SecurityIndication provides a common superclass for the CIM Security Events schema. SecurityIndications are messages produced by Detectors that watch for and report on events that have security implications. Detectors may include, but are not limited to intrusion detection systems, antivirus scanners, firewalls, vulnerability scanners, or operating system sentries and subsystems. Although often due to attacks or probes, security events can also reflect normal activity, such as host or network login, firewall connections, etc. Messages include information about the Effect of the event, the Mechanism or method by which the event occurred, and the Resource affected by the event. Properties from the base class CIM_Indication that MUST be populated are: IndicationIdentifier and IndicationTime. A property from the superclass CIM_AlertIndication that MUST be populated is: AlertType which MUST be set to 'Security'. EventID, ProviderName and AlertingManagedElement in some combination SHOULD be populated in a way that identifies the device type and its source in an unambiguous way from the Detector's point of view. | Qualifiers:Experimental Version ( "2.10.0" ) Indication | Parameters (local in grey) | | Values { "Unknown" , "DMTF Reserved" , "Not Applicable" , "Vendor Reserved" } Required ValueMap { "0" , ".." , "2" , "16000.." } uint16 MessageType ; MessageType is an identifier distinguishing the instance of a SecurityIndication semantically. Instances of this class or its subclasses have different meaning depending upon the value of MessageType. For example, overrides of this property in subclasses can define new MethodTypes, such as 'Virus Found' or 'Vulnerability Detected'. A range of values, DMTF_Reserved, and Vendor Reserved, has been defined that allows subclasses to override and define their specific event message types. Note that MessageType does not correspond to the CIM_AlertIndication 'Message' property, which holds a formatted string for general AlertIndications. CIM_AlertIndication.Message MAY be used to contain message text sent by the Detector, but in addition to, rather than in lieu of SecurityIndication specific properties. | Values { "Unknown" , "DMTF Reserved" , "Degradation" , "Reconnaissance" , "Access" , "Integrity" , "System Compromised" , "Vendor Reserved" } Required ModelCorrespondence { "CIM_SecurityIndication.MoreSpecificEffects" } ValueMap { "0" , ".." , "2" , "3" , "4" , "5" , "6" , "16000.." } ArrayType ( "Indexed" ) uint16 Effects [ ] ; An array of enumerated values that describes the effect(s) of an event from the Detector's point of view. Some security devices such as simple packet filters may not be able to detect the notion of an event's Effect. In these cases, the Effect is 'Unknown'. Although in many cases the Effect of an attack is intended, not all attacks have a known intent, such as viruses or other malicious code, which may have multiple varied Effects. If there is more than one Effect, the first element in the array SHOULD represent the most significant or most severe Effect, from the Detector's point of view. The following values are defined: 0 - Unknown means the Effect of the event is purely unknown. 2 - Degradation. The message indicates that an attempt was made to damage or impair usability, performance, service availability, etc. 3 - Reconnaissance. The message indicates that there was an attempt to gather information useful for attacks, or probe for vulnerabilities without necessarily exploiting them. 4 - Access. The message indicates that access has been attempted or made to data or services. 5 - Integrity. The message indicates that there was an attempt to modify or delete data. 6 - System Compromised. The message indicates that an attacker succeeded in gaining complete access to the system. | Required Override ( "IndicationTime" ) ModelCorrespondence { "CIM_SecurityIndication.IndicationStartCountTime" } datetime IndicationTime ; The time and date of creation of the Indication. The property may be set to NULL if the entity creating the Indication is not capable of determining this information. Note that IndicationTime may be the same for two Indications that are generated in rapid succession. | MinValue ( 1 ) ModelCorrespondence { "CIM_SecurityIndication.IndicationStartCountTime" } Counter uint16 EventCount = 1 ; The number of events represented by this Indication. If IndicationStartCountTime is not NULL, EventCount MUST be greater than 1 which means that the Indication represents an event aggregate. | Required Override ( "IndicationIdentifier" ) MappingStrings { "Recommendation.ITU|X733.Notification " "identifier" } string IndicationIdentifier ; An identifier for the Indication. This