h1. IDMEF Analyzer Zoom

[[IDMEFDiag#Whole-Diagram| Whole Diagram]]

[[IDMEF Alert Zoom|Alert]]

* [[IDMEF Time Zoom|Time]]

* *Analyzer*

** [[IDMEF Node Zoom|Node/Address]]

** [[IDMEF Process Zoom|Process]]

* [[IDMEF Target/Source Zoom|Source/Target]]

** [[IDMEF Node Zoom|Node/Address]]

** [[IDMEF User Zoom|User/UserId]]

** [[IDMEF Service Zoom|Service]]

** [[IDMEF File Zoom|File]]

* [[IDMEF Assessment Zoom|Assessment]]

* [[IDMEF Classification Zoom|Classification]]

----

!/attachments/download/64/Analyzer%20Zoom.svg!

----

h2. The Analyzer Class

The Analyzer class identifies the analyzer from which the Alert or Heartbeat message originates.  Only one analyzer may be encoded for each alert or heartbeat, and that MUST be the analyzer at which the alert or heartbeat originated.  Although the IDMEF data model does not prevent the use of hierarchical intrusion detection systems (where alerts get relayed up the tree), it does not provide any way to record the identity of the "relay" analyzers along the path from the originating analyzer to the manager that ultimately receives the alert.

h4. The Analyzer class is composed of three aggregate classes :

* Node

> Zero or one.  Information about the host or device on which the analyzer resides (network address, network name, etc.).

* Process

> Zero or one.  Information about the process in which the analyzer is executing.

* Analyzer

> Zero or one.  Information about the analyzer from which the message may have gone through.  The idea behind this mechanism is that when a manager receives an alert and wants to forward it to another analyzer, it needs to substitute the original analyzer

h4. The Analyzer class has eight attributes:

* analyzerid

> Optional (but see below).  A unique identifier for the analyzer

> This attribute is only "partially" optional.  If the analyzer makes use of the "ident" attributes on other classes to provide unique identifiers for those objects, then it MUST also provide a valid "analyzerid" attribute.  This requirement is dictated by the uniqueness requirements of the "ident" attribute (they are unique only within the context of a particular "analyzerid"). If the analyzer does not make use of the "ident" attributes, however, it may also omit the "analyzerid" attribute.

* name

> Optional.  An explicit name for the analyzer that may be easier to understand than the analyzerid.

* manufacturer

> Optional.  The manufacturer of the analyzer software and/or hardware.

* model

> Optional.  The model name/number of the analyzer software and/or hardware.

* version

> Optional.  The version number of the analyzer software and/or hardware.

* class

> Optional.  The class of analyzer software and/or hardware.

* ostype

> Optional.  Operating system name.  On POSIX 1003.1 compliant systems, this is the value returned in utsname.sysname by the uname() system call, or the output of the "uname -s" command.

* osversion

> Optional.  Operating system version.  On POSIX 1003.1 compliant systems, this is the value returned in utsname.release by the uname() system call, or the output of the "uname -r" command.

The "manufacturer", "model", "version", and "class" attributes' contents are vendor-specific, but may be used together to identify different types of analyzers (and perhaps make determinations about the contents to expect in other vendor-specific fields of IDMEF messages).