Keys use CamelCase, however to avoid confusion, they must be case insensitively unique within their parent object. When parsing, keys “ID”, “id”, “iD” and “Id” must be considered as equivalent.
Each definition line is in form KEY: TYPE, followed by an explanation line, where type can be basic JSON type (in italics), syntactically restricted type (with reference to Types chapter), or array of former two (order is important). Types define expected syntax, however their content may be further syntactically or semantically restricted according to particular key explanation.
The keys Format, ID, DetectTime and Category are mandatory, rest of the keys is optional (nonexistent key indicates that information is not applicable or unknown).
As human language may be ambiguous inadvertently or by omission, when in doubt, consult JSON schema.
stringnumberstringstringobjectstringstringstringstringobjectstringstringstringstringobjectstringstringstringstringobjectstringstringJSON “true” or “false” value.
JSON “number” with no fractional and exponential part.
Must contain string “IDEA0”. (Trailing zero denotes draft version, after review/discussion and specification finalisation the name will change.)
Internet media type without parameters. Format is type and subtype, separated by slash, where type can contain only alphanumeric, underscore and minus sign, and subtype can contain only alphanumeric, plus and minus sign, underscore and dot.
Character set name may consist of alphanumeric, dot, colon, minus sign, underscore and parentheses (round brackets).
May contain only string “base64” (however note that key can be nonexistent, which means native encoding).
String value unique among all “Handle” element values. May contain only alphanumeric or underscore, must not start with number and must not be empty.
String, containing reasonably globally unique identifier. UUID version 4 (random) or 5 (SHA-1) is recommended. As IDs are meant to be used at other mediums, transfer protocols and formats (an example being query string fields in URL), they are allowed to contain only reasonably safe subset of characters. May thus contain only alphanumeric, dot, minus sign and underscore and must not be empty.
String, containing timestamp conforming to RFC 3339.
String, containing time offset, intended for representing difference between two timestamps. Format is time part of RFC 3339, optionally prepended by “D” or “d” separator and number of days (which can have arbitrary number number of digits). “D” separator has been chosen to distinguish from internet time, and as a memory aid for “duration” or “days”. For example “536D10:20:30.5” means 536 days, 10 hours, 20 seconds, 30.5 seconds, whereas 00:05:00 represents five minutes.
ABNF syntax:
time-hour = 2DIGIT ; 00-23 time-minute = 2DIGIT ; 00-59 time-second = 2DIGIT ; 00-59 time-secfrac = "." 1*DIGIT separator = "D" / "d" days = 1*DIGIT duration = [days separator] time-hour ":" time-minute ":" time-second [time-secfrac]
String, containing URI as defined in RFC 3986 and related.
String, containing IPv4 range in human readable form. Range can be specified as CIDR network (“192.0.2.0/24”) or two IP addresses in dot-decimal notation, separated by minus sign (“192.0.2.0-192.0.2.255”).
String, containing IPv6 range in human readable form. Range can be specified as CIDR notation (“2001:db8::/48”) or two IP addresses in colon-hexadecimal notation, separated by minus sign (“2001:db8::-2001:db8:0:ffff:ffff:ffff:ffff:ffff”).
Namespaced identifier. Dot separated list of labels, with significance from left to right – leftmost denoting largest containing realm, rightmost denoting single entity. Country – organisation – suborganizations – machine – local scheme akin to “org.example.csirt.northwest.honeypot.jabberwock” is strongly recommended. Label case is insignificant, label can contain only letters, numbers or underscore and must not start with number.
String, containing MAC address in human friendly form - six groups of two hexadecimal digits, separated by colon.
URI string, containing LIR identifier and network identifier within LIR namespace, separated by colon.
URI string, defining hash type and hash value, separated by colon.
Category name consists of one or two abbreviated parts - category and optional subcategory, separated by dot. If unsure of more precise nature of the incident, subcategory and dot may be omitted. Category and subcategory name must contain only alphanumeric, underscore and minus sign.
For semantics and taxonomy see security event types classification.
Name must not be empty, must contain only alphanumeric and minus sign, must contain at least one letter, must not begin or end with a hyphen and two hyphens must not be adjacent.
For semantics and applicable strings see protocols classification.
Tag name must contain only alphanumeric, underscore and minus sign.
For semantics and taxonomy see source/target classification.
Tag name must contain only alphanumeric, underscore and minus sign.
For semantics and taxonomy see classification of detection nodes.
Tag name must contain only alphanumeric, underscore and minus sign.
For semantics and taxonomy see attachment description.
CESNET, z. s. p. o.
Generála Píky 26
16000 Prague 6
Tel: +420 234 680 222
Fax: +420 224 320 269
info@cesnet.cz
Tel: +420 234 680 222
GSM: +420 602 252 531
Fax: +420 224 313 211
support@cesnet.cz