property is similar to a key value in that it can be used for identification, when correlating Indications (see the CorrelatedIndications array). Its value SHOULD be unique as long as Alert correlations are reported, but MAY be reused or left NULL if no future Indications will reference it in their CorrelatedIndications array. | Values { "Unknown" , "DMTF Reserved" , "ArpPoisoning" , "Backdoor" , "Rootkit" , "Trojan" , "BufferOverflow" , "GuessPassword" , "ReplayAttack" , "SQLInjection" , "SpoofIdentity" , "PortSweep" , "HostSweep" , "NetworkSweep" , "NetworkICMP" , "NetworkTCP" , "NetworkUDP" , "Worm" , "Virus" , "Non-viral Malicious" , "Spyware" , "Adware" , "Login" , "Logout" , "Application Exploitation" , "Script Injection" , "Stale-data Scan" , "Congestion" , "Saturation" , "Overloading" , "Port Scan" , "Network Protocol" , "Network HTTP" , "Phishing" , "Redirection" , "RemoteExecution" , "DataManipulation" , "Cross-site Scripting" , "Vendor Reserved" } Required ModelCorrespondence { "CIM_SecurityIndication.MoreSpecificMechanisms" } ValueMap { "0" , ".." , "2" , "3" , "4" , "5" , "6" , "7" , "8" , "9" , "10" , "11" , "12" , "13" , "14" , "15" , "16" , "17" , "18" , "19" , "20" , "21" , "22" , "23" , "24" , "25" , "26" , "27" , "28" , "29" , "30" , "31" , "32" , "33" , "34" , "35" , "36" , "37" , "16000.." } ArrayType ( "Indexed" ) uint16 Mechanisms [ ] ; An array of integers indicating the method(s) used in an attack, probe, or other action. When more than one value is used there MAY be a parent/child or hierarchical relationship between values where the more general or parent value is at the lowest index and the more specific or child value(s) are at increasing indices. Values with a parent/child relationship are: Parent - NetworkProtocol Children - NetworkICMP, NetworkTCP, NetworkUDP, NetworkHTTP
Parent - Overloading Children - Congestion, Saturation Mechanisms values can be used with any of the Effects values, depending on the method(s) employed in an attack or probe. For example, a DoS attack using ICMP packets, Effects would contain Degradation, and Mechanisms would contain NetworkProtocol and NetworkICMP in that order. For a port scan, Effects contains Reconnaissance and Mechanisms would contain PortScan. | ModelCorrespondence { "CIM_SecurityIndication.Resources" , "CIM_AlertIndication.OwningEntity" } ArrayType ( "Indexed" ) string MoreSpecificResources [ ] ; Specifies a more specific resource based on a value specified in the Resources property. For example, if one of the values of Resources is Web, then a MoreSpecificResource might be Apache for an attack or probe against an Apache web server. String values for this property are vendor or Detector specific and as such, the property CIM_AlertIndication.OwningEntity SHOULD be populated to identify the business entity or standards body defining the possible values. | ModelCorrespondence { "CIM_SecurityIndication.Mechanisms" , "CIM_AlertIndication.OwningEntity" } ArrayType ( "Indexed" ) string MoreSpecificMechanisms [ ] ; Specifies a more specific mechanism based on a value specified in the Mechanisms property. For example, if one of the values of Mechanisms is Trojan, then a MoreSpecificMechanisms might be Connect for a trojan that opens a port and listens for connections. A different method might be Response if the trojan sends information. String values for this property are vendor or Detector specific and as such, the property CIM_AlertIndication.OwningEntity SHOULD be populated to identify the business entity or standards body defining the possible values. | Values { "Security Alert" } Required Override ( "AlertType" ) ValueMap { "8" } MappingStrings { "Recommendation.ITU|X733.Event type" } uint16 AlertType = 8 ; Primary classification of the Indication. The following value is the only value permitted from AlertIndication: 8 - Security Alert. An Indication of this type is associated with security violations, detection of viruses, and similar issues. | ModelCorrespondence { "CIM_SecurityIndication.Effects" , "CIM_AlertIndication.OwningEntity" } ArrayType ( "Indexed" ) string MoreSpecificEffects [ ] ; If more details are known about the effect of an attack or probe, this property can contain that information. For example, if one of the values of Effects is Access, a more specific Effect might be HostCompromised. Or, if the Effect is Degradation, a more specific effect might be DistributedDoS. String values for this property are vendor or Detector specific and as such, the property CIM_AlertIndication.OwningEntity SHOULD be populated to identify the business entity or standards body defining the possible values. | Values { "Unknown" , "DMTF