Schema cidee.xsd


targetNamespace:  http://www.cisco.com/cids/2006/08/cidee
 
Elements  Complex types  Simple types 
alertDetails  AbstractEvent  AlertSummaryType 
appInstanceId  AbstractStatusDetail  ApplicationName 
applicationStarted  ApplicationInstance  AttackRelevance 
applicationStopped  ApplicationVersion  ContextBytes 
appName  AttackParticipant  ErrorDescription 
autoUpgradeServerCheck  ErrorMessage  ErrorName 
blockConnectionRequested  GlobalEventId  ErrorSeverity 
certificatesChanged  IpLog  InterfaceName 
context  NetProtocol  IpLogId 
controlTransaction  OriginatorInstance  IpLogStatus 
defaultConfigCheck  RateLimitType  IPv4Address 
deniedAttacker  Requestor  LocalEventId 
deniedAttackerListClearedByUser  ShunInfo  NetLocality 
deniedAttackerServicePair  TransactionParameter  NetProtocolName 
deniedAttackerVictimPair  OsType 
deniedFlow  Percentage 
denyAttackerCompleted  PortNumber 
denyAttackerRequestedNotPerformed  ShunCause 
denyAttackerServicePairRequestedNotPerformed  ShutdownReason 
denyAttackerStarted  SoftwareVersion 
denyAttackerVictimPairRequestedNotPerformed  SyslogSeverity 
denyFlowRequestedNotPerformed  TargetValue 
denyPacketRequestedNotPerformed  Traits 
downloadUpgradeFile  TransactionCommand 
engineBuildSkipped  UserAccountName 
engineBuildStarted 
engineBuildSuccess 
eventCount 
evError 
evShunRqst 
evStatus 
externalProductInterfaceOffline 
externalProductInterfaceOnline 
interface 
ipLogAdded 
ipLogCompleted 
ipLogIds 
ipLogRemoved 
ipLogStarted 
logAttackerPacketsActivated 
loginAction 
logPairPacketsActivated 
logVictimPacketsActivated 
managedDeviceOffline 
managedDeviceOnline 
marsCategory 
maxDeniedAttackersReached 
netInlineBypassStarted 
netInlineBypassStopped 
netInterfaceAdded 
netInterfaceLinkDown 
netInterfaceLinkUp 
netInterfaceMissedPacketThresholdExceeded 
netInterfaceRemoved 
netInterfaceTrafficStarted 
netInterfaceTrafficStopped 
os 
packetDrop 
packetUnscanned 
protocol 
rateLimitRequested 
riskRatingValue 
shunEntryAdded 
shunEntryRemoved 
shunningDisabled 
shunningEnabled 
sigDetails 
signatureUpdateLicenseExpired 
signatureUpdateLicenseExpiring 
signatureUpdateNoLicense 
snmpGetRequested 
snmpSetRequested 
snmpTrapRequested 
softwareDowngradeCompleted 
softwareDowngradeInitiated 
softwareUpgradeCompleted 
softwareUpgradeInitiated 
sshHostKeyChanged 
startedDiscardingHostPostures 
startedDiscardingWatchlistAddresses 
statusDetail 
stoppedDiscardingHostPostures 
stoppedDiscardingWatchlistAddresses 
subsigId 
summary 
syslogMessage 
threatRatingValue 
triggerPacket 


element alertDetails
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Textual details about the specific alert instance, not just the signature. Zero or one instances of this element may be children of SDEE's evIdsAlert element - immediately following the context element.

element appInstanceId
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
properties
content simple
used by
complexTypes ApplicationInstance OriginatorInstance
facets
minLength 1
maxLength 32
annotation
documentation 
The id of this instance of the application - typically the process id (pid). Zero or one instances of this element may be children of SDEE's evIdsAlert/originator element - immediately following the appName element.

element applicationStarted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:version
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Indicates that the originator application has started and has completed its initialization.

element applicationStarted/version
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:ApplicationVersion
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
buildType  xsd:stringrequired      
documentation 
Typically this will be some string such as "release" or "debug". In some cases, it is the id of the builder of the application.
buildDateTime  xsd:dateTime      

element applicationStopped
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:reason
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Indicates that the originator application is shutting down due to a execShutdownApplication control transaction.

element applicationStopped/reason
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:ShutdownReason
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
A string explaining how and/or why the application was shut down.

element appName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:ApplicationName
properties
content complex
used by
complexTypes ApplicationInstance OriginatorInstance
facets
minLength 1
maxLength 64
pattern [a-zA-Z0-9_]+
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Name of the application. Zero or one instances of this element may be children of SDEE's evIdsAlert/originator element - immediately following the hostId element.

element autoUpgradeServerCheck
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:uri cid:packageFileName cid:result
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates the status of an attempt to evaluate the file listing on the upgrade server. If successful, the upgrade server’s file listing was successfully accessed, however, there is no indication in this message as to whether a valid upgrade actually exists. If unsuccessful, then an error occurred while trying to reach the upgrade server or access its file listing.

element autoUpgradeServerCheck/uri
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
URI of auto upgrade server directory.

element autoUpgradeServerCheck/packageFileName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
properties
isRef 0
content simple
annotation
documentation 
Name of package file to be auto downloaded and installed.

element autoUpgradeServerCheck/result
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
status  xsd:booleanrequired      
annotation
documentation 
Upgrade result. Status attribute indicates whether upgrade server’s file listing was successfully accessed; a true value indicates successful access.

element blockConnectionRequested
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that a TCP connection has been requested to be blocked as a result of the alert. This element may be omitted if and only if its value is false.

element certificatesChanged
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Indicates that the host's X.509v3 certificates were changed.

element context
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
properties
content complex
children cid:fromTarget cid:fromAttacker
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Context buffer indicating the data that was sent just prior to and immediately after the alert was triggered. Zero or one instances of this element may be children of SDEE's evIdsAlert element - immediately following the summary element.

element context/fromTarget
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of cid:ContextBytes
properties
isRef 0
content simple
annotation
documentation 
Base64-encoded representation of the stream data that was sourced by the target. 

element context/fromAttacker
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:ContextBytes
properties
isRef 0
content simple
annotation
documentation 
Base64-encoded representation of the stream data that was sourced by the attacker

element controlTransaction
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:requestor cid:requestParameter cid:responseParameter cid:requestData cid:responseData
attributes
Name  Type  Use  Default  Fixed  Annotation
command  cid:TransactionCommandrequired      
successful  xsd:booleanoptional      
annotation
documentation 
Content of an evStatus event. Contains information about a control transaction that has occurred. Note that the originator of the event is the application instance to which the control transaction request was originally directed.  The 'command' attribute specifies the control transaction command that was requested.  The 'successful' attribute indicates whether the control transaction request was completed without error.  The 'successful' attribute may be omitted if and only if its value is true.

element controlTransaction/requestor
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:Requestor
properties
isRef 0
content complex
children cid:user cid:application
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The user or application that initiated the control transaction.

