Proposal for additional asset infos in IDMEF
Sandro Poppi <[email protected]> Wed, 24 Aug 2005 11:41:11 +0200
| Newsgroups | gmane.ietf.idwg |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------090303070308010004060507
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Hello all,
I'd like to propose inclusion of additional information within IDMEF:
When dealing with IDS/IPS data it's very helpful if there was also
information available about the target attacked, e.g. for event
correlation, like os, open ports, software running on the target, known
vulnerabilities etc.
As this helps in understanding attacks reported by analyzers and
mitigating risks this for me is also part of Intrusion
Detection/Prevention and thus should be reflected within IDMEF.
To generate that kind of information lots of open source and commercial
tools are available (nmap, nessus, ISS Internet Scanner, Microsoft
Baseline Security Analyzer, ...).
In terms of IDMEF I'd see such kind of tool also as an "analyzer", but
this analyzer does not generate any alarm but asset information which
didn't fit to any of the current classes (it's not an alert nor a
heartbeat).
Thanks to Detmar Liesen who sent valuable input to these thoughts.
Find attached the proposal for further discussion.
Thank you,
Sandro Poppi
--
Maintainer of snort-idmef http://sf.net/projects/snort-idmef
co-author of libidmef 1.x http://sf.net/projects/libidmef
--------------090303070308010004060507
Content-Type: text/plain;
name="asset-proposal.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="asset-proposal.txt"
Hello all,
I'd like to propose inclusion of additional information within IDMEF:
When dealing with IDS/IPS data it's very helpful if there was also information
available about the target attacked, e.g. for event correlation, like os, open
ports, software running on the target, known vulnerabilities etc.
As this helps in understanding attacks reported by analyzers and mitigating
risks this for me is also part of Intrusion Detection/Prevention and thus
should be reflected within IDMEF.
To generate that kind of information lots of open source and commercial tools
are available (nmap, nessus, ISS Internet Scanner, Microsoft Baseline Security
Analyzer, ...).
In terms of IDMEF I'd see such kind of tool also as an "analyzer", but this
analyzer does not generate any alarm but asset information which didn't fit to
any of the current classes (it's not an alert nor a heartbeat).
Note: Everything in [] are notes to the editor or reader.
Thanks to Detmar Liesen who sent valuable input to these thoughts.
My proposal is adding an additional main class "Asset" to IDMEF:
+---------------+
| IDMEF-Message |
+---------------+
/_\
|
+--------------+--------------+
| | |
+-------+ +-----------+ +-------+
| Alert | | Heartbeat | | Asset |
+-------+ +-----------+ +-------+
The Asset Class
The Asset class defines assets to include data "offline" generated by various
tools or manually to allow better correlation and minimize false positives.
[The Asset Class reuses existing classes and adds some new]
+--------------+
| Asset |
+--------------+ 0..1 +----------------+
| STRING ident |<>---------| Analyzer |
| | +----------------+
| | +----------------+
| |<>---------| Target |
| | +----------------+
| | 1..* +----------------+
| |<>---------| Tool |
| | +----------------+
+--------------+
The aggregate classes that make up Asset are:
Analyzer
Zero or one. Information about the system the tool runs on.
Target
One or more. The target this asset is for.
Tool
Exactly one. The tool(s) used for this asset.
This is represented in the XML DTD as follows:
<!ELEMENT Asset (
Analyzer?, Target, Tool+
)>
<!ATTLIST Asset
ident CDATA '0'
>
The Asset class has one attribute:
ident
Optional. A unique identifier for this asset, see Section 4.2.9.
[Addition to 4.2.9] The Asset must be uniquely identified by the couple
(asset.ident,tool.name).
The Tool Class
The Tool Class is used to define which tool created the information and what
the results are for further processing.