Reserved" , "DB" , "DNS" , "FTP" , "Mail" , "Web" , "Host" , "Firewall" , "Registry" , "Network Device" , "Hardware" , "User Activity" , "Cookies" , "Network Data" , "Application Data" , "Application Configuration" , "OS Kernel" , "OS Configuration" , "OS Session" , "File System" , "Process" , "Service" , "Network Session" , "URL" , "User Account" , "Privileges" , "User Policy" , "Group" , "RPC" , "SNMP" , "Remote Service" , "Remote Share" , "Naming Service" , "Application" , "OS" , "NFS" , "SMB" , "CIFS" , "CPU" , "Router" , "Switch" , "LDAP" , "Vendor Reserved" } Required ModelCorrespondence { "CIM_SecurityIndication.MoreSpecificResources" } ValueMap { "0" , ".." , "2" , "3" , "4" , "5" , "6" , "7" , "8" , "9" , "10" , "11" , "12" , "13" , "14" , "15" , "16" , "17" , "18" , "19" , "20" , "21" , "22" , "23" , "24" , "25" , "26" , "27" , "28" , "29" , "30" , "31" , "32" , "33" , "34" , "35" , "36" , "37" , "38" , "39" , "40" , "41" , "42" , "16000.." } ArrayType ( "Indexed" ) uint16 Resources [ ] ; An integer indicating the type(s) of resource affected by an attack or probe. When more than one value is used there MAY be a parent/child or hierarchical relationship between values where the more general or parent value is at the lowest index and the more specific or child value(s) are at increasing indices. Values with a parent/child relationship are: Parent - Remote Service Children - Remote Share, Naming Service, DB, FTP, Mail, RPC, Web Parent - Remote Share Children - NFS, SMB, CIFS Parent - Naming Service Children - DNS, LDAP Parent - Application Children - Application Data, Application Configuration Parent - OS Children - OS Kernel, OS Configuration, OS Session, File System, Process, Service, User Account, Privileges, User Policy, Group, Registry, File Parent - Network Device Children - Firewall, Router, Switch For example, DB indicates that an attack was made against a database server, where Mail indicates that some type of email server is affected. DB, DNS, and other values can mean a server or service, e.g. there is no distinction between a DNS server resource and a DNS service resource. Web means a web server/service but more specific resources of this type can be specified using the MoreSpecificResources property, e.g. IIS, Apache, iPlanet, etc. | ModelCorrespondence { "CIM_SecurityIndication.EventCount" , "CIM_SecurityIndication.IndicationTime" } datetime IndicationStartCountTime ; The start time and date of a range of events represented by the Indication whose current event time is specified by IndicationTime. If the Indication represents a single event, this property MUST be set to NULL. If the Indication represents multiple events over time, the EventCount property MUST be greater than 1 and this property MUST be less than or equal to the IndicationTime value. In this case, the Indication represents an event aggregate with the aggregate amplitude being the EventCount property. The time range or EventCount does not imply a threshold in and of itself, but a time or amplitude threshold MAY be used in determining how a Detector populates this property. | Experimental ModelCorrespondence { "CIM_AlertIndication.MessageID" , "CIM_AlertIndication.MessageArguments" } string Message ; The formatted message. This message is constructed by applying the dynamic content of the message, described in MessageArguments, to the format string uniquely identified, within the scope of the OwningEntity, by MessageID. | MappingStrings { "Recommendation.ITU|X733.Additional text" } string Description ; A short description of the Indication. | Values { "Unknown" , "Other" , "Information" , "Degraded/Warning" , "Minor" , "Major" , "Critical" , "Fatal/NonRecoverable" } Required Override ( "PerceivedSeverity" ) ValueMap { "0" , "1" , "2" , "3" , "4" , "5" , "6" , "7" } MappingStrings { "Recommendation.ITU|X733.Perceived severity" } uint16 PerceivedSeverity ; An enumerated value that describes the severity of the Alert Indication from the notifier's point of view: 1 - Other, by CIM convention, is used to indicate that the Severity's value can be found in the OtherSeverity property. 3 - Degraded/Warning should be used when its appropriate to let the user decide if action is needed. 4 - Minor should be used to indicate action is needed, but the situation is not serious at this time. 5 - Major should be used to indicate action is needed NOW. 6 - Critical should be used to indicate action is needed NOW and the scope is broad (perhaps an imminent outage to a critical resource will result). 7 - Fatal/NonRecoverable should be used to indicate an error occurred, but it's too late to take remedial action. 