element controlTransaction/requestParameter
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:TransactionParameter
properties
isRef 0
content complex
children cid:name cid:value
attributes
Name  Type  Use  Default  Fixed  Annotation

element controlTransaction/responseParameter
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:TransactionParameter
properties
isRef 0
content complex
children cid:name cid:value
attributes
Name  Type  Use  Default  Fixed  Annotation

element controlTransaction/requestData
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The XML data that was contained in the control transaction request.

element controlTransaction/responseData
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The XML data that was contained in the conttrol transaction response.

element defaultConfigCheck
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Indicates that built-in signatures are being loaded.

element deniedAttacker
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that the traffic from originating from the attacker is being blocked as a result of the alert. This element may be omitted if and only if its value is false.

element deniedAttackerListClearedByUser
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the denied attacker list was cleared as a result of user action.

element deniedAttackerServicePair
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that traffic from originating from the attacker’s address and destined for the destination service port identified in the alert is being denied as a result of the alert. This element may be omitted if and only if its value is false.

element deniedAttackerVictimPair
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that traffic from originating from the attacker’s address and destined for the victim’s address identified in the alert is being denied as a result of the alert. This element may be omitted if and only if its value is false.

element deniedFlow
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that the traffic on the TCP connection being blocked as a result of the alert. This element may be omitted if and only if its value is false.

element denyAttackerCompleted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:address
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Completed denying packets originating from an attacker.

element denyAttackerCompleted/address
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IPv4Address
properties
isRef 0
content complex
facets
pattern (((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))\.){3}((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The attaker's IP address

element denyAttackerRequestedNotPerformed
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates whether the traffic from the attacker that triggered the alert would have been denied as a result of the alert if the IPS was operating in inline mode. However, this action was not actually taken because the IPS was operating in promiscuous mode. This element may be omitted if and only if its value is false.

element denyAttackerServicePairRequestedNotPerformed
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that traffic from originating from the attacker’s address and destined for the destination service port identified in the alert would have been denied as a result of the alert if the IPS was operating in inline mode. However, this action was not actually taken because the IPS was operating in promiscuous mode. This element may be omitted if and only if its value is false.

element denyAttackerStarted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:address
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Started denying packets originating from an attacker.

element denyAttackerStarted/address
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IPv4Address
properties
isRef 0
content complex
facets
pattern (((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))\.){3}((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The attaker's IP address

element denyAttackerVictimPairRequestedNotPerformed
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that traffic from originating from the attacker’s address and destined for the victim’s address identified in the alert would have been denied as a result of the alert if the IPS was operating in inline mode. However, this action was not actually taken because the IPS was operating in promiscuous mode. This element may be omitted if and only if its value is false.

element denyFlowRequestedNotPerformed
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates whether the flow that triggered the alert would have been denied as a result of the alert if the IPS was operating in inline mode. However, this action was not actually taken because the IPS was operating in promiscuous mode. This element may be omitted if and only if its value is false.

element denyPacketRequestedNotPerformed
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates whether the packet that triggered the alert would have been denied as a result of the alert if the IPS was operating in inline mode. However, the packet was not actually denied because the IPS was operating in promiscuous mode. This element may be omitted if and only if its value is false.

element downloadUpgradeFile
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:uri cid:result
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that a download of an upgrade file was attempted.

element downloadUpgradeFile/uri
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
URI of the download upgrade file

element downloadUpgradeFile/result
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
status  xsd:booleanrequired      
annotation
documentation 
Download result. Status attribute indicates whether the download successfully completed; a true value indicates successful completion.

element engineBuildSkipped
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Build of the specified engine was skipped because the engine is up-to-date.

element engineBuildStarted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Build of the specified engine has started.

element engineBuildSuccess
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Build of the specified engine has successfully completed.

element eventCount
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:unsignedInt
properties
content simple
annotation
documentation 
The SOAP Body's child element that is returned in the response to a queryEventCount request.

element evError
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractEvent
properties
content complex
children cid:originator cid:time cid:errorMessage
attributes
Name  Type  Use  Default  Fixed  Annotation
eventId  sd:LocalEventIdrequired      
vendor  xsd:stringrequired      
severity  cid:ErrorSeverityrequired      
annotation
documentation 
Event indicating that an error or warning has occurred.

element evError/errorMessage
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:ErrorMessage
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
name  cid:ErrorNamerequired      
annotation
documentation 
A textual description of the error or warning (in case the 'name' attribute value is errWarning).  The 'name' attribute is one of the standard error names chosen from the enumeration type 'ErrorName'. 

element evShunRqst
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractEvent
properties
content complex
children cid:originator cid:time cid:shunInfo cid:evAlertRef
attributes
Name  Type  Use  Default  Fixed  Annotation
eventId  sd:LocalEventIdrequired      
vendor  xsd:stringrequired      
annotation
documentation 
Event requesting that a network access controller perform a shun action.  Member of the 'event' substitution group.

element evShunRqst/shunInfo
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:ShunInfo
properties
isRef 0
content complex
children cid:host cid:network cid:rateLimit cid:timeoutMinutes cid:cause cid:removable
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Details on the shun to be performed.

element evShunRqst/evAlertRef
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:GlobalEventId
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
hostId  sd:HostIdrequired      
annotation
documentation 
Reference to an evAlert event that caused the shun to be initiated.  This element should be included if the shun was initiated by a sensor as the result of an alert.  It is used to provide traceability back to the original alert.

element evStatus
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractEvent
properties
content complex
children cid:originator cid:time cid:statusDetail
attributes
Name  Type  Use  Default  Fixed  Annotation
eventId  sd:LocalEventIdrequired      
vendor  xsd:stringrequired      
annotation
documentation 
Event used to report a status message that indicates that something of potential interest occurred on the host. Different types of status messages may be reported in the status event – one message per event. Each type of status message may contain a set of data elements that are specific to the type of occurrence that the status message is describing. The information in many of the status messages may be useful for audit purposes.

element externalProductInterfaceOffline
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:address
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the communications for the interface to an external product has gone offline.

element externalProductInterfaceOffline/address
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IPv4Address
properties
isRef 0
content complex
facets
pattern (((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))\.){3}((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The external product's IP address

element externalProductInterfaceOnline
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:address
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the communications for the interface to an external product has been established.

element externalProductInterfaceOnline/address
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IPv4Address
properties
isRef 0
content complex
facets
pattern (((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))\.){3}((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The external product's IP address

element interface
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
physical  optional      
documentation 
Identifies the physical interface only if the physical interface is different from this element’s value.
backplane  optional      
documentation 
Identifies the backplane interface only if the backplane interface is different from the physical interface.
context  optional      
documentation 
Identifies the security context with which the named interface specified in this element's value is associated.
annotation
documentation 
Identifies the interface on which the activity was detected. This element's value is intended to be the most meaningful interface identfier that is available. This element's attrbiutes provide additional interface identification details and qualifiers. Zero or one instances of this element may be children of SDEE's evIdsAlert element immediately following the riskRatingValue element.