+---------------------+
| Tool |
+---------------------+ 0..1 +----------+
| STRING name |<>----------| url |
| STRING manufacturer | +----------+
| STRING model | 0..* +----------+
| STRING version |<>----------| arg |
| STRING class | +----------+
| STRING ostype | 1..* +----------+
| STRING osversion |<>----------| Result |
| | +----------+
| | 0..* +----------------+
| |<>----------| AdditionalData |
+---------------------+ +----------------+
The aggregate classes that make up Tool are:
url
Zero or one. STRING. A URL at which the tool (or the human
operator of the manager) can find additional information about it.
The document pointed to by the URL may include an in-depth
description of the tool, most likely its homepage.
arg
Zero or more. STRING. A command-line argument to the tool.
Multiple arguments may be specified (they are assumed to have
occurred in the same order they are provided) with multiple uses
of arg. This could be e.g. a nessus commandline of a certain nasl
script or an nmap commandline.
Result
One or more. The result set the tool found for the target. This is a
list of what the tool identified on the target, e.g. a list of open
ports, the operating system, the vulnerabilities found etc.
AdditionalData
Zero or more. Information included by the analyzer that does not
fit into the data model. This may be an atomic piece of data, or
a large amount of data provided through an extension to the IDMEF
(see Section 6).
This is represented in the XML DTD as follows:
<!ELEMENT Tool (
Result+, AdditionalData*, url?, arg*
)>
<!ATTLIST Tool
name CDATA #IMPLIED
manufacturer CDATA #IMPLIED
model CDATA #IMPLIED
version CDATA #IMPLIED
class CDATA #IMPLIED
ostype CDATA #IMPLIED
osversion CDATA #IMPLIED
>
The Tool class has seven attributes:
name
Required. An explicit name for the tool used. This could also be
"manual" if the data was generated "by hand".
manufacturer
Optional. The manufacturer of the tool software.
model
Optional. The model name/number of the tool software.
version
Optional. The version number of the tool software.
class
Optional. The class of tool software.
ostype
Optional. Operating system name the tool runs on. On POSIX 1003.1
compliant systems, this is the value returned in utsname.sysname by the
uname() system call, or the output of the "uname -s" command.
osversion
Optional. Operating system version the tool runs on. On POSIX 1003.1
compliant systems, this is the value returned in utsname.release by the
uname() system call, or the output of the "uname -r" command.
The Result Class
The Result class provides information about the tool's findings. It is
intended to exactly define what the toolthinks it has found on the target.
+-----------------+
| Result |
+-----------------+ 0..1 +--------------+
| STRING ident |<>------| Confidence |
| ENUM severity | +--------------+
| STRING version | +--------------+
| STRING category |<>------| Service |
| ENUM type | +--------------+
| | +--------------+
| |<>------| Vulnerability|
| | +--------------+
| | +--------------+
| |<>------| OS |
| | +--------------+
| | 1..* +--------------+
| |<>------| Rule |
| | +--------------+
| | 0..* +--------------+
| |<>------| Reference |
| | +--------------+
| | +--------------+
| |<>------| CreateTime |
| | +--------------+
| | 0..1 +--------------+
| |<>------| banner |
| | +--------------+
| | 0..1 +--------------+
| |<>------| summary |
| | +--------------+
| | 0..1 +--------------+
| |<>------| description |
| | +--------------+
+-----------------+
There MUST be exactly one of the classes Service, Vulnerability, OS, Rule set
(mutual exclusion).
Multiple Vulnerabilities found result in multiple Result classes.
The aggregate classes that make up Result are:
Confidence
Zero or one. A measurement of the confidence the tool has in its
evaluation of the event.
Service
Exactly one. Information about the network service involved in
the event. This is used for indicating open ports.
Vulnerability
Exactly one. The vulnerability found by the tool on the target.
OS
Exactly one. The operating system of the target as provided by the tool.
Rule
One or more. The rule(s) what's allowed on the target and for whom if
it's secured by a firewall. This can be used for providing knowledge about
firewall rules such as iptables.
