idmef

README

IDMEF for Go

Intrusion Detection Message Exchange Format

Go library for authoring and parsing data in IDMEF format (IETF RFC 4765).

Usage

There are two sets of Message structs, one for authoring and one for parsing. The reason is due to Go's lack of support for parsing XML with tag prefixes.

Authoring

Use the go-idmef (idmef) package structs to create the idmef.Message struct and then call xml.Marshal() or idmef.Message.Bytes().

An example is in the testdata/example_pingofdeath.go file.

Parsing

See unmarshal.ReadFile() function for an example to parse aa IDMEF XML file.

Coverage

• IDMEF-Message
  • Alert
    • Analyzer
    • CreateTime
    • DetectTime
    • AnalyzerTime
    • Source
      • Node
        • Address
      • User
        • UserId
      • Process
      • Service
    • Target
      • Node
        • Address
      • User
        • UserId
      • Process
      • Service
      • File
        • FileAccess
          • Permission
        • Linkage
    • Classification
      • Reference
    • Assessment
    • AdditionalData
  • Heartbeat
    • Analyzer
    • CreateTime
    • AdditionalData

Examples

The examples in RFC 4765 are included and tested in this repo. Go and XML representations are provided, parsed and compared. The following is a lists of the examples in RFC 4765.

• Denial-of-Service Attacks
  • The "teardrop" Attack (xml)
  • The "ping of death" Attack (xml)
• Port Scanning Attacks
  • Connection to a Disallowed Service (xml)
  • Simple Port Scanning
• Local Attacks
  • The "loadmodule" Attack
  • The "phf" Attack
  • File Modification (xml)
• System Policy Violation (xml)
• Correlated Alerts
• Analyzer Assessments (xml)
• Heartbeat

Notes

1. idmef is the authoring package and creates XML with the idmef tag.
2. unmarshal is the parsing package which reads in XML files but does not support the idmef tag prefix due to Go issue 9519. Unmarshal or parse a file using unmarshal to receive a *unmarshal.Message which can then be converted to an authoring struct with *unmarshal.Message.Common().

References

IDMEF

• IETF RFC 4765: Format Details
• IETF RFC 4766: Format Requirements
• IETF RFC 4767: Recommended Transport Protocol (IDXP)
• IDMEF on Wikipedia
• XML Schema-Based Minification for Communication of Security Information and Event
• awesome-idmef

Alternative Formats

• OSSEC: https://www.ossec.net/docs/formats/alerts.html
• OSSEM: https://github.com/OTRF/OSSEM

Go XML situation

1. encoding/xml: support for XML namespace prefixes
2. xml namespace prefix issue at go: "To fix that you need to use two structs, one for Unmarshalling and second to Marshalling data"
3. Unable to parse xml in GO with : in tags

Other Implementations

1. PHP - https://github.com/fpoirotte/php-idmef

Comparisons

1. Power of the IDMEF format
2. SDEE vs IDMEF?
3. Security Log Standard: Still an Open Question

Credits

timestamp.Timestamp is based on code from github.com/coreos/mantle under the Apache 2.0 license. This is a large, archived codebase with many dependencies.

Documentation

Index

• Constants
• type Action
• type AdditionalData
• type Address
• type Alert
• type Analyzer
• type Assessment
• type Classification
• type Confidence
• type File
• type FileAccess
• type Impact
• type Linkage
• type Message
  • func (m *Message) Bytes(prefix, indent string) ([]byte, error)
• type Node
• type Permission
• type Process
• type Reference
• type Service
• type Source
• type Target
• type Time
  • func NewTime(t time.Time) Time
  • func (t *Time) InflateNtpStamp()
• type User
• type UserId

Constants

const (
	IPV4Addr    = "ipv4-addr"
	IPV4AddrHex = "ipv4-addr-hex"
	IPV4NetMask = "ipv4-net-mask"

	CategoryOSDevice = "os-device"

	LocationConsole = "console"
	LocationLocal   = "local"

	ServiceDNS     = "dns"
	ServiceFinger  = "finger"
	ServiceLogin   = "login"
	ServiceNIS     = "nis"
	ServiceNISPlus = "nisplus"

	UserIdTypeCurrentUser  = "current-user"
	UserIdTypeOriginalUser = "original-user"
	UserIdTypeGroupPrivs   = "group-privs"
	UserIdTypeUserPrivs    = "user-privs"

	OriginUserSpecific   = "user-specific"
	OriginVendorSpecific = "vendor-specific"

	DateTime  = "date-time"
	StartTime = "start-time"
	StopTime  = "stop-time"
)

const (
	XMLNSIDMEFUrl     = "http://iana.org/idmef"
	XMLNSIDMEFVersion = "1.0"
)

Types

type Action

type Action struct {
	Action   string `xml:",chardata"`
	Category string `xml:"category,attr,omitempty"`
}

type AdditionalData

type AdditionalData struct {
	Type     string    `xml:"type,attr,omitempty"`
	Meaning  string    `xml:"meaning,attr,omitempty"`
	DateTime time.Time `xml:"idmef:date-time,omitempty"`
}

type Address

type Address struct {
	Ident    string `xml:"ident,attr,omitempty"`
	Category string `xml:"category,attr,omitempty"`
	Address  string `xml:"idmef:address,omitempty"`
	Netmask  string `xml:"idmef:netmask,omitempty"`
}