element ipLogAdded
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:ipLog
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Reports that a new ip logging session has been added in a sensor.  Member of the 'cid:statusDetail' substitution group.  The ip log document may not actually be created until the first packet is added to the log, at which time an ipLogStarted status event will be generated. 

element ipLogAdded/ipLog
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IpLog
properties
isRef 0
content complex
children cid:addr cid:virtualSensorName cid:evAlertRef cid:beginTime cid:endTime cid:minutesRemaining cid:bytesCaptured cid:bytesRemaining cid:packetsCaptured cid:packetsRemaining cid:status
attributes
Name  Type  Use  Default  Fixed  Annotation
ipLogId  cid:IpLogIdrequired      
annotation
documentation 
Information about the ip log that was added.  The ipLogId attribute uniquely (with host-scope) identifies the ip log document for use in other control transactions (see execStopIpLog, ipLogStarted, and ipLogCompleted) and for retrieving the log document via RDEP.

element ipLogCompleted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:ipLog
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Member of the 'cid:statusDetail' substitution group. Reports that an ip logging session has ended, either due to a timeout or a control transaction.  The document is still available for retrieval until it is actually deleted, at which time an ipLogRemoved status event will be generated. 

element ipLogCompleted/ipLog
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IpLog
properties
isRef 0
content complex
children cid:addr cid:virtualSensorName cid:evAlertRef cid:beginTime cid:endTime cid:minutesRemaining cid:bytesCaptured cid:bytesRemaining cid:packetsCaptured cid:packetsRemaining cid:status
attributes
Name  Type  Use  Default  Fixed  Annotation
ipLogId  cid:IpLogIdrequired      
annotation
documentation 
Information about the ip log instance that just completed.  The ipLogId attribute uniquely (with host-scope) identifies the ip log document for retrieving the log document via RDEP.

element ipLogIds
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
properties
content complex
children cid:ipLogId
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
List of IP log identifiers for IP logs that were added as the result of this alert. Zero or one instances of this element may be children of SDEE's evIdsAlert element - immediately following the alertDetails element.

element ipLogIds/ipLogId
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:IpLogId
properties
isRef 0
content simple
annotation
documentation 
Set of IP log identifiers.

element ipLogRemoved
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:ipLogId
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Member of the 'cid:statusDetail' substitution group.  Reports that an ip log document has been deleted. The log document will no longer be included in the response to a getIpLogList control transaction and can no longer be retrieved using RDEP.

element ipLogRemoved/ipLogId
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IpLogId
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
A unique identifier for the ip log document that has been deleted. The document with that id is no longer available for retrieval.

element ipLogStarted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:ipLog
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Member of the 'cid:statusDetail' substitution group.  Reports that an ip logging session has started.  The logging session may start immediately after the log is added, or it may be delayed and started only when the first packet is logged.
   

element ipLogStarted/ipLog
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IpLog
properties
isRef 0
content complex
children cid:addr cid:virtualSensorName cid:evAlertRef cid:beginTime cid:endTime cid:minutesRemaining cid:bytesCaptured cid:bytesRemaining cid:packetsCaptured cid:packetsRemaining cid:status
attributes
Name  Type  Use  Default  Fixed  Annotation
ipLogId  cid:IpLogIdrequired      
annotation
documentation 
Information about the ip log instance that started.  The ipLogId attribute uniquely (with host-scope) identifies the ip log document for use in other control transactions (see execStopIpLog, and ipLogCompleted) and for retrieving the log document via RDEP.

element logAttackerPacketsActivated
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that packets associated with the attacker(s) identified by this alert are being logged.  This element may be omitted if and only if its value is false.

element loginAction
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:userName cid:userAddress
attributes
Name  Type  Use  Default  Fixed  Annotation
action  required      
annotation
documentation 
Content of an evStatus event. A login action occurred.

element loginAction/userName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:UserAccountName
properties
isRef 0
content simple
facets
minLength 1
maxLength 64
pattern [a-zA-Z0-9_\-]+

element loginAction/userAddress
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IPv4Address
properties
isRef 0
content complex
facets
pattern (((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))\.){3}((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))
attributes
Name  Type  Use  Default  Fixed  Annotation
port  cid:PortNumberrequired      

element logPairPacketsActivated
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that packets associated with the attacker/victim pair(s) identified by this alert are being logged. This element may be omitted if and only if its value is false.

element logVictimPacketsActivated
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that packets associated with the victim(s) identified by this alert are being logged. This element may be omitted if and only if its value is false.

element managedDeviceOffline
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:addr
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that a managed device (router / firewall / switch) has gone offline, or communication with that device has been terminated.  Member of the 'cid:statusDetail' substitution group.

element managedDeviceOffline/addr
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IPv4Address
properties
isRef 0
content complex
facets
pattern (((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))\.){3}((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Ip address of the managed device

element managedDeviceOnline
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:addr
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that a managed device (router / firewall / switch) has gone online, or communication with that device has been established.  Member of the 'cid:statusDetail' substitution group.

element managedDeviceOnline/addr
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IPv4Address
properties
isRef 0
content complex
facets
pattern (((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))\.){3}((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Ip address of the managed device

element marsCategory
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
annotation
documentation 
Optional identification of the MARS attack catergories associated with the signature. Zero or more instances of this element may be children of SDEE's evIdsAlert/signature element - immediately following the sigDetails element.

element maxDeniedAttackersReached
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the maximum number of denied attackers for which packets are blocked has been reached.

element netInlineBypassStarted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that packet traffic on inline interfaces is now bypassing the analysis engine and is therefore not being analyzed.

element netInlineBypassStopped
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that packet traffic on inline interfaces is no longer bypassing the analysis engine.

element netInterfaceAdded
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:interfaceName
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that a network interface has been physically added to the sensor.

element netInterfaceAdded/interfaceName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:InterfaceName
properties
isRef 0
content simple
facets
pattern [a-zA-Z]+[0-9]+/[0-9]+

element netInterfaceLinkDown
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:interfaceName
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the specified network interface has lost link.

element netInterfaceLinkDown/interfaceName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:InterfaceName
properties
isRef 0
content simple
facets
pattern [a-zA-Z]+[0-9]+/[0-9]+

element netInterfaceLinkUp
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:interfaceName
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the specified network interface has established link.

element netInterfaceLinkUp/interfaceName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:InterfaceName
properties
isRef 0
content simple
facets
pattern [a-zA-Z]+[0-9]+/[0-9]+

element netInterfaceMissedPacketThresholdExceeded
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:interfaceName
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the percentage of missed packets on the specified interface has exceeded the configured threshold.

element netInterfaceMissedPacketThresholdExceeded/interfaceName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:InterfaceName
properties
isRef 0
content simple
facets
pattern [a-zA-Z]+[0-9]+/[0-9]+

element netInterfaceRemoved
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:interfaceName
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that a network interface has been physically removed from the sensor.

