IODEF/IDMEF Solutions

Aims of this List

The eCSIRT.net project aims to address recognized limitations and missing benefits of an established CSIRT infrastructure. By concentrating on the CSIRT-to-CSIRT communication and cooperation, an overall improvement for all participating CSIRTs can be achieved in regard to various aspects.

By applying new established protocols ­ namely IODEF and IDMEF ­ communication should be formalized and integrated into the internal workflows. This will enable semi-automated handling of new incoming reports and facilitate complete and timely reporting to other CSIRTs.

The following sections contains references to known tools and documents that relate to IODEF and IDMEF.

Links to IODEF Documents

• INCH working group of the IETF (working on IODEF):
  http://www.ietf.org/html.charters/inch-charter.html
• INCH working group of TERENA (here are the IODEF documents):
  http://www.terena.nl/tech/task-forces/tf-csirt/iodef/index.html
• Some early IODEF documentation and proposal, including perl tools for generating IODEF-XML:
  http://irt.umdc.umu.se/IODEF/
• Actual links to the development of IODEF, including latest DTD and drafts:
  http://www.iodef.org/

Links to IODEF Tools

• ihsh: Incident Handling Shell (using libih und libair to generate IODEF output using shell commands):
  http://www.ecsirt.net/service/downloads/ihsh-0.9.tgz
• libih: Incident Handling Library (containing functions for processing IODEF and IDMEF and SNML):
  http://aircert.sourceforge.net/libih/libih_index.html
• Some early IODEF documentation and proposal, including perl tools for generating IODEF-XML:
  http://irt.umdc.umu.se/IODEF/
• XML-IODEF: Scripts from JANET-CERT for generation and parsing of IODEF Objects:
  http://search.cpan.org/~johng/XML-IODEF-0.04/

Links to IDMEF Documents

• Intrusion Detection Working Group of the IETF, the home of IDMEF:
  http://www.ietf.org/html.charters/idwg-charter.html
• Simple IDMEF overview and introduction
  http://xml.coverpages.org/idmef.html

Links to IDMEF Tools

• Snort IDMEF-Extensions:
  http://www.silicondefense.com/idwg/snort-idmef/
• There is a plugin for snort for logging in XML, this is not IDMEF but called SNML (simple network markup language):
  http://www.cert.org/kb/snortxml/index.html
• The whole AIRCERT project is here:
  http://www.cert.org/kb/aircert/
• Prelude IDS: OpenSource Hybrid IDS with IDMEF-Alerts
  http://www.prelude-ids.org/
• STAT (IDS of UC Santa Barbara) uses IDMEF:
  http://www.cs.ucsb.edu/~rsg/STAT/software/

Links to other CSIRT related Tools and Products

• Clearing House for Incident Handling Tools
  http://chiht.dfn-cert.de/

eCSIRT.net The European Computer Security Incident Response Team Network News | Sitemap | Imprint | Privacy Statement | Contact | Top Last changed: 23 December, 2003 / OG Copyright © 2002-2003 by PRESECURE Consulting GmbH, Germany

Signed with PGP!