IDMEF vs IODEF: (7)
9. Reuse definition of “Alertident” for extended identification of Incidents.
AlertIdent - the list of alert identifiers that are related to this alert. Because alert identifiers are only unique across the alerts sent by a single analyzer, the optional "analyzerid" attribute of "alertident" should be used to identify the analyzer that a particular alert came from. If the "analyzerid" is not provided, the alert is assumed to have come from the same analyzer that is sending the ToolAlert.
Not applicable for IODEF?