element netInterfaceRemoved/interfaceName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:InterfaceName
properties
isRef 0
content simple
facets
pattern [a-zA-Z]+[0-9]+/[0-9]+

element netInterfaceTrafficStarted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:interfaceName
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that packet traffic has started on the specified network interface.

element netInterfaceTrafficStarted/interfaceName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:InterfaceName
properties
isRef 0
content simple
facets
pattern [a-zA-Z]+[0-9]+/[0-9]+

element netInterfaceTrafficStopped
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:interfaceName
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that packet traffic has stopped on the specified network interface.

element netInterfaceTrafficStopped/interfaceName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:InterfaceName
properties
isRef 0
content simple
facets
pattern [a-zA-Z]+[0-9]+/[0-9]+

element os
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
idSource  required      
type  cid:OsTyperequired      
relevance  cid:AttackRelevancerequired      
annotation
documentation 
Target's operating system information. Zero or one instances of this element may be children of SDEE's evIdsAlert/participants/target element immediately following the port element.

element packetDrop
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Triggers when an engine is not available and the system drops all packets for that engine due to a fail close setting.

element packetUnscanned
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Triggers when an engine is not available and the system passes packets for that engine without scanning due to a fail open setting.

element protocol
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Identifies the protocol associated with the alert. Zero or one instances of this element may be children of SDEE's evIdsAlert element immediately following the interface element.

element rateLimitRequested
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that traffic rate limiting based on the source address and protocol associated with the alert has been requested on external network devices. This element may be omitted if and only if its value is false.

element riskRatingValue
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:Percentage
properties
content complex
facets
minInclusive 0
maxInclusive 100
attributes
Name  Type  Use  Default  Fixed  Annotation
targetValueRating  cid:TargetValueoptional      
documentation 
Identifies the asset values associated with target(s) identified in alerts.
attackRelevanceRating  cid:AttackRelevanceoptional  unknown    
documentation 
An enumerated value used to indicate an attack's relevance to its destination target(s).
watchlist  optional  0    
documentation 
Identifies the amount that the risk rating value was increase due to the source(s) of the activity associated with the alert being on a watchlist.
annotation
documentation 
Value that represents the calculated risk associated with the detected activity. The risk value is calculated using multiple factors. The risk value has a range between 0 and 100 (inclusive), where a value of 0 represents the lowest risk and 100 the greatest risk. Zero or one instances of this element may be children of SDEE's evIdsAlert element - immediately following the triggerPacket element.

element shunEntryAdded
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:shunInfo cid:evAlertRef
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that a new entry has been added to the shun list.  Member of the 'cid:statusDetail' substitution group.

element shunEntryAdded/shunInfo
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:ShunInfo
properties
isRef 0
content complex
children cid:host cid:network cid:rateLimit cid:timeoutMinutes cid:cause cid:removable
attributes
Name  Type  Use  Default  Fixed  Annotation

element shunEntryAdded/evAlertRef
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:GlobalEventId
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
hostId  sd:HostIdrequired      
annotation
documentation 
Reference to an evAlert event that caused the shun to be initiated.  This element should be included if the shun was initiated by a sensor as the result of an alert.  It is used to provide traceability back to the original alert.

element shunEntryRemoved
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:shunInfo
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of en evStatus event. Indicates that a shun entry has expired or was removed from the shun list.  Member of the 'cid:statusDetail' substitution group.

element shunEntryRemoved/shunInfo
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:ShunInfo
properties
isRef 0
content complex
children cid:host cid:network cid:rateLimit cid:timeoutMinutes cid:cause cid:removable
attributes
Name  Type  Use  Default  Fixed  Annotation

element shunningDisabled
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that shunning has been disabled.  Member of the 'cid:statusDetail' substitution group.

element shunningEnabled
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that shunning has been enabled.  Member of the 'cid:statusDetail' substitution group.

element sigDetails
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
properties
content simple
annotation
documentation 
Optional details for the reported signature. Zero or one instances of this element may be children of SDEE's evIdsAlert/signature element - immediately following the subsigId element.

element signatureUpdateLicenseExpired
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the signature update license has expired.

element signatureUpdateLicenseExpiring
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the signature update license will be expiring soon.

element signatureUpdateNoLicense
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that no signature update license is installed on the system.

element snmpGetRequested
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:requestor cid:requestedOid
attributes
Name  Type  Use  Default  Fixed  Annotation
success  xsd:booleanoptional      
annotation
documentation 
Content of an evStatus event.  Indicates that the an SNMP get was requested.  The success attribute indicates if the get request was completed successfully.  The success attribute can be eliminated if and only if the get was unsuccessful.

element snmpGetRequested/requestor
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:IPv4Address
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
port  cid:PortNumberrequired      
annotation
documentation 
The network information of the host that made the request. 

element snmpGetRequested/requestedOid
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
properties
isRef 0
content simple
annotation
documentation 
The OID that was requested in the SNMP get.

element snmpSetRequested
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:requestor cid:requestedOid
attributes
Name  Type  Use  Default  Fixed  Annotation
success  xsd:booleanoptional      
annotation
documentation 
Content of an evStatus event.  Indicates that the an SNMP set was requested.  The success attribute indicates if the set request was completed successfully.  The success attribute can be eliminated if and only if the set was unsuccessful.

element snmpSetRequested/requestor
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:IPv4Address
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
port  cid:PortNumberrequired      
annotation
documentation 
The network information of the host that made the request. 

element snmpSetRequested/requestedOid
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
properties
isRef 0
content simple
annotation
documentation 
The OID that was requested in the SNMP set.

element snmpTrapRequested
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates that an SNMP trap was requested to be generated for this alert. This element may be omitted if and only if its value is false.

element softwareDowngradeCompleted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:upgradeName cid:oldVersion cid:newVersion cid:success
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Indicates that the uninstaller for a software upgrade has completed.

element softwareDowngradeCompleted/upgradeName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The name of the upgrade package that was uninstalled.

element softwareDowngradeCompleted/oldVersion
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:SoftwareVersion
properties
isRef 0
content complex
facets
minLength 1
maxLength 64
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
System software version before the upgrade was uninstalled.

element softwareDowngradeCompleted/newVersion
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:SoftwareVersion
properties
isRef 0
content complex
facets
minLength 1
maxLength 64
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
System software version after the upgrade was uninstalled.  If omitted, should be assumed to be the same as oldVersion.

element softwareDowngradeCompleted/success
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates whether the upgrade was successfully uninstalled.

element softwareDowngradeInitiated
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:upgradeName cid:oldVersion
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Indicates that the uninstaller for a software upgrade has started.

element softwareDowngradeInitiated/upgradeName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The name of the upgrade package to be uninstalled.

