Project

General

Profile

describe IDMEFMessageStructure here

                               +---------------+
                               | IDMEF-Message |
                               +---------------+
                                      /_\
                                       |
          +----------------------------+-------+
          |                                    |
      +-------+   +----------------+     +-----------+   +----------------+
      | Alert |<>-|    Analyzer    |     | Heartbeat |<>-|    Analyzer    |
      +-------+   +----------------+     +-----------+   +----------------+
      |       |   +----------------+     |           |   +----------------+
      |       |<>-|   [[CreateTime]]   |     |           |<>-|   [[CreateTime]]   |
      |       |   +----------------+     |           |   +----------------+
      |       |   +----------------+     |           |   +----------------+
      |       |<>-|   [[DetectTime]]   |     |           |<>-| [[AdditionalData]] |
      |       |   +----------------+     +-----------+   +----------------+
      |       |   +----------------+
      |       |<>-|  [[AnalyzerTime]]  |
      |       |   +----------------+
      |       |   +--------+   +----------+
      |       |<>-| Source |<>-|   Node   |
      |       |   +--------+   +----------+
      |       |   |        |   +----------+
      |       |   |        |<>-|   User   |
      |       |   |        |   +----------+
      |       |   |        |   +----------+
      |       |   |        |<>-| Process  |
      |       |   |        |   +----------+
      |       |   |        |   +----------+
      |       |   |        |<>-| Service  |
      |       |   +--------+   +----------+
      |       |   +--------+   +----------+
      |       |<>-| Target |<>-|   Node   |
      |       |   +--------+   +----------+
      |       |   |        |   +----------+
      |       |   |        |<>-|   User   |
      |       |   |        |   +----------+
      |       |   |        |   +----------+
      |       |   |        |<>-| Process  |
      |       |   |        |   +----------+
      |       |   |        |   +--------- +
      |       |   |        |<>-| Service  |       +----------------+
      |       |   |        |   +----------+  +----| Classification |
      |       |   |        |   +----------+  |    +----------------+
      |       |   |        |<>-| [[FileList]] |  |    +----------------+
      |       |   +--------+   +----------+  | +--|   Assessment   |
      |       |<>----------------------------+ |  +----------------+
      |       |<>------------------------------+  +----------------+
      |       |<>---------------------------------| [[AdditionalData]] |
      +-------+                                   +----------------+