184-8795
184-8795
IODEF Data Type | Reference | JSON Data Type |
---|---|---|
INTEGER |
|
integer; see |
REAL |
|
"number" per |
CHARACTER |
|
"string" per |
STRING |
|
"string" per |
ML_STRING |
|
see |
BYTE |
|
"string" per |
BYTE[] |
|
"string" per |
HEXBIN |
|
"string" per |
HEXBIN[] |
|
"string" per |
ENUM |
|
see |
DATETIME |
|
"string" per |
TIMEZONE |
|
"string" per |
PORTLIST |
|
"string" per |
POSTAL |
|
ML_STRING; see |
PHONE |
|
"string" per |
|
"string" per |
|
URL |
|
"string" per |
ID |
|
"string" per |
IDREF |
|
"string" per |
SOFTWARE |
|
see |
STRUCTUREDINFO |
|
see |
EXTENSION |
|
see |
IODEF Data Type | CBOR Data Type | CDDL Prelude |
---|---|---|
INTEGER | 0, 1, 6 tag 2, 6 tag 3 | integer |
REAL | 7 bits 26 | float32 |
CHARACTER | 3 | text |
STRING | 3 | text |
ML_STRING | 5 | Maps/Structs ( |
BYTE | 6 tag 22 | eb64legacy |
BYTE[] | 6 tag 22 | eb64legacy |
HEXBIN | 6 tag 23 | eb16 |
HEXBIN[] | 6 tag 23 | eb16 |
ENUM | - | Choices ( |
DATETIME | 6 tag 0 | tdate |
TIMEZONE | 3 | text |
PORTLIST | 3 | text |
POSTAL | 3 | ML_STRING ( |
PHONE | 3 | text |
3 | text | |
URL | 6 tag 32 | uri |
ID | 3 | text |
IDREF | 3 | text |
SOFTWARE | 5 | Maps/Structs ( |
STRUCTUREDINFO | 5 | Maps/Structs ( |
EXTENSION | 5 | Maps/Structs ( |
IODEF Class | Class, Element, and Attribute | Section in |
---|---|---|
IODEF-Document |
|
|
Incident |
|
|
IncidentID |
|
|
AlternativeID |
|
|
RelatedActivity |
|
|
ThreatActor |
|
|
Campaign |
|
|
Contact |
|
|
RegistryHandle |
|
|
PostalAddress |
|
|
|
|
|
Telephone |
|
|
Discovery |
|
|
DetectionPattern |
|
|
Method |
|
|
Weakness |
|
|
Reference |
|
|
Assessment |
|
|
SystemImpact |
|
|
BusinessImpact |
|
|
TimeImpact |
|
|
MonetaryImpact |
|
|
Confidence |
|
|
History |
|
|
HistoryItem |
|
|
EventData |
|
|
Expectation |
|
|
System |
|
|
Node |
|
|
Address |
|
|
NodeRole |
|
|
Counter |
|
|
DomainData |
|
|
Nameservers |
|
|
DomainContacts |
|
|
Service |
|
|
ServiceName |
|
|
EmailData |
|
|
RecordData |
|
|
RecordPattern |
|
|
WindowsRegistryKeysModified |
|
|
Key |
|
|
CertificateData |
|
|
Certificate |
|
|
FileData |
|
|
File |
|
|
HashData |
|
|
Hash |
|
|
FuzzyHash |
|
|
Indicator |
|
|
IndicatorID |
|
|
AlternativeIndicatorID |
|
|
Observable |
|
|
BulkObservable |
|
|
BulkObservableFormat |
|
|
IndicatorExpression |
|
|
IndicatorReference |
|
|
AttackPhase |
|
|
mapkey | cborkey |
---|---|
iodef-version | -24 |
iodef-lang | -23 |
iodef-format-id | -22 |
iodef-private-enum-name | -21 |
iodef-private-enum-id | -20 |
iodef-Incident | -19 |
iodef-AdditionalData | -18 |
iodef-value | -17 |
iodef-translation-id | -16 |