element softwareDowngradeInitiated/oldVersion
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:SoftwareVersion
properties
isRef 0
content complex
facets
minLength 1
maxLength 64
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
System software version before the upgrade is uninstalled.

element softwareUpgradeCompleted
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:upgradeName cid:oldVersion cid:newVersion cid:success
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that a software upgrade has completed.

element softwareUpgradeCompleted/upgradeName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The name of the upgrade package that was installed

element softwareUpgradeCompleted/oldVersion
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:SoftwareVersion
properties
isRef 0
content complex
facets
minLength 1
maxLength 64
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
System software version before the upgrade was installed.

element softwareUpgradeCompleted/newVersion
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:SoftwareVersion
properties
isRef 0
content complex
facets
minLength 1
maxLength 64
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
System software version after the upgrade was installed.  If omitted, should be assumed to be the same as oldVersion.

element softwareUpgradeCompleted/success
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:boolean
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Indicates whether the upgrade was successfully installed.

element softwareUpgradeInitiated
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description cid:upgradeName cid:oldVersion
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that a software upgrade has begun.

element softwareUpgradeInitiated/upgradeName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The name of the upgrade package to be installed

element softwareUpgradeInitiated/oldVersion
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:SoftwareVersion
properties
isRef 0
content complex
facets
minLength 1
maxLength 64
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
System software version before the upgrade is installed.

element sshHostKeyChanged
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event.  Indicates that the host's SSH key was changed.

element startedDiscardingHostPostures
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the limit on the maximum number of active host postures that may be received from external products has been exceeded, and that received host postures are being discarded.

element startedDiscardingWatchlistAddresses
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the limit on the maximum number of watch listed addresses that may be received from external products has been exceeded, and that received watch listed addresses are being discarded.

element statusDetail
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:AbstractStatusDetail
properties
content complex
abstract true
children cid:description
used by
element evStatus
annotation
documentation 
Head element for the 'statusDetail' substitution group for content of an evStatus event.  This is an abstract type, so should never be instantiated directly.

element stoppedDiscardingHostPostures
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the number of active host postures received from external products no longer exceeds the limit, and that received host postures are no longer being discarded.

element stoppedDiscardingWatchlistAddresses
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the number of watch listed addresses received from external products no longer exceeds the limit, and that received watch listed addresses are no longer being discarded.

element subsigId
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:unsignedInt
properties
content simple
annotation
documentation 
Sub-signature ID. A single instance of this element is the first child of SDEE's evIdsAlert/signature element.

element summary
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:unsignedInt
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
summaryType  cid:AlertSummaryTyperequired      
final  xsd:booleanoptional      
initialAlert  cid:LocalEventIdrequired      
annotation
documentation 
If present, specifies that this is a summary alert, representing one or more alerts with common characteristics. The numeric value indicates the number of times the signature fired since the last summary alert with a matching 'initialAlert'  attribute value.  The first and all subsequent summary alerts in a sequence will use the eventId of a previous non-summary evIdsAlert in the initialAlert attribute value. All alerts represented by the summary alert share the same signature and sub-signature id.  The summaryType attribute defines the common characteristic(s) of all alerts in the summary.  The 'final' attribute indicates whether this is the last evAlert containing the same value in the 'initialAlert' attribute.  The 'final' attribute may be omitted if and only if its value is false. Zero or one instances of this element may be children of SDEE's evIdsAlert element - immediately following the avps element.

element syslogMessage
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:AbstractStatusDetail
properties
content complex
substGrp cid:statusDetail
children cid:description
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Content of an evStatus event. Indicates that the software reported a syslog message of potential interest. The actual syslog message is reported in the description element.

element threatRatingValue
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:Percentage
properties
content complex
facets
minInclusive 0
maxInclusive 100
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Value that represents the calculated threat associated with the detected activity. The threat value consists of the risk rating value adjusted for the mitigation action performed. The threat value has a range between 0 and 100 (inclusive), where a value of 0 represents the lowest threat and 100 the greatest threat. Zero or one instances of this element may be children of SDEE's evIdsAlert element - immediately following the protocol element.

element triggerPacket
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:base64Binary
properties
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
truncated  xsd:booleanoptional      
annotation
documentation 
Single, complete packet that triggered the alert. Zero or one instances of this element may be children of SDEE's evIdsAlert element - immediately following the ipLogIds element.

complexType AbstractEvent
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
children cid:originator cid:time
used by
elements evError evShunRqst evStatus
attributes
Name  Type  Use  Default  Fixed  Annotation
eventId  sd:LocalEventIdrequired      
vendor  xsd:stringrequired      
annotation
documentation 
Abstract base type for all CIDEE events

element AbstractEvent/originator
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:OriginatorInstance
properties
isRef 0
content complex
children cid:hostId cid:appName cid:appInstanceId
annotation
documentation 
Identifies the event's originator.

element AbstractEvent/time
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:EventTime
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The time at which an event occurred based on the originator's best attempt to capture this time. The time value is UTC time in nanoseconds from 1970-01-01T00:00:00Z.  Although the resolution is specified in nanoseconds, this does not imply that the time is accurate to this resolution. The 'offset' attribute indicates the number of minutes that must be added to the UTC time to convert to local time at the originating host.  The 'timeZone' attribute contains a string identifying the local time zone at the originating host's location. 

complexType AbstractStatusDetail
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
properties
abstract true
children cid:description
used by
elements applicationStarted applicationStopped autoUpgradeServerCheck certificatesChanged controlTransaction defaultConfigCheck deniedAttackerListClearedByUser denyAttackerCompleted denyAttackerStarted downloadUpgradeFile engineBuildSkipped engineBuildStarted engineBuildSuccess externalProductInterfaceOffline externalProductInterfaceOnline ipLogAdded ipLogCompleted ipLogRemoved ipLogStarted loginAction managedDeviceOffline managedDeviceOnline maxDeniedAttackersReached netInlineBypassStarted netInlineBypassStopped netInterfaceAdded netInterfaceLinkDown netInterfaceLinkUp netInterfaceMissedPacketThresholdExceeded netInterfaceRemoved netInterfaceTrafficStarted netInterfaceTrafficStopped packetDrop packetUnscanned shunEntryAdded shunEntryRemoved shunningDisabled shunningEnabled signatureUpdateLicenseExpired signatureUpdateLicenseExpiring signatureUpdateNoLicense snmpGetRequested snmpSetRequested softwareDowngradeCompleted softwareDowngradeInitiated softwareUpgradeCompleted softwareUpgradeInitiated sshHostKeyChanged startedDiscardingHostPostures startedDiscardingWatchlistAddresses statusDetail stoppedDiscardingHostPostures stoppedDiscardingWatchlistAddresses syslogMessage
annotation
documentation 
Abstract base type for content info for an evStatus event

element AbstractStatusDetail/description
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
properties
isRef 0
content simple

complexType ApplicationInstance
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
children cid:hostId cid:appName cid:appInstanceId
used by
element Requestor/application
annotation
documentation 
Identifies an instance of an application on a particular host.

