Intrusion Detection Message Exchange Format
IDMEF Intrusion Detection Message Exchange Format (IDMEF). The purpose of IDMEF is to define data formats and exchange procedures for sharing information of interest to intrusion detection and response systems and to the management systems that may need to interact with them. It is used in computer security for incidents reporting and exchanging. It is intended for easy automatic processing. Format details is described in the RFC 4765. An implementation of the data model in the Extensible Markup Language (XML) is presented and XML Document Type Definition is developed.[1]
Example IDMEF report of ping of death attack can look as follows:
<?xml version="1.0" encoding="UTF-8"?>
<idmef:IDMEF-Message xmlns:idmef="http://iana.org/idmef" version="1.0">
<idmef:Alert messageid="abc123456789">
<idmef:Analyzer analyzerid="bc-sensor01">
<idmef:Node category="dns">
<idmef:name>sensor.example.com</idmef:name>
</idmef:Node>
</idmef:Analyzer>
<idmef:CreateTime ntpstamp="0xbc71f4f5.0xef449129">2000-03-09T10:01:25.93464Z</idmef:CreateTime>
<idmef:Source ident="a1a2" spoofed="yes">
<idmef:Node ident="a1a2-1">
<idmef:Address ident="a1a2-2" category="ipv4-addr">
<idmef:address>192.0.2.200</idmef:address>
</idmef:Address>
</idmef:Node>
</idmef:Source>
<idmef:Target ident="b3b4">
<idmef:Node>
<idmef:Address ident="b3b4-1" category="ipv4-addr">
<idmef:address>192.0.2.50</idmef:address>
</idmef:Address>
</idmef:Node>
</idmef:Target>
<idmef:Target ident="c5c6">
<idmef:Node ident="c5c6-1" category="nisplus">
<idmef:name>lollipop</idmef:name>
</idmef:Node>
</idmef:Target>
<idmef:Target ident="d7d8">
<idmef:Node ident="d7d8-1">
<idmef:location>Cabinet B10</idmef:location>
<idmef:name>Cisco.router.b10</idmef:name>
</idmef:Node>
</idmef:Target>
<idmef:Classification text="Ping-of-death detected">
<idmef:Reference origin="cve">
<idmef:name>CVE-1999-128</idmef:name>
<idmef:url>http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-128</idmef:url>
</idmef:Reference>
</idmef:Classification>
</idmef:Alert>
</idmef:IDMEF-Message>
Tools implementing the IDMEF protocol
- LibPrelude : Part of the Prelude OSS Project, libprelude permits to communicate between agents using the IDMEF format. Libprelude is coded in C but multiples bindings are availables (python, lua, perl, etc.). It can be used in any open-source IDS tools.
- LibIDMEF : LibIDMEF is an implementation of the Internet Engineering Task Force (IETF), Intrusion Detection Exchange Format Charter Working Group (IDWG), draft standard Intrusion Detection Message Exchange Format (IDMEF) protocol.