2 and 0 - Information and Unknown (respectively) follow common usage. Literally, the AlertIndication is purely informational or its severity is simply unknown. | Values { "Unknown" , "Other" , "Adapter/Card Error" , "Application Subsystem Failure" , "Bandwidth Reduced" , "Connection Establishment Error" , "Communications Protocol Error" , "Communications Subsystem Failure" , "Configuration/Customization Error" , "Congestion" , "Corrupt Data" , "CPU Cycles Limit Exceeded" , "Dataset/Modem Error" , "Degraded Signal" , "DTE-DCE Interface Error" , "Enclosure Door Open" , "Equipment Malfunction" , "Excessive Vibration" , "File Format Error" , "Fire Detected" , "Flood Detected" , "Framing Error" , "HVAC Problem" , "Humidity Unacceptable" , "I/O Device Error" , "Input Device Error" , "LAN Error" , "Non-Toxic Leak Detected" , "Local Node Transmission Error" , "Loss of Frame" , "Loss of Signal" , "Material Supply Exhausted" , "Multiplexer Problem" , "Out of Memory" , "Output Device Error" , "Performance Degraded" , "Power Problem" , "Pressure Unacceptable" , "Processor Problem (Internal Machine Error)" , "Pump Failure" , "Queue Size Exceeded" , "Receive Failure" , "Receiver Failure" , "Remote Node Transmission Error" , "Resource at or Nearing Capacity" , "Response Time Excessive" , "Retransmission Rate Excessive" , "Software Error" , "Software Program Abnormally Terminated" , "Software Program Error (Incorrect Results)" , "Storage Capacity Problem" , "Temperature Unacceptable" , "Threshold Crossed" , "Timing Problem" , "Toxic Leak Detected" , "Transmit Failure" , "Transmitter Failure" , "Underlying Resource Unavailable" , "Version MisMatch" , "Previous Alert Cleared" , "Login Attempts Failed" , "Software Virus Detected" , "Hardware Security Breached" , "Denial of Service Detected" , "Security Credential MisMatch" , "Unauthorized Access" , "Alarm Received" , "Loss of Pointer" , "Payload Mismatch" , "Transmission Error" , "Excessive Error Rate" , "Trace Problem" , "Element Unavailable" , "Element Missing" , "Loss of Multi Frame" , "Broadcast Channel Failure" , "Invalid Message Received" , "Routing Failure" , "Backplane Failure" , "Identifier Duplication" , "Protection Path Failure" , "Sync Loss or Mismatch" , "Terminal Problem" , "Real Time Clock Failure" , "Antenna Failure" , "Battery Charging Failure" , "Disk Failure" , "Frequency Hopping Failure" , "Loss of Redundancy" , "Power Supply Failure" , "Signal Quality Problem" , "Battery Discharging" , "Battery Failure" , "Commercial Power Problem" , "Fan Failure" , "Engine Failure" , "Sensor Failure" , "Fuse Failure" , "Generator Failure" , "Low Battery" , "Low Fuel" , "Low Water" , "Explosive Gas" , "High Winds" , "Ice Buildup" , "Smoke" , "Memory Mismatch" , "Out of CPU Cycles" , "Software Environment Problem" , "Software Download Failure" , "Element Reinitialized" , "Timeout" , "Logging Problems" , "Leak Detected" , "Protection Mechanism Failure" , "Protecting Resource Failure" , "Database Inconsistency" , "Authentication Failure" , "Breach of Confidentiality" , "Cable Tamper" , "Delayed Information" , "Duplicate Information" , "Information Missing" , "Information Modification" , "Information Out of Sequence" , "Key Expired" , "Non-Repudiation Failure" , "Out of Hours Activity" , "Out of Service" , "Procedural Error" , "Unexpected Information" } Required ModelCorrespondence { "CIM_AlertIndication.ProbableCauseDescription" , "CIM_AlertIndication.EventID" , "CIM_AlertIndication.EventTime" } ValueMap { "0" , "1" , "2" , "3" , "4" , "5" , "6" , "7" , "8" , "9" , "10" , "11" , "12" , "13" , "14" , "15" , "16" , "17" , "18" , "19" , "20" , "21" , "22" , "23" , "24" , "25" , "26" , "27" , "28" , "29" , "30" , "31" , "32" , "33" , "34" , "35" , "36" , "37" , "38" , "39" , "40" , "41" , "42" , "43" , "44" , "45" , "46" , "47" , "48" , "49" , "50" , "51" , "52" , "53" , "54" , "55" , "56" , "57" , "58" , "59" , "60" , "61" , "62" , "63" , "64" , "65" , "66" , "67" , "68" , "69" , "70" , "71" , "72" , "73" , "74" , "75" , "76" , "77" , "78" , "79" , "80" , "81" , "82" , "83" , "84" , "85" , "86" , "87" , "88" , "89" , "90" , "91" , "92" , "93" , "94" , "95" , "96" , "97" , "98" , "99" , "100" , "101" , "102" , "103" , "104" , "105" , "106" , "107" , "108" , "109" , "110" , "111" , "112" , "113" , "114" , "115" , "116" , "117" , "118" , "119" , "120" , "121" , "122" , "123" , "124" , "125" , "126" , "127" , "128" , "129" , "130" } MappingStrings { "Recommendation.ITU|X733.Probable cause" , "Recommendation.ITU|M3100.probableCause" , "ITU-IANA-ALARM-TC" } uint16 ProbableCause ; An enumerated value that describes the probable cause of the situation which resulted in the AlertIndication. | ModelCorrespondence { "CIM_AlertIndication.AlertType" } string OtherAlertType ; A string