Re: [mile] JSON representation of IODEF (FW: New Version Notification for draft-takahashi-mile-jsoniodef-00.txt)

[Carsten Bormann <[e-mail]>]

Carsten Bormann wrote:
>  a couple of errors

I think I worked around most of them.
I fed this into my experimental "JSON-Schema"-to-CDDL converter.
(While CDDL has been designed for CBOR, JSON's data model is a subset of
CBOR's, so CDDL can be used for JSON as well.)

Here are a few observations:

*** Unused rule RegistryHandle
*** Unused rule PostalAddress
*** Unused rule Email
*** Unused rule BusinessImpact
*** Unused rule HistoryItem
*** Unused rule ServiceName
*** Unused rule ApplicationHeader
*** Unused rule EmailData
*** Unused rule RecordPattern
*** Unused rule WindowsRegistryKeysModified
*** Unused rule Key
*** Unused rule Observable
*** Unused rule BulkObservable
*** Unused rule BulkObservableFormat

For your perusal, the CDDL is reproduced below.
Since "JSON-Schema" isn't always very well-defined, I don't know whether
what my tool reads from it indeed was the intended definition.  (See
also a few weird cases marked with @@@.)
I'm not also sure that ExtensionType and Campaign are exactly the two
JSON objects that are extensible, and that Incident's AlternativeID
field is as loosely defined as it seems.  (There are also a lot of "any"
types I have guessed.)  Finally, I can't parse

      "properties": {
        "Signature": {
          "SignatureValue": "xxxxxxxx",
          "id": "xxxxxxxx"
        }
      },

Without further ado, here is the automatically generated CDDL:

Grüße, Carsten




start = iodef

;;; iodef.json: IODEF-Document

iodef = {
 version: text
 ? lang: lang
 ? format-id: text
 ? private-enum-name: text
 ? private-enum-id: text
 Incidents: [* Incident]
 ? AdditionalData: [* ExtensionType]
}

lang = "en" / "jp"
restriction = "public" / "partner" / "need-to-know" / "private" /
              "default" / "white" / "green" / "amber" / "red" /
              "ext-value"
URLtype = text
IDtype = text

ExtensionType  = {
 ? Name: text
 ? dtype: "boolean" / "byte" / "bytes" / "character" / "date-time" /
          "ntpstamp" / "integer" / "portlist" / "real" / "string" / "file" /
          "path" / "frame" / "packet" / "ipv4-packet" / "ipv6-packet" /
"url" /
          "csv" / "winreg" / "xml" / "ext-value"
 ? ext-dtype: text
 ? meaning: text
 ? formatid: text
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 * text => any
}

SoftwareType = {
 ? SoftwareReference: SoftwareReference
 ? URL: URLtype
 ? Description: text
}

SoftwareReference = {
 ? value: text
 spec-name: text
 ? ext-spec-name: text
 ? dtype: text
 ? ext-dtype: text
}

Incident = {
 purpose: "traceback" / "mitigation" / "reporting" / "watch" / "other" /
"ext-value"
 ? ext-purpose: text
 ? status: "blabla"
 ? ext-status: text
 ? lang: lang
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 IncidentID: IncidentID
 ? AlternativeID: anymap ; @@@ object not well-defined @@@
 ? RelatedActivity: [* RelatedActivity]
 ? DetectTime: text
 ? StartTime: text
 ? EndTime: text
 ? RecoveryTime: text
 ? ReportTime: text
 GenerationTime: text
 ? Description: [* text]
 ? Discovery: [* Discovery]
 ? Assessment: [* Assessment]
 ? Methods: [* Method]
 Contacts: [* Contact]
 ? EventData: [* EventData]
 ? IndicatorList: [* Indicator]
 ? History: History
 ? AdditionalData: [* ExtensionType]
}

IncidentID = {
 ? id: text
 name: text
 ? instance: text
 ? restriction: restriction
 ? ext-restriction: text
}

RelatedActivity = {
 ? restriction: restriction
 ? ext-restriction: text
 ? IncidentID: [* IncidentID]
 ? URL: [* URLtype]
 ? ThreatActor: [* ThreatActor]
 ? Campaign: [* Campaign]
 ? IndicatorID: [* IndicatorID]
 ? Confidence: Confidence
 ? Description: [* text]
 ? AdditionalData: [* ExtensionType]
}

ThreatActor = {
 ? restriction: restriction
 ? ext-restriction: text
 ? ThreatActorID: text
 ? Description: text
 ? URL: URLtype
 ? AdditionalData: [* ExtensionType]
}

Campaign  = {
 ? restriction: restriction
 ? ext-restriction: text
 ? CampaignID: any
 ? URL: URLtype
 ? Description: text
 ? AdditionalData: [* ExtensionType]
 * text => any
}

Contact = {
 role: any
 ? ext-role: any
 type: any
 ? ext-type: any
 ? restriction: restriction
 ? ext-restriction: text
 ? ContactName: any
 ? ContactTitle: any
 ? Description: text
 ? RegistryHandle: any
 ? PostalAddress: any
 ? Email: any
 ? Telephone: Telephone
 ? Timezone: any
 ? Contact: Contact
 ? AdditionalData: [* ExtensionType]
}