iodef-name | -15 |
iodef-dtype | -14 |
iodef-ext-dtype | -13 |
iodef-meaning | -12 |
iodef-formatid | -11 |
iodef-restriction | -10 |
iodef-ext-restriction | -9 |
iodef-observable-id | -8 |
iodef-SoftwareReference | -7 |
iodef-URL | -6 |
iodef-Description | -5 |
iodef-spec-name | -4 |
iodef-ext-spec-name | -3 |
iodef-purpose | -2 |
iodef-ext-purpose | -1 |
iodef-status | 0 |
iodef-ext-status | 1 |
iodef-IncidentID | 2 |
iodef-AlternativeID | 3 |
iodef-RelatedActivity | 4 |
iodef-DetectTime | 5 |
iodef-StartTime | 6 |
iodef-EndTime | 7 |
iodef-RecoveryTime | 8 |
iodef-ReportTime | 9 |
iodef-GenerationTime | 10 |
iodef-Discovery | 11 |
iodef-Assessment | 12 |
iodef-Method | 13 |
iodef-Contact | 14 |
iodef-EventData | 15 |
iodef-Indicator | 16 |
iodef-History | 17 |
iodef-id | 18 |
iodef-instance | 19 |
iodef-ThreatActor | 20 |
iodef-Campaign | 21 |
iodef-IndicatorID | 22 |
iodef-Confidence | 23 |
iodef-ThreatActorID | 24 |
iodef-CampaignID | 25 |
iodef-role | 26 |
iodef-ext-role | 27 |
iodef-type | 28 |
iodef-ext-type | 29 |
iodef-ContactName | 30 |
iodef-ContactTitle | 31 |
iodef-RegistryHandle | 32 |
iodef-PostalAddress | 33 |
iodef-Email | 34 |
iodef-Telephone | 35 |
iodef-Timezone | 36 |
iodef-handle | 37 |
iodef-registry | 38 |
iodef-ext-registry | 39 |
iodef-PAddress | 40 |
iodef-EmailTo | 41 |
iodef-TelephoneNumber | 42 |
iodef-source | 43 |
iodef-ext-source | 44 |
iodef-DetectionPattern | 45 |
iodef-DetectionConfiguration | 46 |
iodef-Application | 47 |
iodef-Reference | 48 |
iodef-AttackPattern | 49 |
iodef-Vulnerability | 50 |
iodef-Weakness | 51 |
iodef-SpecID | 52 |
iodef-ext-SpecID | 53 |
iodef-ContentID | 54 |
iodef-RawData | 55 |
iodef-Platform | 56 |
iodef-Scoring | 57 |
iodef-ReferenceName | 58 |
iodef-specIndex | 59 |
iodef-ID | 60 |
iodef-occurrence | 61 |
iodef-IncidentCategory | 62 |
iodef-Impact | 63 |
iodef-SystemImpact | 64 |
iodef-BusinessImpact | 65 |
iodef-TimeImpact | 66 |
iodef-MonetaryImpact | 67 |
iodef-IntendedImpact | 68 |
iodef-Counter | 69 |
iodef-MitigatingFactor | 70 |
iodef-Cause | 71 |
iodef-severity | 72 |
iodef-completion | 73 |
iodef-ext-severity | 74 |
iodef-metric | 75 |
iodef-ext-metric | 76 |
iodef-duration | 77 |
iodef-ext-duration | 78 |
iodef-currency | 79 |
iodef-rating | 80 |
iodef-ext-rating | 81 |
iodef-HistoryItem | 82 |
iodef-action | 83 |
iodef-ext-action | 84 |
iodef-DateTime | 85 |
iodef-DefinedCOA | 86 |
iodef-System | 87 |
iodef-Expectation | 88 |
iodef-RecordData | 89 |
iodef-category | 90 |
iodef-ext-category | 91 |
iodef-interface | 92 |
iodef-spoofed | 93 |
iodef-virtual | 94 |
iodef-ownership | 95 |
iodef-ext-ownership | 96 |