Reference
Zero or more. Information about the result, pointing to external
documentation sites, that will provide background information.
banner
Zero or one. STRING. The service's banner as provided by connecting to
the given Service. If banner is set, Service MUST be set too.
summary
Zero or one. STRING. A brief summary of the result.
description
Zero or one. STRING. A detailed description of the result.
This is represented in the XML DTD as follows:
<!ENTITY % attvals.type "
( automatic | manual )
">
<!ENTITY % attvals.severity "
( info | low | medium | high )
">
<!ELEMENT Result (
Confidence?,
((Service | (Service, banner?)) | Vulnerability | OS | Rule+),
Reference*, CreatTime, summary?, descritpion?
)>
<!ATTLIST Result
ident CDATA '0'
severity %attvals.severity; #IMPLIED
version CDATA #IMPLIED
category CDATA #IMPLIED
type %attvals.type; 'automatic'
>
The Result class has five attributes:
ident
Optional. A unique identifier for this Result, e.g. the corresponding
tool's id for the result.
severity
Required. An estimate of the relative severity of the event. The permitted
values are shown below. There is no default value.
+------+---------+-----------------------------------------+
| Rank | Keyword | Description |
+------+---------+-----------------------------------------+
| O | info | Alert represents informational activity |
| | | |
| 1 | low | Low severity |
| | | |
| 2 | medium | Medium severity |
| | | |
| 3 | high | High severity |
+------+---------+-----------------------------------------+
version
Optional. The version/revision of the script/rule if applicable.
category
Optional. The category the result belongs to.
type
Required. The type of the result. The permitted values for this attribute
are shown below. The default value is "automatic".
+----------------------+-----------+--------------------------+
| Rank | Keyword | Description |
+----------------------+-----------+--------------------------+
| 0 | automatic | The result was generated |
| | | automatically. |
| | | |
| 1 | manual | The result was generated |
| | | manually. |
+----------------------+-----------+--------------------------+
The Vulnerability Class
The vulnerability class provides detailed information of the vulnerability
found.
[the attributes are mainly inspired by OSVDB http://www.osvdb.org]
+-------------------+
| Vulnerability |
+-------------------+ 0..* +--------------+
| STRING ident |<>------| exploit |
| ENUM expoitable | +--------------+
| ENUM location |
| ENUM attacktype |
| ENUM attackimpact |
| ENUM grade |
| ENUM web |
+-------------------+
The aggregate classes that make up Vulnerability are:
exploit
Zero or more. STRING. If 'exploitable' is set to "available" this class
holds information about the published exploit(s), else exploit has to be
omitted.
This is represented in the XML DTD as follows:
<!ENTITY % attvals.exploitable "
( unknown | available | unavailable | rumored )
">
<!ENTITY % attvals.location "
( unknown | local | remote | physical | dialup )
">
<!ENTITY % attvals.attacktype "
( unknown | auth_manage | crypt | dos | hijack | info_disclose |
infrastruct | input_manip | miss_config | race | other )
">
<!ENTITY % attvals.attackimpact "
( unknown | confidential | integrity | available )
">
<!ENTITY % attvals.grade "
( verified | myth | best_practice | concern )
">
<!ENTITY % attvals.web "
( unknown | yes | no )
">
<!ELEMENT Vulnerability (
exploit*
)>
<!ATTLIST Vulnerability
ident CDATA '0'
exploitable %attvalsexploitable.; 'unknown'
location %attvals.location; 'unknown'
attacktype %attvals.attacktype; 'unknown'
attackimpact %attvals.impact; 'unknown'
grade %attvals.grade; #IMPLIED
web %attvals.web; 'unknown'
>
The Vulnerability class has five attributes:
ident
Optional. A unique identifier for this Vulnerability, e.g. the
corresponding tool's id for the result.
exploitable
Required. Is an exploit for the vulnerability found available. The
permitted values are shown below. The default value is "unknown".
