Incident Object Description Exchange Format

Used for computer security, IODEF (Incident Object Description Exchange Format) is a data format which is used to describe computer security information for the purpose of exchange between Computer Security Incident Response Teams (CSIRTs).

This RFC presents an implementation of the data model in XML as well as the associated DTD.

For this reason, IODEF is heavily based on IDMEF and provides backward compatibility with it.

IODEF is an object-oriented structured format, composed of 47 classes in the first version.

The IODEF and IDMEF formats having a lot in common: the field structure is similar to the IDMEF one and it is an extensible format: in addition to the usual Additional Data Class, which allow adding any information relevant to the IODEF message, most enumerations are provided with an "ext" field.