Used as part of computer security, IDMEF (''Intrusion Detection Message Exchange Format'') is a data format used to exchange information between software enabling intrusion detection, intrusion prevention, security information collection and management systems that may need to interact with them. IDMEF messages are designed to be processed automatically. The details of the format are described in the RFC 4765. This RFC presents an implementation of the

XML Extensible Markup Language (XML) is a markup language and file format for storing, transmitting, and reconstructing arbitrary data. It defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. T ...

data model and the associated DTD. The requirements for this format are described in RFC 4766, and the recommended transport protocol (IDXP) is documented in RFC 4767

IDMEF

The purpose of IDMEF is to define data formats and exchange procedures for sharing information of interest to

intrusion detection An intrusion detection system (IDS; also intrusion prevention system or IPS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically rep ...

and response systems and to the management systems that may need to interact with them. It is used in

computer security Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...

for incidents reporting and exchanging. It is intended for easy automatic processing. IDMEF is a well-structured object-oriented format, which consists of 33 classes containing 108 fields, including three mandatory: * The classification * The unique login * The date of creation of the alert. There are currently two types of IDMEF messages that can be created, ''Heartbeat'' or ''Alert''

Heartbeat

The Heartbeats are sent by the analyzers to indicate their status. These messages are sent at regular intervals which period is defined in the Heartbeat Interval Field. If none of these messages are received for several periods of time, consider that this analyzer is not able to trigger alerts.

Alert

Alerts are used to describe an attack that took place, the main areas that create the alert are: * CreateTime: Date of creation of the alert * DetectTime: alert detection time by the analyzer * AnalyzerTime: The time the alert was sent by the analyzer * Source: Details about the origin of the attack can be a service, a user, a process and / or a node * Target: Details on the target of the attack can be a service, a user, a process and / or a node and a file * Classification: Name of the attack and references, as CVEs * Assessment: Evaluation of the attack (severity, potential impact, etc.) * AdditionalData: Additional information on the attack There are three other alert types that inherit from this scheme: * CorrelationAlert: Grouping of alerts related to one another * ToolAlert: alerts from the same Grouping tool * OverflowAlert: Alert resulting from attack so-called buffer overflow

Example

IDMEF report of

ping of death A ping of death is a type of attack on a computer system that involves sending a malformed or otherwise malicious ping to a computer. A correctly formed ping packet is typically 56 bytes in size, or 64 bytes when the Internet Control ...

attack can look as follows:

sensor.example.com 2000-03-09T10:01:25.93464Z 192.0.2.200 192.0.2.50 lollipop Cabinet B10 Cisco.router.b10 CVE-1999-128 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-128

Tools implementing the IDMEF protocol

Prelude (Intrusion Detection System)

NIDS Snort

NIDS Suricata

HIDS Ossec

HIDS Samhain

Sagan

Barnyard 2

Orchids

LibPrelude
: Part of th
Prelude OSS Project
libprelude permits to communicate between agents using the IDMEF format. Libprelude is coded in C but multiple bindings are available (Python, Lua, Perl, etc.). It can be used in any open-source IDS tools.
LibIDMEF
: LibIDMEF is an implementation of the IETF (''Internet Engineering Task Force''), IDWG ( ''Intrusion Detection Exchange Format Charter Working Group''), draft standard IDMEF protocol.
IDMEF Framework Dotnet
: Dotnet library to create IDMEF objects and export them in XML.
DILCA
– Distributed IDMEF Logical Correlation Architecture : DILCA is a distributed logical correlation and reaction architecture featuring collection and correlation of IDMEF formatted log events (Intrusion Detection Message Exchange Format – RFC 4765) through a multi-step signature based system.
XML::IDMEF
– A Perl module for building/parsing IDMEF messages : IDMEF.pm is an interface for simply creating and parsing IDMEF messages. IDMEF is an XML based protocol designed mainly for representing Intrusion Detection (IDS) alert messages.
Other module for creating/parsing IDMEF messages

Snort IDMEF Plugin
: Snort IDMEF is an IDMEF XML plugin for Snort to output alert events in the form of IDMEF messages. The plugin is compatible with Snort 2.x
A Broccoli server to send IDMEF alerts via Prelude

Converter for the IDMEF format

IDMEF Parser

An IDMEF alerting library for distributed IDPS

Competing frameworks

Many telecommunications network elements produce security alarms that address intrusion detection in conformance with international standards. These security alarms are inserted into the normal alarm stream, where they can be seen and acted upon immediately by personnel in a

network operations center A network operations center (NOC, pronounced like the word ''knock''), also known as a "network management center", is one or more locations from which network monitoring and control, or network management, is exercised over a computer, telecom ...

References

External links

* RFC 4765, The Intrusion Detection Message Exchange Format (IDMEF) * RFC 4766, Intrusion Detection Message Exchange Requirements (IDMEF) * RFC 4767, The Intrusion Detection Exchange Protocol (IDXP) * Pravin Kothari,
Intrusion Detection Interoperability and Standardization
', SANS Institute InfoSec Reading Room, 19 février 2002 * {{in lang, en}
SECEF
Project for the promotion of the IDMEF and IODEF formats

Tutorials

Formats
Quick introduction on alert formats and what they are
Comparison of alert formats
Long comparison of existing formats (CEF, LEEF, SDEE, etc.)
Format IDMEF
Detailed description of the IDMEF Format
Format SDEE
Detailed schema of SDEE format
How to use IDMEF
Tutorial on IDMEF content and how to use it
How to use LibPrelude
Detailed tutorial on how to use LibPrelude and code an IDMEF client (Python, C, Ruby, etc.)
How to build a sensor
Detailed tutorial on how to create a new sensor that can communicate in IDMEF through the LibPrelude Library.
LibPrelude IDMEF
Detailed description of all IDMEF fields Intrusion detection systems