+------+-------------+------------------------------------------+
| Rank | Keyword | Description |
+------+-------------+------------------------------------------+
| O | unknown | It's not sure if an exploit exists |
| | | |
| 1 | available | An exploit is publicly available |
| | | |
| 2 | unavailable | An exploit is not available |
| | | |
| 3 | rumored | Rumors has it that there seems to be an |
| | | exploit floating around |
+------+-------------+------------------------------------------+
location
Optional. The way how this vulnerability can be exploited. The
permitted values are shown below. The default value is "unknown".
+------+---------+------------------------------------------+
| Rank | Keyword | Description |
+------+---------+------------------------------------------+
| 0 | unknown | It's not sure which kind of access is |
| | | required to exploit this vulnerability |
| | | |
| 1 | local | To exploit this vulnerability local shell|
| | | access is required. |
| | | |
| 2 | remote | To exploit this vulnerability remote |
| | | access is required |
| | | |
| 3 | physical| To exploit this vulnerability physical |
| | | console access is required |
| | | |
| 4 | dialup | To exploit this vulnerability dialup |
| | | access is required |
+------+---------+------------------------------------------+
attacktype
Optional. The type of this attack. The permitted values are shown
below. The default value is "unknown".
+------+---------------+------------------------------------------+
| Rank | Keyword | Description |
+------+---------------+------------------------------------------+
| O | unknown | The attack type is unknown |
| | | |
| 1 | auth_manage | This is an authentication attack |
| | | |
| 2 | crypt | This is a cryptographic attack |
| | | |
| 3 | dos | This attack leads to a Denial of Service |
| | | |
| 4 | hijack | This attack leads to session hijacking |
| | | |
| 5 | info_disclose | This attack leads to information |
| | | disclosure |
| | | |
| 6 | infrastruct | This is an infrastructure attack |
| | | |
| 7 | input_manip | This is an input manipulation attack |
| | | |
| 8 | miss_config | This attack is possible because of a |
| | | missconfiguration |
| | | |
| 9 | race | This attack uses a race condition |
| | | |
| 10 | other | The type doesn't fit to any of the above |
| | | types but is not unknown |
+------+---------------+------------------------------------------+
attackimpact
Optional. The impact of this attack. The permitted values are shown
below. The default value is "unknown".
+------+--------------+------------------------------------------+
| Rank | Keyword | Description |
+------+--------------+------------------------------------------+
| O | unknown | The impact is unknown |
| | | |
| 1 | confidential | The impact leads to loss of |
| | | confidentiality |
| | | |
| 2 | integrity | The impact leads to loss of integrity |
| | | |
| 3 | available | The impact leads to loss of availability |
+------+--------------+------------------------------------------+
grade
Required. The grade of this attack. The permitted values are shown
below. There's no default value.
+------+--------------+------------------------------------------+
| Rank | Keyword | Description |
+------+--------------+------------------------------------------+
| O | verified | The vulnerability has been verified |
| | | |
| 1 | myth | The vulnerability is a myth aka not real |
| | | |
| 2 | best_practice| The vulnerability gives best practices |
| | | |
| 3 | concern | The vulnerability is concerning |
+------+--------------+------------------------------------------+
web
Optional. Describes if this vulnerability is web related. The permitted
values are shown below. The default value is "unknown".
+------+--------------+------------------------------------------+
| Rank | Keyword | Description |
+------+--------------+------------------------------------------+
| O | unknown | It is unknown if this vulnerability is |
| | | web related |
| | | |
| 1 | yes | The vulnerability is web related |
| | | |
| 2 | no | The vulnerability is not web related |
+------+--------------+------------------------------------------+
The OS Class
The OS class provides information about the operating system the tool thinks
is running on the target.
