Project

General

Profile

IDMEF Analyzer Zoom » History » Version 5

Anonymous, 06/04/2015 12:00 PM

1 1 Anonymous
h1. IDMEF Analyzer Zoom
2 1 Anonymous
3 2 Anonymous
[[IDMEFDiag#Whole-Diagram| Whole Diagram]]
4 2 Anonymous
5 2 Anonymous
[[IDMEF Alert Zoom|Alert]]
6 2 Anonymous
* [[IDMEF Time Zoom|Time]]
7 2 Anonymous
* *Analyzer*
8 2 Anonymous
** [[IDMEF Node Zoom|Node/Address]]
9 2 Anonymous
** [[IDMEF Process Zoom|Process]]
10 2 Anonymous
* [[IDMEF Target/Source Zoom|Source/Target]]
11 2 Anonymous
** [[IDMEF Node Zoom|Node/Address]]
12 2 Anonymous
** [[IDMEF User Zoom|User/UserId]]
13 2 Anonymous
** [[IDMEF Service Zoom|Service]]
14 2 Anonymous
** [[IDMEF File Zoom|File]]
15 2 Anonymous
* [[IDMEF Assessment Zoom|Assessment]]
16 2 Anonymous
* [[IDMEF Classification Zoom|Classification]]
17 5 Anonymous
* [[IDMEF AdditionalData Zoom|Additional Data]]
18 2 Anonymous
19 2 Anonymous
----
20 2 Anonymous
21 4 Anonymous
!/attachments/download/64/Analyzer%20Zoom.svg!
22 3 Anonymous
23 3 Anonymous
----
24 3 Anonymous
25 3 Anonymous
h2. The Analyzer Class
26 3 Anonymous
27 3 Anonymous
The Analyzer class identifies the analyzer from which the Alert or Heartbeat message originates.  Only one analyzer may be encoded for each alert or heartbeat, and that MUST be the analyzer at which the alert or heartbeat originated.  Although the IDMEF data model does not prevent the use of hierarchical intrusion detection systems (where alerts get relayed up the tree), it does not provide any way to record the identity of the "relay" analyzers along the path from the originating analyzer to the manager that ultimately receives the alert.
28 3 Anonymous
29 3 Anonymous
h4. The Analyzer class is composed of three aggregate classes :
30 3 Anonymous
31 3 Anonymous
* Node
32 3 Anonymous
33 3 Anonymous
> Zero or one.  Information about the host or device on which the analyzer resides (network address, network name, etc.).
34 3 Anonymous
35 3 Anonymous
* Process
36 3 Anonymous
37 3 Anonymous
> Zero or one.  Information about the process in which the analyzer is executing.
38 3 Anonymous
39 3 Anonymous
* Analyzer
40 3 Anonymous
41 3 Anonymous
> Zero or one.  Information about the analyzer from which the message may have gone through.  The idea behind this mechanism is that when a manager receives an alert and wants to forward it to another analyzer, it needs to substitute the original analyzer
42 3 Anonymous
43 3 Anonymous
h4. The Analyzer class has eight attributes:
44 3 Anonymous
45 3 Anonymous
* analyzerid
46 3 Anonymous
47 3 Anonymous
> Optional (but see below).  A unique identifier for the analyzer
48 3 Anonymous
49 3 Anonymous
> This attribute is only "partially" optional.  If the analyzer makes use of the "ident" attributes on other classes to provide unique identifiers for those objects, then it MUST also provide a valid "analyzerid" attribute.  This requirement is dictated by the uniqueness requirements of the "ident" attribute (they are unique only within the context of a particular "analyzerid"). If the analyzer does not make use of the "ident" attributes, however, it may also omit the "analyzerid" attribute.
50 3 Anonymous
51 3 Anonymous
* name
52 3 Anonymous
53 3 Anonymous
> Optional.  An explicit name for the analyzer that may be easier to understand than the analyzerid.
54 3 Anonymous
55 3 Anonymous
* manufacturer
56 3 Anonymous
57 3 Anonymous
> Optional.  The manufacturer of the analyzer software and/or hardware.
58 3 Anonymous
59 3 Anonymous
* model
60 3 Anonymous
61 3 Anonymous
> Optional.  The model name/number of the analyzer software and/or hardware.
62 3 Anonymous
63 3 Anonymous
* version
64 3 Anonymous
65 3 Anonymous
> Optional.  The version number of the analyzer software and/or hardware.
66 3 Anonymous
67 3 Anonymous
* class
68 3 Anonymous
69 3 Anonymous
> Optional.  The class of analyzer software and/or hardware.
70 3 Anonymous
71 3 Anonymous
* ostype
72 3 Anonymous
73 3 Anonymous
> Optional.  Operating system name.  On POSIX 1003.1 compliant systems, this is the value returned in utsname.sysname by the uname() system call, or the output of the "uname -s" command.
74 3 Anonymous
75 3 Anonymous
* osversion
76 3 Anonymous
77 3 Anonymous
> Optional.  Operating system version.  On POSIX 1003.1 compliant systems, this is the value returned in utsname.release by the uname() system call, or the output of the "uname -r" command.
78 3 Anonymous
79 3 Anonymous
The "manufacturer", "model", "version", and "class" attributes' contents are vendor-specific, but may be used together to identify different types of analyzers (and perhaps make determinations about the contents to expect in other vendor-specific fields of IDMEF messages).