element ApplicationInstance/hostId
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type sd:HostId
properties
isRef 0
annotation
documentation 
Globally unique identifier for the host.

complexType ApplicationVersion
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
base xsd:string
used by
element applicationStarted/version
attributes
Name  Type  Use  Default  Fixed  Annotation
buildType  xsd:stringrequired      
documentation 
Typically this will be some string such as "release" or "debug". In some cases, it is the id of the builder of the application.
buildDateTime  xsd:dateTime      
annotation
documentation 
The version of an application. The contents of this element is typically a build number.

complexType AttackParticipant
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
children cid:addr cid:port
attributes
Name  Type  Use  Default  Fixed  Annotation
totalPorts  xsd:unsignedIntoptional      
annotation
documentation 
Host that participated in an attack, either as attackers or targets

element AttackParticipant/addr
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:IPv4Address
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
cid:locality  optional      
documentation 
Identifies whether an address is located inside or outside of a given network as specified by the intrusion detection device's configuration. May be an optional attribute of the SDEE AttackParticipant type's addr element.
annotation
documentation 
IP address of the participant. 

element AttackParticipant/port
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:PortNumber
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Port number associated with the attack participant host(s). When a range of hosts are identified, the port is associated with each host.  Note: this port may have appeared in either the source or destination field of the packet that triggered the alert.

complexType ErrorMessage
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:ErrorDescription
properties
base cid:ErrorDescription
used by
element evError/errorMessage
attributes
Name  Type  Use  Default  Fixed  Annotation
name  cid:ErrorNamerequired      
annotation
documentation 
A textual description of the error that occurred.  Contains an enumerated error name, which defines the general type of error, and a textual description of the error, which may be very specific.  An optional error number may also be provided as a reference to additional documentation of the error.  The error number should reference the specific error, not the error class defined in the 'name' attribute.  The purpose of the error number is to provide a reference to external documentation describing the specific error in greater detail.

complexType GlobalEventId
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:LocalEventId
properties
base sd:LocalEventId
used by
elements evShunRqst/evAlertRef shunEntryAdded/evAlertRef IpLog/evAlertRef
attributes
Name  Type  Use  Default  Fixed  Annotation
hostId  sd:HostIdrequired      
annotation
documentation 
A globally unique identifier for an event, which consists of the LocalEventId and the originating host's host id.

complexType IpLog
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
children cid:addr cid:virtualSensorName cid:evAlertRef cid:beginTime cid:endTime cid:minutesRemaining cid:bytesCaptured cid:bytesRemaining cid:packetsCaptured cid:packetsRemaining cid:status
used by
elements ipLogAdded/ipLog ipLogCompleted/ipLog ipLogStarted/ipLog
attributes
Name  Type  Use  Default  Fixed  Annotation
ipLogId  cid:IpLogIdrequired      
annotation
documentation 
Information about an ip log instance.  The ipLogId attribute uniquely (with host-scope) identifies the ip log document for use in other control transactions and status events (see execStopIpLog, getIpLog, getIpLogList, ipLogStarted, ipLogAdded, ipLogRemoved,and ipLogCompleted) and for retrieving the log document via RDEP.

element IpLog/addr
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:IPv4Address
properties
isRef 0
content complex
facets
pattern (((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))\.){3}((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Identifies the IP address associated with the IP log.

element IpLog/virtualSensorName
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:string
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Identifies the name of the virtual sensor associated with the IP log.

element IpLog/evAlertRef
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:GlobalEventId
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
hostId  sd:HostIdrequired      
annotation
documentation 
The global event id of the evAlert event that triggered the log to be initiated.  This element should only be present if the log was created automatically as the result of an evAlert.

element IpLog/beginTime
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:EventTime
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Start of the time range that is currently available in the log document.  Note that some earlier data in the log may have already been deleted due to storage limitations.

element IpLog/endTime
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:EventTime
properties
isRef 0
content complex
nillable true
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
End of the time range that is currently available in the log document.  Note that if the log is currently active, some packets may have been received but are not yet available for retrieval in the log document.

element IpLog/minutesRemaining
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:unsignedInt
properties
isRef 0
content complex
nillable true
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Minutes remaining until the log will be terminated.  If no maxMinutes limit was imposed when the log was created, this element should either be omitted or should be empty.

element IpLog/bytesCaptured
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:unsignedLong
properties
isRef 0
content simple
facets
maxInclusive 4294967295
annotation
documentation 
Total bytes captured so far.  Note that some packets that were captured may have already been deleted from the log due to memory limitiations.  Also, if the log is currently active, some packets may have been captured but are not yet available for retrieval in the log document.  The bytesCaptured value includes all bytes captured, whether they are available for retrieval or not.

element IpLog/bytesRemaining
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:unsignedLong
properties
isRef 0
content simple
nillable true
facets
maxInclusive 4294967295
annotation
documentation 
Bytes remaining until the log will be terminated.  If no maxBytes limit was imposed when the log was created, this element should either be omitted or should be empty.

element IpLog/packetsCaptured
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:unsignedLong
properties
isRef 0
content simple
facets
maxInclusive 4294967295
annotation
documentation 
Total packets captured and logged so far.  Note that some packets that were captured may have already been deleted from the log due to memory limitiations.  Also, if the log is currently active, some packets may have been captured but are not yet available for retrieval in the log document.  The packetsCaptured value includes all packets captured, whether they are available for retrieval or not.

element IpLog/packetsRemaining
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:unsignedLong
properties
isRef 0
content simple
nillable true
facets
maxInclusive 4294967295
annotation
documentation 
Packets remaining until the log will be terminated.  If no maxPackets limit was imposed when the log was created, this element should either be omitted or should be empty.

element IpLog/status
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:IpLogStatus
properties
isRef 0
content simple
facets
enumeration added
enumeration started
enumeration completed
annotation
documentation 
State of the log.  When the log is created, the state is 'added'.  If and when the first entry is inserted in the log, the state changes to 'started'.  When the log is completed, due to reaching the packet count limit for example, the status changes to 'completed'.

complexType NetProtocol
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:NetProtocolName
properties
base cid:NetProtocolName
used by
element ShunInfo/host/protocol
facets
enumeration tcp
enumeration udp
enumeration ip
enumeration icmp
enumeration arp
enumeration rarp
enumeration igmp
enumeration ipInIp
enumeration ipip
enumeration egp
enumeration igp
enumeration igrp
enumeration etherip
enumeration other
attributes
Name  Type  Use  Default  Fixed  Annotation
numericType  xsd:shortoptional      
annotation
documentation 
Layer 2 or 3 network protocol used in a connection.  The protocol is identified by name, and optionally by numeric type using the 'numericType' attribute.  If the protocol is not a well-known protocol that can be represented using the names enumerated in the ProtocolName type, then the value should be 'other' and the 'numericType' attribute should be used to identify the protocol.