+-----------------+
| OS |
+-----------------+ 0..1 +--------------+
| |<>------| patchlevel |
| ENUM arch | +--------------+
| STRING version | 0..* +--------------+
| |<>------| hotfix |
| | +--------------+
+-----------------+
The aggregate classes that make up OS are:
patchlevel
Zero or one. The OS's patchlevel as provided by the tool.
hotfix
Zero or more. The installed hotfixes of the OS. These SHOULD be ordered
by release date.
This is represented in the XML DTD as follows:
<!ENTITY % attvals.arch "
( x86 | x86-64 | amd | amd64 | ppc | mips | sparc | arm | other )
">
<!ELEMENT OS (
patchlevel?, hotfix*
)>
<!ATTLIST
arch %attvals.arch; #IMPLIED
version CDATA #IMPLIED
>
The OS class has three attributes:
arch
Optional. The architecture of the processor the OS runs on. The permitted
values are shown below. The default value is "unknown".
+------+---------+-----------------------------------------+
| Rank | Keyword | Description |
+------+---------+-----------------------------------------+
| O | unknown | The processor type is unknown |
| | | |
| 1 | x86 | Intel based PC 32 bit processor |
| | | |
| 2 | x86-64 | Intel based PC 64 bit processor |
| | | |
| 3 | amd | AMD based PC 32 bit processor |
| | | |
| 4 | amd64 | AMD based PC 64 bit processor |
| | | |
| 5 | ppc | Power PC |
| | | |
| 6 | mips | MIPS processor |
| | | |
| 7 | sparc | Sun Sparc/UltraSparc processor |
| | | |
| 8 | arm | ARM based processor |
| | | |
| 9 | other | Any processor not mentioned above |
| | | |
+------+---------+-----------------------------------------+
version
Optional. The version of the OS.
The Rule Class
This is an optional class to define policy rules defined by firewalls for a
specific target. This supports finding holes in a firewall's policy (by
correlating with other analyzers' findings) as well as filtering unwanted
probes the firewall blocks anyway although reported by an analyzer.
+------------------+
| Rule |
+------------------+
| STRING ident |
| ENUM log |
| ENUM action | 0..* +---------+
| STRING interface |<>---------| Node |
| | +---------+
| | 0..* +---------+
| |<>---------| User |
| | +---------+
| | 0..* +---------+
| |<>---------| Service |
| | +---------+
| | 0..* +---------+
| |<>---------| Nat |
| | +---------+
| | +---------+
| |<>---------| fwtype |
| | +---------+
| | +-----------+
| |<>---------| fwversion |
| | +-----------+
+------------------+
The aggregate classes that make up Rule are:
fwtype
Exactly one. The rule's type definition, the firewall type.
fwversion
Exactly one. The rule's type definition, the firewall version.
Node
Zero or more. The source(s) defined in the policy.
User
Zero or more. The User(s) defined in the policy if it's a user based
rule.
Nat
Zero or more. Detailed information about Network Address Translation
(NAT) rules.
One of the classes Node and User MUST be set but not both.
If a Nat class is provided none of the classes Node, User and Service have
to be set. In all other cases a Service class MUST be provided.
This is represented in the XML DTD as follows:
<!ENTITY % attvals.log "
( unknown | none | log | user | other )
">
<!ENTITY % attvals.action "
( accept | drop | reject | accounting )
">
<!ELEMENT Rule (
(((Node* | User*), Service*) | Nat*), fwtype, fwversion
)>
<!ATTLIST
ident CDATA #IMPLIED
log %attvals.log; 'unknown'
action %attvals.action #IMPLIED
interface CDATA #IMPLIED
>
The Rule class has three attributes:
ident
Optional. A unique identifier for this Policy, see Section 4.2.9.
log
Required. Defines if there was logging enabled and when what exactly.
The permitted values are shown below. The default value is "unknown".
