Project

General

Profile

Formats » History » Version 4

Anonymous, 06/04/2015 12:16 PM

1 1 Anonymous
h1. Formats
2 1 Anonymous
3 1 Anonymous
h2. What is a format ?
4 1 Anonymous
5 1 Anonymous
This project revolves around formats. But there are a lot of types of formats.
6 1 Anonymous
Here we are actually discussing what we can call schemas, which is the structure used to organize the information in a message.
7 1 Anonymous
8 1 Anonymous
Let's have a closer look on what this means.
9 2 Anonymous
10 2 Anonymous
!{width:500px}/attachments/download/62/Sch%C3%A9ma%20des%20formats.png!
11 2 Anonymous
12 2 Anonymous
We have to make a clear distinction between the syntax, the encoding format and the transport format. 
13 2 Anonymous
Examples of transport format are syslog, http or smtp.
14 2 Anonymous
Examples of encoding format are JSON, XML or Yaml.
15 2 Anonymous
16 2 Anonymous
SECEF is meant to work on the syntax.
17 2 Anonymous
18 2 Anonymous
Each syntax can be split into the schema and the semantics. Schema refers to the structure, semantics refers to what can be stored whithin (types of fields for example).
19 2 Anonymous
20 2 Anonymous
For simplicity reasons, the word format is used throughout this wiki and should mostly be understood as schema or syntax.
21 2 Anonymous
22 2 Anonymous
This being said, it should be easier to understand the purpose of this project.
23 2 Anonymous
24 2 Anonymous
25 2 Anonymous
h2. Which formats are we working on ?
26 2 Anonymous
27 3 Anonymous
SECEF revolves around IDMEF and IODEF. However, in order to improve these formats, a lot of work has also been done on other formats, to [[Comparison of alert formats|compare]] IDMEF and IODEF to them.
28 2 Anonymous
29 2 Anonymous
Here is a quick and non exhaustive list of the formats SECEF already considered : 
30 3 Anonymous
* [[SDEE format|SDEE]]
31 4 Anonymous
* [[CompareFormat#CEE|CEE]]
32 4 Anonymous
* [[CompareFormat#HP-ArcSight-CEF|CEF]]
33 4 Anonymous
* [[CompareFormat#IBM-QRadar-LEEF|LEEF]]
34 4 Anonymous
* [[CompareFormat#DMTF-CIM|CIM]]
35 4 Anonymous
* [[CompareFormat#The-Open-Group-XDAS|XDAS]]