Relation between IDMEF and IODEF

Initial requirements/suggestions:

1. IODEF should be compatible with IDMEF and be capable to use/include IDMEF message into IO, e.g. as or inside of IncidentAlert IO class.

However, backward compatibility is not required, i.e. it’s not necessary that IODEF message is understood by IDS (or other automatic system?)

2. If some elements or attributes intersect, options should be considered:

• change name in IODEF or
• ask IDWG to consider changing name in IDMEF

Request for comments to ITDWG and IODEF http://www.terena.nl/task-forces/tf-csirt/i-taxonomy/docs/iodef-idmef-xmldtd-00-rfc.html

Previous slide

Next slide

Back to first slide

View graphic version