Intrusion Detection Exchange Format (idwg)

In addition to this official charter maintained by the IETF Secretariat, there is additional information about this working group on the Web at:

       Additional IDWG Web Page

Last Modified: 2005-01-26


Security Area Director(s):

Security Area Advisor:

Mailing Lists:

General Discussion:
To Subscribe:
In Body: 'subscribe idwg-l' in the body

Description of Working Group:

Security incidents are becoming more common and more serious, and
intrusion detection systems are becoming of increasing commercial
importance.  Numerous intrusion detection systems are important in the
market and different sites will select different vendors. Since
incidents are often distributed over multiple sites, it is likely that
different aspects of a single incident will be visible to different
systems.  Thus it would be advantageous for diverse intrusion
detection systems to be able to share data on attacks in progress.

The purpose of the Intrusion Detection Working Group is to define data
formats and exchange procedures for sharing information of interest to
intrusion detection and response systems, and to management systems
which may need to interact with them.  The Intrusion Detection Working
Group will coordinate its efforts with other IETF Working Groups.

The outputs of this working group will be:

1. A requirements document, which describes the high-level functional
  requirements for communication between intrusion detection systems
  and requirements for communication between intrusion detection
  systems and with management systems, including the rationale for
  those requirements.  Scenarios will be used to illustrate the

2. A common intrusion language specification, which describes data
  formats that satisfy the requirements.

3. A framework document, which identifies existing protocols best used
  for communication between intrusion detection systems, and describes
  how the devised data formats relate to them.

Goals and Milestones:

Done    Submit Requirements document as an Internet-Draft
Done    Submit Framework and Language documents as Internet-Drafts
Done    Submit Requirements document to IESG for consideration as an RFC.
Done    Submit Language documents to IESG for consideration as RFCs.
Done    Submitt transport documnet to IESG for consideration as RFCs

No Current Internet-Drafts

Request For Comments:

The TUNNEL Profile (RFC 3620) (35365 bytes)
Intrusion Detection Mesage Exchange Requirements (RFC 4766) (50816 bytes)
The Intrusion Detection Message Exchange Format (IDMEF) (RFC 4765) (307966 bytes)
The Intrusion Detection Exchange Protocol (IDXP) (RFC 4767) (56048 bytes)