-
Notifications
You must be signed in to change notification settings - Fork 1
IDMEFv2 : Vector Class Comments
The Vector class describes the vector(s) of the event(s) leading up to the alert. o Name, location, description, ...
TBR: o Name, location, description, ...
+------------------------+
| Vector |
+------------------------+
| ENUM[] Category |
| STRING Name |
| ENUM Size |
| STRING Note |
| STRING[] TI |
| GEOLOC GeoLocation |
| FLOAT GeoRadius |
| UNLOCODE UnLocation |
| STRING Location |
| ID[] Attachment |
| ID[] Observable |
+------------------------+
The Vector class has the following attributes:
Mandatory. Category for the detected "vector".
FIXME: Les valeurs du domaine cyber n'ont pas ete ajoutees car elles semblent redondantes avec la notion d'Observable.
TBM : Add the cyber categories : compromise credential, weak credential, insider threats, Missing or Poor Encryption, misconfiguration, ransomware, phishing, vulnerabilities, brute force, DDOS, SQL Injections, Trojans, XSS, Session Hijacking, Man-in-the-Middle Attacks, Third and Fourth-Party Vendors
Optional. Name of the detected vector or "Unknown". Please note that this name does not need to be unique across vectors.
Optional. Rough estimate of the detected vector's size. Enum : Small, Medium, Large, Huge
TBR : The idea behind this attribute was to give information to the operator about the rough size of the vector. But this enum is to vague. The try of a more precise enum with cm, m, etc ... is not a good solution has it's very heavy. Anyway, there is no need for such an enum, operators (& analyst) are not going to filter incident on the size of the vector specially if it's a rough size. I suggest we delete this attribute? If this information is available it should be specify in the "Note" attribute.
Optional. Free text human-readable additional note for this vector.
Optional. Threat Intelligence data about the vector. Values in this list MUST use the format "attribute:origin", where "attribute" refers to the attribute inside this vector found inside a Threat Intelligence database, and "origin" contains a short identifier for the Threat Intelligence database. E.g. "Name:FBI-Wanted".Please note that the same attribute may appear multiple times inside the list (because a match was found in multiple Threat Intelligence databases).
Optional. GPS coordinates for the vector.
Optional. Estimated radius around the provided geolocation in meters. This attribute can be interpreted as an error margin related to the detection of this vector.
Optional. Standard UN/Locode for the vector.
Optional. Internal name for the location of the vector.
Optional. Identifiers for attachments related to this vector. Each identifier listed here MUST match the "Name" attribute for one of the attachments described using the Attachment class (Section 4.8).
Optional. Identifiers for observables related to this vector. Each identifier listed here MUST match the "Name" attribute for one of the observables described using the Observable class (Section 4.9).