complexType OriginatorInstance
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
children cid:hostId cid:appName cid:appInstanceId
used by
element AbstractEvent/originator
annotation
documentation 
Identifies the instance of an event originator.

element OriginatorInstance/hostId
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:HostId
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Globally unique identifier for the host that originated the event.

complexType RateLimitType
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
children cid:protocol cid:rate cid:srcAddr cid:srcPort cid:destAddr cid:destPort cid:data
used by
element ShunInfo/rateLimit
annotation
documentation 
The rate limit provides the information necessary to implement a token bucket policer.  Traffic may be conforming (transmitted), exceeding (might drop) or violating (dropped)

element RateLimitType/protocol
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
properties
isRef 0
content simple
facets
enumeration icmp
enumeration tcp
enumeration udp
annotation
documentation 
IP protocol of the rate limit.

element RateLimitType/rate
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:short
properties
isRef 0
content simple
annotation
documentation 
The percent of bandwidth capacity that this traffic is allowed to use.  Value1-100

element RateLimitType/srcAddr
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:IPv4Address
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Specify the ip of the attacking host

element RateLimitType/srcPort
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:PortNumber
properties
isRef 0
content simple
annotation
documentation 
Specify the port of the attacking host

element RateLimitType/destAddr
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type sd:IPv4Address
properties
isRef 0
annotation
documentation 
Specify the address of the vitim host

element RateLimitType/destPort
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type sd:PortNumber
properties
isRef 0
annotation
documentation 
Specify the port of the victim host

element RateLimitType/data
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
properties
isRef 0
content simple
facets
enumeration echo-reply
enumeration echo-request
enumeration halfOpenSyn
annotation
documentation 
Additional data to identify the rate limit. echo-reply indicates ICMP echo reply flood. echo-request indicates ICMP echo request flood. halfOpenSyn indicates TCP half-open SYN attack

complexType Requestor
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
children cid:user cid:application
used by
element controlTransaction/requestor
annotation
documentation 
The user or application that initiated a control transaction.

element Requestor/user
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:UserAccountName
properties
isRef 0
content simple
facets
minLength 1
maxLength 64
pattern [a-zA-Z0-9_\-]+
annotation
documentation 
The user account name of the user that initiated the control transaction.

element Requestor/application
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:ApplicationInstance
properties
isRef 0
content complex
children cid:hostId cid:appName cid:appInstanceId
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The application instance that initiated the control transaction.

complexType ShunInfo
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
children cid:host cid:network cid:rateLimit cid:timeoutMinutes cid:cause cid:removable
used by
elements evShunRqst/shunInfo shunEntryAdded/shunInfo shunEntryRemoved/shunInfo
annotation
documentation 
Data content of a shun request or shun status change.  Describes one address or set of addresses to be shunned.

element ShunInfo/host
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
properties
isRef 0
content complex
children cid:srcAddr cid:srcPort cid:destAddr cid:destPort cid:protocol cid:vlan cid:interface
attributes
Name  Type  Use  Default  Fixed  Annotation
connectionShun  xsd:booleanoptional      
annotation
documentation 
The host to be shunned.  Packets containing a matching source address will be blocked by the shunning router.  If the srcPort, destAddress, and destPort are specified, then only packets that match the host's source address and the additional criteria will be shunned.  If the protocol is also specified, only packets matching all the above criteria and that also match the protocl will be shunned.  The 'connectionShun' attribute indicates whether only the connection should be shunned (connectionShun=true) or all traffic from the srcAddr should be shunned (connectionShun=false). If connectionShun is omitted, it defaults to false.

element ShunInfo/host/srcAddr
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:IPv4Address
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The source address to be shunned.

element ShunInfo/host/srcPort
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:PortNumber
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The port associated with srcAddr.

element ShunInfo/host/destAddr
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:IPv4Address
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The destination address.

element ShunInfo/host/destPort
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:PortNumber
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The port associated with destAddr.

element ShunInfo/host/protocol
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of cid:NetProtocol
properties
isRef 0
content complex
facets
enumeration tcp
enumeration udp
enumeration ip
enumeration icmp
enumeration arp
enumeration rarp
enumeration igmp
enumeration ipInIp
enumeration ipip
enumeration egp
enumeration igp
enumeration igrp
enumeration etherip
enumeration other
attributes
Name  Type  Use  Default  Fixed  Annotation
numericType  xsd:shortoptional      
annotation
documentation 
Optional ip protocol (tcp/udp).  If not specified, all ip traffic matching the source address or 4-tuple will be shunned.  If specified, only packets that match the 4-tuple AND the specified protocol will be shunned.  The protocol is identified by name, and optionally by numeric type using the 'numericType' attribute.  If the protocol is not a well-known protocol that can be represented using the names enumerated in the ProtocolName type, then the value should be 'other' and the 'numericType' attribute should be used to identify the protocol.

element ShunInfo/host/vlan
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
properties
isRef 0
content simple
annotation
documentation 
Identifies the vlan associated with the host to be shunned.

element ShunInfo/host/interface
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
properties
isRef 0
content simple
annotation
documentation 
Identifies the interaface associated with the host to be shunned.

element ShunInfo/network
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
properties
isRef 0
content complex
children cid:addr cid:netMask
attributes
Name  Type  Use  Default  Fixed  Annotation

element ShunInfo/network/addr
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:IPv4Address
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The network address of the network to be shunned.

element ShunInfo/network/netMask
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of sd:IPv4Address
properties
isRef 0
content complex
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
The netmask of the network to be shunned

element ShunInfo/rateLimit
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:RateLimitType
properties
isRef 0
content complex
children cid:protocol cid:rate cid:srcAddr cid:srcPort cid:destAddr cid:destPort cid:data

element ShunInfo/timeoutMinutes
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type extension of xsd:integer
properties
isRef 0
content complex
nillable true
attributes
Name  Type  Use  Default  Fixed  Annotation
annotation
documentation 
Length of time that the shun should continue, in minutes.  If an infinite timeout is desired, this element should be empty (nil).

element ShunInfo/cause
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type cid:ShunCause
properties
isRef 0
content simple
facets
enumeration alert
enumeration user
enumeration configuration
annotation
documentation 
The cause, or origin, of the shun.  Shuns can be initiated as the result of an evShunRqst event,upon request from a user, or as the result of a configuration selection.

element ShunInfo/removable
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:boolean
properties
isRef 0
content simple
annotation
documentation 
If value is 'true', then the shun can be terminated using a removeShunEntry control transaction. If false, it cannot be removed except by a timeout.  If missing, defaults to true.

complexType TransactionParameter
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
children cid:name cid:value
used by
elements controlTransaction/requestParameter controlTransaction/responseParameter
annotation
documentation 
The name/value pair passed as a request or response parameter in a control transaction

element TransactionParameter/name
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
properties
isRef 0
content simple

element TransactionParameter/value
diagram
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
properties
isRef 0
content simple

simpleType AlertSummaryType
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
attribute summary/@summaryType
facets
maxLength 16
annotation
documentation 
Common characteristics shared by all non-summary alerts included in a summary alert.