+------+--------------+------------------------------------------+
| Rank | Keyword | Description |
+------+--------------+------------------------------------------+
| O | unknown | The logging is unknown |
| | | |
| 1 | none | The logging is disabled for this rule |
| | | |
| 2 | log | Normal logging, e.g. syslog or firewall |
| | | default logging |
| | | |
| 3 | user | The logging is user-defined |
| | | |
| 4 | other | The logging is something else (email, |
| | | snmp, ...) |
+------+--------------+------------------------------------------+
action
Required. The action defined on this specific rule. The permitted values
are shown below. There is no default value.
+------+--------------+------------------------------------------+
| Rank | Keyword | Description |
+------+--------------+------------------------------------------+
| O | accept | The rule allows access |
| | | |
| 1 | drop | The rule drops any packet without sending|
| | | information back |
| | | |
| 2 | reject | The rule drops any packet and sends back |
| | | icmp unreachable or tcp reset packets |
| | | |
| 3 | accounting | The rule only counts matches |
+------+--------------+------------------------------------------+
interface
Optional. The interface this rule is bound to such as "eth0" with Linux,
or "any".
The Nat Class
The Nat class provides detailed information about the Network Address
Tranlsation (NAT) rules. It is intended to gain knowledge about which ip
addresses and/or ports are affected by an attack behind the NAT'ing device.
+--------------+
| Nat |
+--------------+ +----------+
| STRING ident |<>---------| OrgSrc |
| | +----------+
| | +----------+
| |<>---------| OrgTgt |
| | +----------+
| | +----------+
| |<>---------| TransSrc |
| | +----------+
| | +----------+
| |<>---------| TransTgt |
| | +----------+
+--------------+
The aggregate classes that make up Nat are:
OrgSrc
Exactly one. The original source address(es).
OrgTgt
Exactly one. The original target address(es)
TransSrc
Exactly one. The translated source address.
TransTgt
Exactly one. The translated target address.
This is represented in the XML DTD as follows:
<!ELEMENT Nat (
OrgSrc, OrgTgt, TransSrc, TransTgt
)>
<!ATTLIST Nat
ident CDATA #IMPLIED
>
The Nat class has one attribute:
ident
Optional. A unique identifier for this Nat rule, see Section 4.2.9.
The OrgSrc Class
The OrgSrc class defines the source node(s) which have to be NAT'ed.
+--------------+
| OrgSrc |
+--------------+ 1..* +----------+
| |<>---------| Node |
| | +----------+
+--------------+
The aggregate classes that make up OrgSrc are:
Node
One or more. The source node(s) to be NAT'ed
This is represented in the XML DTD as follows:
<!ELEMENT OrgSrc (
Node+
)>
The OrgSrc class has no attributes.
The OrgTgt Class
The OrgTgt class defines the target node(s) and port which have to be NAT'ed.
+--------------+
| OrgTgt |
+--------------+ 1..* +----------+
| |<>---------| Node |
| | +----------+
| | +----------+
| |<>---------| Service |
| | +----------+
+--------------+
The aggregate classes that make up OrgTgt are:
Node
One or more. The target node(s) to be NAT'ed
Service
Exactly one. The target service definition to be NAT'ed
This is represented in the XML DTD as follows:
<!ELEMENT OrgTgt (
Node+, Service
)>
The OrgTgt class has no attributes.
The TransSrc Class
This class defines the translated source node for NAT'ing.
+--------------+
| TransSrc |
+--------------+ +----------+
| |<>---------| Node |
| | +----------+
+--------------+
The aggregate classes that make up TransSrc are:
Node
Exactly one. The translated source node for NAT'ing
This is represented in the XML DTD as follows:
<!ELEMENT TransSrc (
Node
)>
The TransSrc class has no attributes.
The TransTgt Class
The TransTgt class defines the target node and port for NAT'ing.