RegistryHandle = {
 ? RegistryHandleName: any
 registry: any
 ? ext-registry: any
}

PostalAddress = {
 ? type: text
 ? ext-type: text
 PAddress: text
 ? Description: text
}

Email = {
 ? type: any
 ? ext-type: any
 EmailTo: any
 ? Description: text
}

Telephone = {
 ? type: any
 ? ext-type: any
 TelephoneNumber: any
 ? Description: text
}

Discovery = {
 ? source: any
 ? ext-source: any
 ? restriction: restriction
 ? ext-restriction: text
 ? Description: text
 ? Contact: Contact
 ? DetectionPattern: DetectionPattern
}

DetectionPattern = {
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 Application: SoftwareType
 ? Description: text
 ? DetectionConfiguration: any
}

Method = {
 ? restriction: restriction
 ? ext-restriction: text
 ? References: [* Reference]
 ? Description: text
 ? AttackPattern: any
 ? Vulnerability: any
 ? Weakness: any
 ? AdditionalData: [* ExtensionType]
}

Reference = {
 ? observable-id: IDtype
 ? ReferenceName: any
 ? URL: URLtype
 ? Description: text
}

Assessment = {
 ? occurrence: any
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 ? IncidentCategory: any
 ? SystemImpact: SystemImpact
 ? BusinessImpact: any
 ? TimeImpact: TimeImpact
 ? MonetaryImpact: MonetaryImpact
 ? IntendedImpact: any
 ? Counter: Counter
 ? MitigatingFactor: any
 ? Cause: any
 ? Confidence: Confidence
 ? AdditionalData: [* ExtensionType]
}

SystemImpact = {
 ? severity: any
 ? completion: any
 type: any
 ? ext-type: any
 ? Description: text
}

BusinessImpact = {
 ? severity: any
 ? ext-severity: any
 type: any
 ? ext-type: any
 ? Description: text
}

TimeImpact = {
 ? value: any
 ? severity: any
 metric: any
 ? ext-metric: any
 ? duration: any
 ? ext-duration: any
}

MonetaryImpact = {
 ? MonetaryImpactValue: any
 ? severity: any
 ? currency: any
}

Confidence = {
 ? ConfidenceValue: any
 rating: any
 ? ext-rating: any
}

History = {
 ? restriction: restriction
 ? ext-restriction: text
 HistoryItem: any
}

HistoryItem = {
 action: any
 ? ext-action: any
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 DateTime: any
 ? IncidentID: any
 ? Contact: Contact
 ? Description: text
 ? DefinedCOA: any
 ? AdditionalData: [* ExtensionType]
}

EventData = {
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 ? Description: text
 ? DetectTime: any
 ? StartTime: any
 ? EndTime: any
 ? RecoveryTime: any
 ReportTime: text
 ? Contact: Contact
 ? Discovery: Discovery
 ? Assessment: any
 ? Method: Method
 ? System: System
 ? Expectation: Expectation
 ? Record: Record
 ? EventData: EventData
 ? AdditionalData: [* ExtensionType]
}

Expectation = {
 ? action: any
 ? ext-action: any
 ? severity: any
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 ? Description: text
 ? DefinedCOA: any
 ? StartTime: any
 ? EndTime: any
 ? Contact: Contact
}

System = {
 ? category: "source" / "target" / "intermediate" / "sensor" /
"infrastructure" / "ext-value"
 ? ext-category: any
 ? interface: any
 ? spoofed: any
 ? virtual: any
 ? ownership: any
 ? ext-ownership: any
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 Node: Node
 ? NodeRole: NodeRole
 ? Service: Service
 ? OperatingSystem: any
 ? Counter: Counter
 ? AssetID: any
 ? Description: text
 ? AdditionalData: [* ExtensionType]
}

Node = {
 ? DomainData: DomainData
 ? Address: Address
 ? PostalAddress: any
 ? Location: text
 ? Counter: Counter
}

Address = {
 ? AddressValue: any
 category: any
 ? ext-category: any
 ? vlan-name: any
 ? vlan-num: int
 ? observable-id: IDtype
}

NodeRole = {
 category: any
 ? ext-category: any
 ? Description: text
}

Counter = {
 ? value: text
 type: any
 ? ext-type: any
 unit: any
 ? ext-unit: any
 ? meaning: any
 ? duration: any
 ? ext-duration: any
}

DomainData = {
 system-status: any
 ? ext-system-status: any
 domain-status: any
 ? ext-domain-status: any
 ? observable-id: IDtype
 Name: any
 ? DateDomainWasChecked: any
 ? RegistrationDate: any
 ? ExpirationDate: any
 ? RelatedDNS: any
 ? NameServers: NameServers
 ? DomainContacts: DomainContacts
}

NameServers = {
 Server: any
 Address: Address
}

DomainContacts = {
 ? SameDomainContact: any
 Contact: Contact
}

Service = {
 ? ip-protocol: any
 ? observable-id: IDtype
 ? ServiceName: any
 ? Port: any
 ? Portlist: any
 ? ProtoCode: any
 ? ProtoType: any
 ? ProtoField: any
 ? ApplicationHeader: any
 ? EmailData: any
 ? Application: any
}