describing the Alert type - used when the AlertType property is set to 1, 'Other State Change'. | Values { "Unknown" , "Not Applicable" , "Trending Up" , "Trending Down" , "No Change" } ValueMap { "0" , "1" , "2" , "3" , "4" } MappingStrings { "Recommendation.ITU|X733.TrendIndication" } uint16 Trending ; Provides information on trending - trending up, down or no change. | ModelCorrespondence { "CIM_AlertIndication.ProbableCause" } string ProbableCauseDescription ; Provides additional information related to the ProbableCause. | MappingStrings { "Recommendation.ITU|X733.Proposed repair " "actions" } string RecommendedActions [ ] ; Free form descriptions of the recommended actions to take to resolve the cause of the notification. | Values { "Unknown" , "Other" , "CIMObjectPath" } ModelCorrespondence { "CIM_AlertIndication.AlertingManagedElement" , "CIM_AlertIndication.OtherAlertingElementFormat" } ValueMap { "0" , "1" , "2" } uint16 AlertingElementFormat = 0 ; The format of the AlertingManagedElement property is interpretable based upon the value of this property. Values are defined as: 0 - Unknown. The format is unknown or not meaningfully interpretable by a CIM client application. 1 - Other. The format is defined by the value of the OtherAlertingElementFormat property. 2 - CIMObjectPath. The format is a CIMObjectPath, with format <NamespacePath>:<ClassName>.<Prop1>='<Value1>', <Prop2>='<Value2>', . . . specifying an instance in the CIM Schema. | ModelCorrespondence { "CIM_AlertIndication.AlertingElementFormat" } string AlertingManagedElement ; The identifying information of the entity (ie, the instance) for which this Indication is generated. The property contains the path of an instance, encoded as a string parameter - if the instance is modeled in the CIM Schema. If not a CIM instance, the property contains some identifying string that names the entity for which the Alert is generated. The path or identifying string is formatted per the AlertingElementFormat property. | ModelCorrespondence { "CIM_AlertIndication.AlertingElementFormat" } string OtherAlertingElementFormat ; A string defining 'Other' values for AlertingElementFormat. This value MUST be set to a non NULL value when AlertingElementFormat is set to a value of 1 ('Other'). For all other values of AlertingElementFormat, the value of this string must be set to NULL. | MaxLen ( 256 ) string SystemName ; The scoping System's Name for the Provider generating this Indication. | Experimental ModelCorrespondence { "CIM_AlertIndication.Message" , "CIM_AlertIndication.MessageID" } string MessageArguments [ ] ; An array containing the dynamic content of the message. | Experimental ModelCorrespondence { "CIM_AlertIndication.Message" , "CIM_AlertIndication.MessageArguments" } string MessageID ; A string that uniquely identifies, within the scope of the OwningEntity, the format of the Message. | ModelCorrespondence { "CIM_AlertIndication.ProbableCause" } datetime EventTime ; The time and date the underlying event was first detected. If specified, this property MUST be set to NULL if the creating entity is not capable of providing this information. This value is based on the notion of local date and time of the Managed System Element generating the Indication. | MaxLen ( 256 ) string ProviderName ; The name of the Provider generating this Indication. | Experimental string OwningEntity ; A string that uniquely identifies the entity that owns the definition of the format of the Message described in this instance. OwningEntity MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity or standards body defining the format. | ModelCorrespondence { "CIM_AlertIndication.ProbableCause" } string EventID ; An instrumentation or provider specific value that describes the underlying 'real-world' event represented by the Indication. Two Indications with the same, non NULL EventID value are considered, by the creating entity, to represent the same event. The comparison of two EventID values is only defined for Alert Indications with identical, non NULL values of SystemCreateClassName, SystemName and ProviderName. | MaxLen ( 256 ) string SystemCreationClassName ; The scoping System's CreationClassName for the Provider generating this Indication. | ModelCorrespondence { "CIM_AlertIndication.PerceivedSeverity" } string OtherSeverity ; Holds the value of the user defined severity value when 'PerceivedSeverity' is 1 ('Other'). | ModelCorrespondence { "CIM_Indication.IndicationIdentifier" } MappingStrings { "Recommendation.ITU|X733.Correlated " "notifications" } string CorrelatedIndications [ ] ; A list of IndicationIdentifiers whose notifications are correlated with (related to) this one. |
| | | | |
|