes the target(s) of the event(s) leading up to the alert.In this context, the Target always refers to the potential victim, which may be different from the destination in the context of a network connection. For instance, when a user connects to a webserver spreading malwares, the user will be listed as the IDMEF Target, even though it was initially the source of the underlying HTTP(S) connection.
+------------------------+
| Target |
+------------------------+
| IP IP |
| STRING Hostname |
| STRING Note |
| STRING Service |
| STRING User |
| EMAIL Email |
| INT[] Port |
| GEOLOC GeoLocation |
| UNLOCODE UnLocation |
| STRING Location |
| ID[] Attachment |
| ID[] Observable |
+------------------------+
The Target class has the following attributes:
Optional. Target IP address.
Optional. Hostname of this target. This SHOULD be a fully qualified domain name, but may not conform exactly because values extracted from logs, messages, DNS, etc. may themselves be malformed.An empty string MAY be used to explicitly state that this value was inquired but not found (missing DNS entry).
Optional. Free text human-readable additional note for this target.
Optional. Service or process impacted by the alert.
Optional. User ID or login targeted by the alert.
Optional. Email address targeted by the alert. E.g. the value of the "To" header inside a phishing e-mail.
Optional. Target ports involved in the alert. Values in this list MUST be integers and MUST be in the range 1-65535.
Optional. GPS coordinates for the target.
Optional. Standard UN/Locode for the target.
Optional. Internal name for the location of the target.
Optional. Identifiers for attachments related to this target. Each identifier listed here MUST match the "Name" attribute for one of the attachments described using the Attachment class (Section 4.8).
Optional. Identifiers for observables related to this target. Each identifier listed here MUST match the "Name" attribute for one of the observables described using the Observable class (Section 4.9).