h1. IDMEFV2

One of SECEF's projects was to build a new IDMEF structure, that referred to as IDMEF V2.

Here are listed the changes that we think could be insteresting to include in the V2.

All of these changes were discussed during meetings or on the forum.

In red are the fields or class to be suppressed, the others are to be added.

|_.Evolution|_.Impacted Class|_.Proposed Field|_.Type   |

|/2. [[Start time end time|Indicate start time and end time or a duration for an event such as worm propagation or scan]]

| StartTime     |   Date | Date|

                                                                                                         | EndTime       |   Date | Date|

|[[Identify transport protocol|Identify transport protocol (TCP, UDP, etc.) regardless of the applicative protocol]] 

| Service       | transport_protocol |ATP

CUDP

DCCP

FCP

IL

MPTCP

RDP

RUDP

SCTP

SPX

SST

TCP

UDP

UDP Lite

µTP|

|[[Translated addresses and ports|Handle translated addresses and ports]]

| Address | translation |no_translation

pre_trabslation

post_translation|

|[[Original log|Add original log attachment]]|Alert|original_log|string|

|[[Counters|Occurrence counter of aggregated events]]|Alert|event_number|Integer|

|[[Counters|Occurrence counter of aggregated alerts in correlation alerts]]|CorrelationAlert|alert_number|Integer|

|[[Thread ID|Add Thread ID]] |Process| TID|Integer|

|/2.[[Specify the attack severity, the target supposed vulnerability, the target criticity and the final priority of the alert]]

|/2.Impact|target_vulnerability|Enum|

|target_criticity|Enum|

|[[Remove OverflowAlerts]]

|\3{background:#e99b9b}.OverflowAlerts|

|[[host category|Specify host category]]|Node|category|Rethink the enumeration|

|/6.[[Location data|Add More explicit location data (latitude, longitude, country, city, etc.)]]|/5.Node->Location|latitude|float|

|longitude|float|

|city|String|

|country|String|

|state|String|

|{background:#e99b9b}.Node|\2{background:#e99b9b}.Location|

|/4.[[Expand WebService class]]|/2.WebService->WebServiceHeaderParams|parameter|host

referer

user-agent

server

cookie

http-method

other|

|value|String|

|/2.WebService->WebServiceParams

|parameter|String|

|value|String|

|/16.[[Expand Service class|Add subclasses to Service class]]|/4.Service->LDAPService|url|String|

|operation|start_tls

bind

search

compare

add

delete

modify

modify_dn

abandon

extended-operation

unbind

other|

|ext-operation|String|

|dn|String|

|/2.LDAPService->LDAPServiceParams|parameter|scope

filter

deref_aliases

attribute

sizelimit

timelimit

sizeonly

ext-type|

|ext-type|String|

|/4.Service->SIPService|uri|String|

|request|INVITE

ACK

BYE

CANCEL

OPTIONS

REGISTER

PRACK

SUBSCRIBE

NOTIFY

PUBLISH

INFO

referer

MESSAGE

UPDATE

other|

|ext-request|String|

|response|integer|

|/2.SIPService->HeaderSIPService|parameter|Enum|

|value|String|

|/4.Service->SMTPService|messsageid|String|

|user-agent|String|

|subject|String|

|references|String|

|[[classification category|Specify classification category]]|Classification|category|(authentification, ...)|