Intrusion Detection Message Exchange Format

File:IDMEF-Schema.png

The purpose of IDMEF is to define data formats and exchange procedures for sharing information of interest to intrusion detection and response systems and to the management systems that may need to interact with them. It is used in computer security for incidents reporting and exchanging. It is intended for easy automatic processing.

IDMEF is a well-structured object-oriented format, which consists of 33 classes containing 108 fields, including three mandatory:

• The classification
• The unique login
• The date of creation of the alert.

There are currently two types of IDMEF messages that can be created, Heartbeat or Alert

The Heartbeats are sent by the analyzers to indicate their status. These messages are sent at regular intervals which period is defined in the Heartbeat Interval Field. If none of these messages are received for several periods of time, consider that this analyzer is not able to trigger alerts.

Alerts are used to describe an attack that took place, the main areas that create the alert are:

• CreateTime: Date of creation of the alert
• DetectTime: alert detection time by the analyzer
• AnalyzerTime: The time the alert was sent by the analyzer
• Source: Details about the origin of the attack can be a service, a user, a process and / or a node
• Target: Details on the target of the attack can be a service, a user, a process and / or a node and a file
• Classification: Name of the attack and references, as CVEs
• Assessment: Evaluation of the attack (severity, potential impact, etc.)
• AdditionalData: Additional information on the attack

There are three other alert types that inherit from this scheme:

• CorrelationAlert: Grouping of alerts related to one another
• ToolAlert: alerts from the same Grouping tool
• OverflowAlert: Alert resulting from attack so-called buffer overflow

IDMEF report of ping of death attack can look as follows:

sensor.example.com

2000-03-09T10:01:25.93464Z

192.0.2.200

192.0.2.50

lollipop

Cabinet B10

Cisco.router.b10

CVE-1999-128

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-128

• [https://www.prelude-siem.com/en/ Prelude (Intrusion Detection System)]
• [https://www.snort.org/ NIDS Snort]
• [https://suricata-ids.org/ NIDS Suricata] {{Webarchive|url=https://web.archive.org/web/20180131131218/https://suricata-ids.org/ |date=2018-01-31 }} ([http://www.openinfosecfoundation.org/])
• [https://ossec.github.io/ HIDS Ossec] ([http://www.ossec.net/])
• [http://www.la-samhna.de/samhain/ HIDS Samhain] ([http://la-samhna.de/samhain/])
• [https://quadrantsec.com/sagan_log_analysis_engine/ Sagan]
• [https://github.com/firnsy/barnyard2 Barnyard 2]
• [http://www.lsv.ens-cachan.fr/Software/orchids/v2.1/ Orchids]
• [https://prelude-siem.org/projects/libprelude LibPrelude] : Part of the [http://www.prelude-siem.org Prelude OSS Project], libprelude permits to communicate between agents using the IDMEF format. Libprelude is coded in C but multiple bindings are available (Python, Lua, Perl, etc.). It can be used in any open-source IDS tools.
• [http://libidmef.sourceforge.net/ LibIDMEF] : LibIDMEF is an implementation of the IETF (Internet Engineering Task Force), IDWG ( Intrusion Detection Exchange Format Charter Working Group), draft standard IDMEF protocol.
• [http://code.google.com/p/idmef-framework-dotnet/ IDMEF Framework Dotnet] : Dotnet library to create IDMEF objects and export them in XML.
• [http://code.google.com/p/dilca/ DILCA] – Distributed IDMEF Logical Correlation Architecture : DILCA is a distributed logical correlation and reaction architecture featuring collection and correlation of IDMEF formatted log events (Intrusion Detection Message Exchange Format – RFC 4765) through a multi-step signature based system.
• [http://search.cpan.org/~erwan/XML-IDMEF-0.11/IDMEF.pm XML::IDMEF] – A Perl module for building/parsing IDMEF messages : IDMEF.pm is an interface for simply creating and parsing IDMEF messages. IDMEF is an XML based protocol designed mainly for representing Intrusion Detection (IDS) alert messages.
• [https://github.com/gitpan/XML-IDMEF Other module for creating/parsing IDMEF messages]
• [http://sourceforge.net/projects/snort-idmef/ Snort IDMEF Plugin] : Snort IDMEF is an IDMEF XML plugin for Snort to output alert events in the form of IDMEF messages. The plugin is compatible with Snort 2.x
• [https://bro-tracker.atlassian.net/browse/BIT-802 A Broccoli server to send IDMEF alerts via Prelude]
• [https://github.com/C-Sec/IDMEF Converter for the IDMEF format]
• [https://github.com/ningirsu/idmef_parser IDMEF Parser]
• [https://github.com/rlupu/libliteidmef An IDMEF alerting library for distributed IDPS]

Many telecommunications network elements produce security alarms{{cite web |last1=ITU-T |title=Recommendation X.736 : Information technology - Open Systems Interconnection - Systems Management: Security alarm reporting function |url=https://www.itu.int/rec/T-REC-X.736/en |accessdate=5 September 2019}} that address intrusion detection in conformance with international standards. These security alarms are inserted into the normal alarm stream,{{cite web |last1=ITU-T |title=Recommendation X.733 : Informations technology - Open Systems Interconnection - Systems Management: Alarm reporting function |url=https://www.itu.int/rec/T-REC-X.733/en}} where they can be seen and acted upon immediately by personnel in a network operations center.

{{Reflist}}

• {{in lang|en}} RFC 4765, The Intrusion Detection Message Exchange Format (IDMEF)
• {{in lang|en}} RFC 4766, Intrusion Detection Message Exchange Requirements (IDMEF)
• {{in lang|en}} RFC 4767, The Intrusion Detection Exchange Protocol (IDXP)
• {{in lang|en}} Pravin Kothari, [http://www.sans.org/reading_room/whitepapers/detection/intrusion-detection-interoperability-standardization_356 Intrusion Detection Interoperability and Standardization], SANS Institute InfoSec Reading Room, February 19, 2002
• {{in lang|en}} [http://www.secef.net/en/home/ SECEF], Project for the promotion of the IDMEF and IODEF formats

• [http://redmine.secef.net/projects/secef/wiki/Formats Formats], Quick introduction on alert formats and what they are
• [http://redmine.secef.net/projects/secef/wiki/CompareFormat Comparison of alert formats], Long comparison of existing formats (CEF, LEEF, SDEE, etc.)
• [http://redmine.secef.net/projects/secef/wiki/IDMEFDiag Format IDMEF], Detailed description of the IDMEF Format
• [http://redmine.secef.net/projects/secef/wiki/SDEE_format Format SDEE], Detailed schema of SDEE format
• [http://redmine.secef.net/projects/secef/wiki/How_to_use_IDMEF How to use IDMEF], Tutorial on IDMEF content and how to use it
• [http://redmine.secef.net/projects/secef/wiki/How_to_use_LibPrelude How to use LibPrelude], Detailed tutorial on how to use LibPrelude and code an IDMEF client (Python, C, Ruby, etc.)
• [http://redmine.secef.net/projects/secef/wiki/How_to_build_a_sensor How to build a sensor], Detailed tutorial on how to create a new sensor that can communicate in IDMEF through the LibPrelude Library.
• [http://redmine.secef.net/projects/secef/wiki/LibPrelude_IDMEF_path LibPrelude IDMEF], Detailed description of all IDMEF fields

Category:Intrusion detection systems