Skip to content

IDMEFv2 : Vector Class Comments

Gilles Lehmann edited this page Jan 25, 2023 · 4 revisions

The Vector class describes the vector(s) of the event(s) leading up to the alert. o Name, location, description, ...

TBR: o Name, location, description, ...

                                   +------------------------+
                                   |         Vector         |
                                   +------------------------+
                                   | ENUM[]     Category    |
                                   | STRING     Name        |
                                   | ENUM       Size        |
                                   | STRING     Note        |
                                   | STRING[]   TI          |
                                   | GEOLOC     GeoLocation |
                                   | FLOAT      GeoRadius   |
                                   | UNLOCODE   UnLocation  |
                                   | STRING     Location    |
                                   | ID[]       Attachment  |
                                   | ID[]       Observable  |
                                   +------------------------+

Figure 8: The Vector class

The Vector class has the following attributes:

Category

Mandatory. Category for the detected "vector".

FIXME: Les valeurs du domaine cyber n'ont pas ete ajoutees car elles semblent redondantes avec la notion d'Observable.

TBM : Add the cyber categories : compromise credential, weak credential, insider threats, Missing or Poor Encryption, misconfiguration, ransomware, phishing, vulnerabilities, brute force, DDOS, SQL Injections, Trojans, XSS, Session Hijacking, Man-in-the-Middle Attacks, Third and Fourth-Party Vendors

Name

Optional. Name of the detected vector or "Unknown". Please note that this name does not need to be unique across vectors.

Size

Optional. Rough estimate of the detected vector's size. Enum : Small, Medium, Large, Huge

TBR : The idea behind this attribute was to give information to the operator about the rough size of the vector. But this enum is to vague. The try of a more precise enum with cm, m, etc ... is not a good solution has it's very heavy. Anyway, there is no need for such an enum, operators (& analyst) are not going to filter incident on the size of the vector specially if it's a rough size. I suggest we delete this attribute? If this information is available it should be specify in the "Note" attribute.

Note

Optional. Free text human-readable additional note for this vector.

TI

Optional. Threat Intelligence data about the vector. Values in this list MUST use the format "attribute:origin", where "attribute" refers to the attribute inside this vector found inside a Threat Intelligence database, and "origin" contains a short identifier for the Threat Intelligence database. E.g. "Name:FBI-Wanted".Please note that the same attribute may appear multiple times inside the list (because a match was found in multiple Threat Intelligence databases).

GeoLocation

Optional. GPS coordinates for the vector.

GeoRadius

Optional. Estimated radius around the provided geolocation in meters. This attribute can be interpreted as an error margin related to the detection of this vector.

UnLocation

Optional. Standard UN/Locode for the vector.

Location

Optional. Internal name for the location of the vector.

Attachment

Optional. Identifiers for attachments related to this vector. Each identifier listed here MUST match the "Name" attribute for one of the attachments described using the Attachment class (Section 4.8).

Observable

Optional. Identifiers for observables related to this vector. Each identifier listed here MUST match the "Name" attribute for one of the observables described using the Observable class (Section 4.9).

Clone this wiki locally