iodef-Node | 97 |
iodef-NodeRole | 98 |
iodef-Service | 99 |
iodef-OperatingSystem | 100 |
iodef-AssetID | 101 |
iodef-DomainData | 102 |
iodef-Address | 103 |
iodef-Location | 104 |
iodef-vlan-name | 105 |
iodef-vlan-num | 106 |
iodef-unit | 107 |
iodef-ext-unit | 108 |
iodef-system-status | 109 |
iodef-ext-system-status | 110 |
iodef-domain-status | 111 |
iodef-ext-domain-status | 112 |
iodef-Name | 113 |
iodef-DateDomainWasChecked | 114 |
iodef-RegistrationDate | 115 |
iodef-ExpirationDate | 116 |
iodef-RelatedDNS | 117 |
iodef-NameServers | 118 |
iodef-DomainContacts | 119 |
iodef-Server | 120 |
iodef-SameDomainContact | 121 |
iodef-ip-protocol | 122 |
iodef-ServiceName | 123 |
iodef-Port | 124 |
iodef-Portlist | 125 |
iodef-ProtoCode | 126 |
iodef-ProtoType | 127 |
iodef-ProtoField | 128 |
iodef-ApplicationHeaderField | 129 |
iodef-EmailData | 130 |
iodef-IANAService | 131 |
iodef-EmailFrom | 132 |
iodef-EmailSubject | 133 |
iodef-EmailX-Mailer | 134 |
iodef-EmailHeaderField | 135 |
iodef-EmailHeaders | 136 |
iodef-EmailBody | 137 |
iodef-EmailMessage | 138 |
iodef-HashData | 139 |
iodef-Signature | 140 |
iodef-RecordPattern | 141 |
iodef-RecordItem | 142 |
iodef-FileData | 143 |
iodef-WindowsRegistryKeysModified | 144 |
iodef-CertificateData | 145 |
iodef-offset | 146 |
iodef-offsetunit | 147 |
iodef-ext-offsetunit | 148 |
iodef-Key | 149 |
iodef-registryaction | 150 |
iodef-ext-registryaction | 151 |
iodef-KeyName | 152 |
iodef-KeyValue | 153 |
iodef-Certificate | 154 |
iodef-X509Data | 155 |
iodef-File | 156 |
iodef-FileName | 157 |
iodef-FileSize | 158 |
iodef-FileType | 159 |
iodef-AssociatedSoftware | 160 |
iodef-FileProperties | 161 |
iodef-scope | 162 |
iodef-HashTargetID | 163 |
iodef-Hash | 164 |
iodef-FuzzyHash | 165 |
iodef-DigestMethod | 166 |
iodef-DigestValue | 167 |
iodef-CanonicalizationMethod | 168 |
iodef-FuzzyHashValue | 169 |
iodef-AlternativeIndicatorID | 170 |
iodef-Observable | 171 |
iodef-uid-ref | 172 |
iodef-IndicatorExpression | 173 |
iodef-IndicatorReference | 174 |
iodef-AttackPhase | 175 |
iodef-BulkObservable | 176 |
iodef-BulkObservableFormat | 177 |
iodef-BulkObservableList | 178 |
iodef-operator | 179 |
iodef-ext-operator | 180 |
iodef-euid-ref | 181 |
iodef-AttackPhaseID | 182 |
CDDL Prelude | Use of JSON | Instance | Validation |
---|---|---|---|
bytes | n/a | string | tool available |
text | string | string | unnecessary |
tdate | n/a | string | date-time per |
integer | n/a | number | integer |
eb64legacy | n/a | string | tool available |
uri | n/a | string | uri per |
float32 | float32 | number | unnecessary |
184-8795
184-8795