• JSON format
• Main classes : Agent, Source, Target, Vector, Attach
• Physical and Availability incidents are included
• Location concept
• Strongly inspired of the IDEA format (based on IDMEFv1)...

New version with minor changes :

• Attributes types have been corrected
• A new sheet "types" for types definition
• Minor correction in the excel and word examples for JSON compatibility

New version with minor changes :

• Add a new class: Observables
• Update list of "Types", "ENUM" and "Category"
• Update word JSON examples
• Move some attributes

Comparaison entre le format IDMEF v1 et les principaux formats propriétaires existants dons CEF de Arsight et LEEF de QRadar.

How to use IDMEF v1 attributs.

Comment utiliser les champs et attributs IDMEF v1.

Draft de spécification IDMEFv2 réalisé avec le concours du centre de détection de la DGA MI et le Cossi de l'ANSSI.

IDMEfv2 draft specification in collaboration with French Ministry of the Army and ANSSI (French NSA)

This table present a "field to field" comparison of the major SIEM alert format.