+--------------+
| TransTgt |
+--------------+ +----------+
| |<>---------| Node |
| | +----------+
| | +----------+
| |<>---------| Service |
| | +----------+
+--------------+
The aggregate classes that make up TransTgt are:
Node
Exactly one. The target node for NAT'ing
Service
Exactly one. The target service definition to be NAT'ed to
This is represented in the XML DTD as follows:
<!ELEMENT TransTgt (
Node, Service
)>
The TransTgt class has no attributes.
Examples
Nessus scan result for MySQL Server version
<?xml version="1.0" encoding="UTF-8"?>
<idmef:IDMEF-Message xmlns:idmef="http://iana.org/idmef"
version="1.0">
<idmef:Asset ident="neptun-nessus-check1">
<idmef:Analyzer analyzerid="hq-nessus01">
<idmef:Node category="dns">
<idmef:location>Headquarters Scan Network</idmef:location>
<idmef:name>nessus01.example.com</idmef:name>
</idmef:Node>
</idmef:Analyzer>
<idmef:Target ident="d1c2b3a4">
<idmef:Node ident="d1c2b3a4-001" category="dns">
<idmef:Address category="ipv4-addr-hex">
<idmef:address>0xde796f70</idmef:address>
</idmef:Address>
</idmef:Node>
</idmef:Target>
<idmef:Tool name="nessus" version="2.2.5" class="vulnerability-scanner"
ostype="Linux" osversion="2.6.12-1.1398_FC4smp">
<idmef:url>http://www.nessus.org</idmef:url>
<idmef:Result severity="info" version="1.14" type="automatic">
<idmef:Vulnerability ident="10719" exploitable="unavailable"
grade="verified" web="no">
</idmef:Vulnerability>
<idmef:CreateTime ntpstamp="0xc694c70c.0xfc87980f">
2005-07-29T15:17:32Z
</idmef:CreateTime>
<idmef:Reference origin="vendor-specific">
<idmef:name>10719</idmef:name>
<idmef:url>
http://www.nessus.org/plugins/index.php?view=single&id=10719
</idmef:url>
</idmef:Reference>
<idmef:summary>
MySQL Server version
</idmef:summary>
<idmef:description>
This detects MySQL Server's version by connecting to the server and
processing the buffer received. This information gives potential
attackers additional information about the system they are attacking.
Versions should be omitted where possible.
</idmef:description>
</idmef:Result>
</idmef:Tool>
</idmef:Asset>
</idmef:IDMEF-Message>
Nmap Operating System Guess
<?xml version="1.0" encoding="UTF-8"?>
<idmef:IDMEF-Message xmlns:idmef="http://iana.org/idmef"
version="1.0">
<idmef:Asset ident="neptun-nmap01">
<idmef:Analyzer analyzerid="hq-nmap01">
<idmef:Node category="dns">
<idmef:location>Headquarters Scan Network</idmef:location>
<idmef:name>nmap01.example.com</idmef:name>
</idmef:Node>
</idmef:Analyzer>
<idmef:Target ident="d1c2b3a4">
<idmef:Node ident="d1c2b3a4-001" category="dns">
<idmef:Address category="ipv4-addr">
<idmef:address>192.168.0.123</idmef:address>
</idmef:Address>
</idmef:Node>
</idmef:Target>
<idmef:Tool name="nmap" version="3.81" class="portscanner"
ostype="Linux" osversion="2.6.12-1.1398_FC4smp">
<idmef:url>http://www.nmap.org</idmef:url>
<idmef:arg>-O</idmef:arg>
<idmef:arg>192.168.0.123</idmef:arg>
<idmef:Result severity="info" type="automatic">
<idmef:OS arch="x86" version="2.4.22 - 2.6.3">
Linux
</idmef:OS>
<idmef:CreateTime ntpstamp="0xc694c70c.0xfc87980f">
2005-07-29T15:17:32Z
</idmef:CreateTime>
<idmef:summary>
Operating System guess
</idmef:summary>
</idmef:Result>
</idmef:Tool>
</idmef:Asset>
</idmef:IDMEF-Message>
--------------090303070308010004060507--