]> NICT

4-2-1 Nukui-Kitamachi Koganei Tokyo 184-8795 Japan +81 42 327 5862 takeshi_takahashi@nict.go.jp

NICT

4-2-1 Nukui-Kitamachi Koganei Tokyo 184-8795 Japan mio@nict.go.jp

Security MILE JSON, IODEF RFC 7970 provides XML-based data representation on incident information, but the use of the IODEF data model is not limited to XML. JSON representation is sometimes preferred since it is easy to handle from certain programming environments. This draft represents the IODEF data model in JSON. Note that this 00 version draft is prepared for the purpose of encouraging discussion on the need for JSON representation.

RFC 7970 defines an data model for sharing incident information. It facilitates automated exchange of information among parties over networks. The data model can be implemented in a form of XML, but it is not always suitable for implementation. JSON-based representation is often useful. Therefore, in this document, we provide a means to represent IODEF data model in JSON.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

The data model of IODEF is defined in RFC 7970, and this section illustrates their representations in JSON. Note that the complete JSON schema is defined in .

The IODEF-Document class is the top level class in the IODEF data model. This class is defined in Section 3.1 of RFC 7970 and has the following fields: "version", "lang", "format-id", "private-enum-name", "private-enum-id", "Incident", and "AdditionalData". An example of this class in JSON is as follows. Note that JSON representation in this draft treats attributes and elements of each class defined in RFC 7970 equally and is agnostic on the order of their appearances.

The Incident class describes commonly exchanged information when reporting or sharing derived analysis from security incidents. This class is defined in Section 3.2 of RFC 7970. It has the following fields: "purpose", "lang", "restriction", "ext-restriction", "IncidentID", "RelatedActivity", "GenrationTime", "Description", "Assessment", "Methods", "Contact", "EventData", "IndicatorData", "History", and "AdditionalData". An example of this class in JSON is as follows.

There are a number of recurring attributes used in the information model. They are documented in this section.

RFC 7970 defines the restriction Attribute as one of common attributes. It is defined as below:

Note that you must use "ext-restriction" field (STRING type) when the value of "restriction" field is set to "ext-value". The example on the use of the "ext-restriction" field is shown below.

RFC 7970 defines the observable-id attribute as one of common attributes. The value of this attribute is a unique identifier in the scope of the document.It is defined as below:

This class is defined in Section 3.4 of RFC 7970. It has the following fields: "IncidentID", "id", "name", "instance", "restriction", and "ext-restriction". The example below represents how to describe this class in JSON.

This class is defined in Section 3.5 of RFC 7970. The example below represents how to describe this class in JSON.

>>] //IncidentID } ]]>

This class is defined in Section 3.6 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.7 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.8 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.9 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.9.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.9.2 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.9.3 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.9.4 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.10 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.10.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.11 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.11.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.12 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.12.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.12.2 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.12.3 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.12.4 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.12.5 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.13 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.13.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.14 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.15 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.17 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.18 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.18.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.18.2 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.18.3 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.19 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.19.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.19.2 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.20 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.20.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.20.2 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.21 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.22.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.22.2 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.23 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.23.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.24 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.24.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.25 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.25.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.26 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.26.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.26.2 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.27 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.29 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.29.1 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.29.2 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.29.3 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.29.4 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.29.6 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.29.7 of RFC 7970. The example below represents how to describe this class in JSON.

This class is defined in Section 3.29.8 of RFC 7970. The example below represents how to describe this class in JSON.

Flow class is deleted, and EventData class now has the instance of System class. Record class is deleted, and the link to the Record class are directly connected to RecordData class, which is then renamed to Record class.

This section provides example of IODEF documents. These examples do not represent the full capabilities of the data model or the the only way to encode particular information.

A document containing only the mandatory elements and attributes.

An example of C2 domains from a given campaign.

TBD.

This memo includes no request to IANA.

This memo does not provide any further security considerations than the one described in RFC 7970.

&RFC2119; &RFC7970; &RFC2629; &RFC3552; &RFC5226; Mad Dominators, Inc.