type Alert

type Alert struct {
	MessageId      string           `xml:"messageid,attr,omitempty"`
	Analyzer       Analyzer         `xml:"idmef:Analyzer"`       // Exactly one.
	CreateTime     Time             `xml:"idmef:CreateTime"`     // Exactly one.
	DetectTime     *Time            `xml:"idmef:DetectTime"`     // Zero or one
	AnalyzerTime   *Time            `xml:"idmef:AnalyzerTime"`   // Zero or one.
	Source         []Source         `xml:"idmef:Source"`         // Zero or more.
	Target         []Target         `xml:"idmef:Target"`         // Zero or more.
	Classification Classification   `xml:"idmef:Classification"` // Exactly one.
	Assessment     *Assessment      `xml:"idmef:Assessment"`
	AdditionalData []AdditionalData `xml:"idmef:AdditionalData"`
}

type Analyzer

type Analyzer struct {
	AnalyzerId string `xml:"analyzerid,attr"`
	OSType     string `xml:"ostype,attr,omitempty"`
	OSVersion  string `xml:"osversion,attr,omitempty"`
	Node       *Node  `xml:"idmef:Node"`
}

type Assessment

type Assessment struct {
	Impact     *Impact     `xml:"idmef:Impact,omitempty"`
	Action     []Action    `xml:"idmef:Action,omitempty"`
	Confidence *Confidence `xml:"idmef:Confidence,omitempty"`
}

type Classification

type Classification struct {
	Text      string      `xml:"text,attr"`
	Reference []Reference `xml:"idmef:Reference,omitempty"`
}

type Confidence

type Confidence struct {
	Rating string `xml:"rating,attr,omitempty"`
}

type File

type File struct {
	Category   string       `xml:"category,attr,omitempty"`
	FSType     string       `xml:"fstype,attr,omitempty"`
	Name       string       `xml:"idmef:name,omitempty"`
	Path       string       `xml:"idmef:path,omitempty"`
	FileAccess []FileAccess `xml:"idmef:FileAccess,omitempty"`
	Linkage    *Linkage     `xml:"idmef:Linkage,omitempty"`
}

type FileAccess

type FileAccess struct {
	UserId     *UserId      `xml:"idmef:UserId,omitempty"`
	Permission []Permission `xml:"idmef:permission,omitempty"`
}

type Impact

type Impact struct {
	Severity   string `xml:"severity,attr,omitempty"`
	Completion string `xml:"completion,attr,omitempty"`
	Type       string `xml:"type,attr,omitempty"`
}

type Linkage

type Linkage struct {
	Category string `xml:"category,attr,omitempty"`
	Name     string `xml:"idmef:name,omitempty"`
	Path     string `xml:"idmef:path,omitempty"`
}

type Message

type Message struct {
	XMLName    xml.Name `xml:"idmef:IDMEF-Message"`
	XMLNSIDMEF string   `xml:"xmlns:idmef,attr"`
	Version    string   `xml:"version,attr"`
	Alert      *Alert   `xml:"idmef:Alert"`
}

Message is for authoring. For parsing use `github.com/grokify/go-idmef/unmarshal/Message`.

func (*Message) Bytes

func (m *Message) Bytes(prefix, indent string) ([]byte, error)

type Node

type Node struct {
	Ident    string   `xml:"ident,attr,omitempty"`
	Category string   `xml:"category,attr,omitempty"`
	Address  *Address `xml:"idmef:Address,omitempty"`
	Location string   `xml:"idmef:location,omitempty"`
	Name     string   `xml:"idmef:name,omitempty"`
}

type Permission

type Permission struct {
	Perms string `xml:"perms,attr,omitempty"`
}

type Process

type Process struct {
	Name string `xml:"idmef:name,omitempty"`
	PID  int    `xml:"idmef:pid,omitempty"`
	Path string `xml:"idmef:path,omitempty"`
	Arg  string `xml:"idmef:arg,omitempty"`
}

type Reference

type Reference struct {
	Origin  string `xml:"origin,attr,omitempty"`
	Meaning string `xml:"meaning,attr,omitempty"`
	Name    string `xml:"idmef:name,omitempty"`
	URL     string `xml:"idmef:url,omitempty"`
}

type Service

type Service struct {
	Ident string `xml:"ident,attr,omitempty"`
	Name  string `xml:"idmef:name,omitempty"`
	Port  int    `xml:"idmef:port,omitempty"`
}

type Source

type Source struct {
	Ident   string   `xml:"ident,attr,omitempty"`
	Spoofed string   `xml:"spoofed,attr,omitempty"` // Source
	Node    *Node    `xml:"idmef:Node,omitempty"`
	User    *User    `xml:"idmef:User,omitempty"`
	Process *Process `xml:"idmef:Process,omitempty"`
	Service *Service `xml:"idmef:Service,omitempty"`
}

type Target

type Target struct {
	Ident   string   `xml:"ident,attr,omitempty"`
	Decoy   string   `xml:"decoy,attr,omitempty"` // Target
	Node    *Node    `xml:"idmef:Node,omitempty"`
	User    *User    `xml:"idmef:User,omitempty"`
	Process *Process `xml:"idmef:Process,omitempty"`
	Service *Service `xml:"idmef:Service,omitempty"`
	File    *File    `xml:"idmef:File,omitempty"`
}

type Time

type Time struct {
	Time     time.Time `xml:",chardata"`
	NtpStamp string    `xml:"ntpstamp,attr"`
}

func NewTime

func NewTime(t time.Time) Time

func (*Time) InflateNtpStamp

func (t *Time) InflateNtpStamp()

type User

type User struct {
	Ident    string   `xml:"ident,attr,omitempty"`
	Category string   `xml:"category,attr,omitempty"`
	UserId   []UserId `xml:"idmef:UserId,omitempty"`
}

type UserId

type UserId struct {
	Ident  string `xml:"ident,attr,omitempty"`
	Type   string `xml:"type,attr,omitempty"`
	Name   string `xml:"idmef:name,omitempty"`
	Number string `xml:"idmef:number,omitempty"`
}