simpleType ApplicationName
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
element appName
facets
minLength 1
maxLength 64
pattern [a-zA-Z0-9_]+
annotation
documentation 
The generic name of a CIDS application

simpleType AttackRelevance
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
attributes riskRatingValue/@attackRelevanceRating os/@relevance
facets
enumeration relevant
enumeration not-relevant
enumeration unknown
annotation
documentation 
An enumerated value used to indicate an attack's relevance to its destination target(s).

simpleType ContextBytes
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:base64Binary
used by
elements context/fromAttacker context/fromTarget
annotation
documentation 
Context buffer data, encoded using Base64 encoding.

simpleType ErrorDescription
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
used by
complexType ErrorMessage
annotation
documentation 
Text that describes an error

simpleType ErrorName
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
attribute ErrorMessage/@name
facets
enumeration errAuthenticationTokenExpired
enumeration errConfigCollision
enumeration errEngineBuildFailed
enumeration errInUse
enumeration errInvalidDocument
enumeration errLimitExceeded
enumeration errNotAvailable
enumeration errNotFound
enumeration errNotSupported
enumeration errPermissionDenied
enumeration errSystemError
enumeration errTransport
enumeration errUnacceptableValue
enumeration errUnclassified
enumeration errWarning
annotation
documentation 
An enumerated error code, which identifies a general class of errors.

simpleType ErrorSeverity
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
attribute evError/@severity
facets
enumeration warning
enumeration error
enumeration fatal
annotation
documentation 
Severity of an error

simpleType InterfaceName
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
elements netInterfaceAdded/interfaceName netInterfaceRemoved/interfaceName netInterfaceLinkDown/interfaceName netInterfaceLinkUp/interfaceName netInterfaceTrafficStopped/interfaceName netInterfaceTrafficStarted/interfaceName netInterfaceMissedPacketThresholdExceeded/interfaceName
facets
pattern [a-zA-Z]+[0-9]+/[0-9]+
annotation
documentation 
Name for a physical network interface.

simpleType IpLogId
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
used by
elements ipLogIds/ipLogId ipLogRemoved/ipLogId
attribute IpLog/@ipLogId
annotation
documentation 
A unique identifier for an ip logging session and its associated ip log.  The log id has host-scope properties.

simpleType IpLogStatus
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
element IpLog/status
facets
enumeration added
enumeration started
enumeration completed
annotation
documentation 
State of an Ip log.

simpleType IPv4Address
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
elements managedDeviceOffline/addr managedDeviceOnline/addr IpLog/addr denyAttackerCompleted/address denyAttackerStarted/address externalProductInterfaceOffline/address externalProductInterfaceOnline/address loginAction/userAddress
facets
pattern (((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))\.){3}((\d)|([1-9]\d)|(1\d\d)|(2[0-4]\d)|(25[0-5]))
annotation
documentation 
An IP (version 4) address, represented in "255.255.255.255" format.

simpleType LocalEventId
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:unsignedLong
used by
attribute summary/@initialAlert
annotation
documentation 
Serial number for an event, which is guaranteed unique within the scope of the originating host

simpleType NetLocality
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
facets
maxLength 16
annotation
documentation 
A string that indicates the relative location of a network host address within the network topology.  It can be used to indicate whether the host is within the protected network, the DMZ, or in the external (unprotected) network, for example.

simpleType NetProtocolName
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
complexType NetProtocol
facets
enumeration tcp
enumeration udp
enumeration ip
enumeration icmp
enumeration arp
enumeration rarp
enumeration igmp
enumeration ipInIp
enumeration ipip
enumeration egp
enumeration igp
enumeration igrp
enumeration etherip
enumeration other
annotation
documentation 
Layer 2 or 3 network protocol used in a connection.

simpleType OsType
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
attribute os/@type
facets
enumeration windows-nt-2k-xp
enumeration win-nt
enumeration windows
enumeration linux
enumeration mac-os
enumeration solaris
enumeration unix
enumeration bsd
enumeration hp-ux
enumeration aix
enumeration irix
enumeration ios
enumeration netware
enumeration general-os
enumeration other
annotation
documentation 
Identifies operating system types.

simpleType Percentage
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:unsignedInt
used by
elements riskRatingValue threatRatingValue
facets
minInclusive 0
maxInclusive 100
annotation
documentation 
A value that is expressed as a percentage.

simpleType PortNumber
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:unsignedShort
used by
element RateLimitType/srcPort
attributes loginAction/userAddress/@port snmpGetRequested/requestor/@port snmpSetRequested/requestor/@port
annotation
documentation 
A network port number, as used in a socket.

simpleType ShunCause
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
element ShunInfo/cause
facets
enumeration alert
enumeration user
enumeration configuration
annotation
documentation 
Enumeration defining the cause for the shun to be initiated.

simpleType ShutdownReason
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:string
used by
element applicationStopped/reason
annotation
documentation 
Reason for shutting down or rebooting the host

simpleType SoftwareVersion
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
elements softwareDowngradeCompleted/newVersion softwareUpgradeCompleted/newVersion softwareDowngradeCompleted/oldVersion softwareDowngradeInitiated/oldVersion softwareUpgradeCompleted/oldVersion softwareUpgradeInitiated/oldVersion
facets
minLength 1
maxLength 64
annotation
documentation 
Identifies a software version

simpleType SyslogSeverity
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
facets
enumeration informational
enumeration warning
enumeration error
annotation
documentation 
Severity of a syslog message.

simpleType TargetValue
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
attribute riskRatingValue/@targetValueRating
facets
enumeration zero-value
enumeration low
enumeration medium
enumeration high
enumeration mission critical
annotation
documentation 
Identifies the asset values associated with targets identified in alerts.

simpleType Traits
namespace http://www.cisco.com/cids/2006/08/cidee
type xsd:unsignedInt
annotation
documentation 
A set of 32 trait bits, represented as a 32-bit unsigned integer.  Each of the 32 bits represents a trait or characteristic of the parent element.  If a specific bit is set, it indicates that the parent element posesses the associated trait. Different products implementing the CIDEE shema may use less bits to represent the product's traits.

simpleType TransactionCommand
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
attribute controlTransaction/@command
facets
minLength 1
maxLength 64
annotation
documentation 
The operation performed by a control transaction

simpleType UserAccountName
namespace http://www.cisco.com/cids/2006/08/cidee
type restriction of xsd:string
used by
elements Requestor/user loginAction/userName
facets
minLength 1
maxLength 64
pattern [a-zA-Z0-9_\-]+
annotation
documentation 
Name of a user's account. This is the username when username/password authentication is used. Otherwise this can be a name used to identify an account.


XML Schema documentation generated with
XMLSpy Schema Editor http://www.altova.com/xmlspy