ServiceName = {
 ? IANAService: any
 ? URL: URLtype
 ? Description: text
}

ApplicationHeader = {
 ? ApplicationHeaderField: any
}

EmailData = {
 ? EmailTo: any
 ? EmailFrom: any
 ? EmailSubject: any
 ? EmailX-Mailer: any
 ? EmailHeaderField: any
 ? EmailHeaders: any
 ? EmailBody: any
 ? EmailMessage: any
 ? HashData: HashData
 ? SignatureData: SignatureData
}

Record = {
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 ? DateTime: any
 ? Description: text
 ? Applicadtion: any
 ? RecordPattern: any
 ? RecordItem: any
 ? URL: URLtype
 ? FileData: FileData
 ? WindowsRegistryKeysModified: any
 ? CertificateData: CertificateData
 ? AdditionalData: [* ExtensionType]
}

RecordPattern = {
 ? RecordPatternValue: any
 type: any
 ? ext-type: any
 ? offset: any
 ? offsetunit: any
 ? ext-offsetunit: any
 ? instance: int
}

WindowsRegistryKeysModified = {
 ? observabile-id: any           ; @@@ typo @@@
 Key: any
}

Key = {
 ? registryaction: any
 ? ext-registryaction: any
 ? observable-id: IDtype
 KeyName: any
 ? KeyValue: any
}

CertificateData = {
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 Certificate: Certificate
}

Certificate = {
 ? observable-id: IDtype
 X509Data: any
 ? Description: text
}

FileData = {
 ? restriction: restriction
 ? ext-restriction: text
 ? observable-id: IDtype
 File: File
}

File = {
 ? FileName: text
 ? FileSize: any
 ? FileType: any
 ? URL: URLtype
 ? HashData: HashData
 ? SignatureData: SignatureData
 ? AssociatedSoftware: any
 ? FileProperties: any
}

HashData = {
 scope: any
 ? HashTargetID: any
 ? Hash: Hash
 ? FuzzyHash: FuzzyHash
}

Hash = {
 DigestMethod: text
 DigestValue: text
 ? CanonicalizationMethod: any
 ? Application: any
}

FuzzyHash = {
 FuzzyHashValue: ExtensionType
 ? Application: any
 ? AdditionalData: [* ExtensionType]
}

; ** unused: {"SignatureValue"=>"xxxxxxxx", "id"=>"xxxxxxxx"}
SignatureData = {
 Signature: any
}

Indicator = {
 ? restriction: restriction
 ? ext-restriction: text
 IndicatorID: IndicatorID
 ? AlternativeIndicatorID: AlternativeIndicatorID
 ? Description: text
 ? StartTime: any
 ? EndTime: any
 ? Confidence: Confidence
 ? Contact: Contact
 ? Observable: any
 ? ObservableReference: ObservableReference
 ? IndicatorExpression: IndicatorExpression
 ? IndicatorReference: IndicatorReference
 ? NodeRole: NodeRole
 ? AttackPhase: AttackPhase
 ? Reference: Reference
 ? AdditionalData: [* ExtensionType]
}

IndicatorID = {
 ? id: any
 name: text
 version: text
}

AlternativeIndicatorID = {
 ? restriction: restriction
 ? ext-restriction: text
 IndicatorReference: IndicatorReference
}

Observable = {
 ? restriction: restriction
 ? ext-restriction: text
 ? System: any
 ? Address: any
 ? DomainData: DomainData
 ? EmailData: any
 ? Service: Service
 ? WindowsRegistryKeysModified: any
 ? FileData: FileData
 ? CertificateData: CertificateData
 ? RegistryHandle: any
 ? Record: Record
 ? EventData: any
 ? Incident: any
 ? Expectation: Expectation
 ? Reference: Reference
 ? Assessment: any
 ? DetectionPattern: any
 ? HistoryItem: any
 ? BulkObservable: text
 ? AdditionalData: [* ExtensionType]
}

BulkObservable = {
 ? type: any
 ? ext-type: any
 ? BulkObservableFormant: any
 ? BulkObservableList: text
 ? AdditionalData: [* ExtensionType]
}

BulkObservableFormat = {
 ? Hash: Hash
 ? AdditionalData: [* ExtensionType]
}

IndicatorExpression = {
 ? operator: any
 ? ext-operator: text
 ? IndicatorExpression: IndicatorExpression
 ? Observable: any
 ? ObservableReference: ObservableReference
 ? IndicatorReference: IndicatorReference
 ? AdditionalData: [* ExtensionType]
}

ObservableReference = {
 uid-ref: any
}

IndicatorReference = {
 ? uid-ref: any
 ? euid-ref: text
 ? version: text
}

AttackPhase = {
 ? AttackPhaseID: text
 ? URL: URLtype
 ? Description: text
 ? AdditionalData: [* ExtensionType]
}

anymap = {
 * text => any
}