IODEF/IDMEF Solutions

(News) (Tools) (Service)
eCSIRT.net > Services > IODEF/IDMEF Solutions

Aims of this List

The eCSIRT.net project aims to address recognized limitations and missing benefits of an established CSIRT infrastructure. By concentrating on the CSIRT-to-CSIRT communication and cooperation, an overall improvement for all participating CSIRTs can be achieved in regard to various aspects.

By applying new established protocols - namely IODEF and IDMEF - communication should be formalized and integrated into the internal workflows. This will enable semi-automated handling of new incoming reports and facilitate complete and timely reporting to other CSIRTs.

The following sections contains references to known tools and documents that relate to IODEF and IDMEF.

Links to IODEF Documents

INCH working group of the IETF (working on IODEF):
http://www.ietf.org/html.charters/OLD/inch-charter.html and http://tools.ietf.org/wg/inch/
INCH working group of TERENA (here are the IODEF documents):
http://www.terena.nl/tech/task-forces/tf-csirt/iodef/index.html
Some early IODEF documentation and proposal, including perl tools for generating IODEF-XML:
http://irt.umdc.umu.se/IODEF/
Actual links to the development of IODEF, including latest DTD and drafts:
http://www.iodef.org/

Links to IODEF Tools

ihsh: Incident Handling Shell (using libih und libair to generate IODEF output using shell commands):
http://www.ecsirt.net/service/downloads/ihsh-0.9.tgz
libih: Incident Handling Library (containing functions for processing IODEF and IDMEF and SNML):
http://aircert.sourceforge.net/libih/libih_index.html
Some early IODEF documentation and proposal, including perl tools for generating IODEF-XML:
http://irt.umdc.umu.se/IODEF/
XML-IODEF: Scripts from JANET-CERT for generation and parsing of IODEF Objects:
http://search.cpan.org/~johng/XML-IODEF-0.04/

Links to IDMEF Documents

Intrusion Detection Working Group of the IETF, the home of IDMEF:
http://www.ietf.org/html.charters/OLD/idwg-charter.html and http://tools.ietf.org/wg/idwg/
Simple IDMEF overview and introduction
http://xml.coverpages.org/idmef.html

Links to IDMEF Tools

Snort IDMEF-Extensions:
http://www.silicondefense.com/idwg/snort-idmef/
There is a plugin for snort for logging in XML, this is not IDMEF but called SNML (simple network markup language):
http://www.cert.org/kb/snortxml/index.html
The whole AIRCERT project is here:
http://www.cert.org/kb/aircert/
Prelude IDS: OpenSource Hybrid IDS with IDMEF-Alerts
http://www.prelude-ids.org/
STAT (IDS of UC Santa Barbara) uses IDMEF:
http://www.cs.ucsb.edu/~rsg/STAT/software/

Links to other CSIRT related Tools and Products

Clearing House for Incident Handling Tools
http://chiht.dfn-cert.de/

eCSIRT.net > Services > IODEF/IDMEF Solutions
(News) (Background) (Service)

Signed with PGP!