{"id":878,"date":"2026-05-28T10:57:34","date_gmt":"2026-05-28T08:57:34","guid":{"rendered":"https:\/\/www.idmefv2.org\/?p=878"},"modified":"2026-05-28T10:57:35","modified_gmt":"2026-05-28T08:57:35","slug":"news-letter-v08-is-out","status":"publish","type":"post","link":"https:\/\/www.idmefv2.org\/index.php\/2026\/05\/28\/news-letter-v08-is-out\/","title":{"rendered":"News letter: V08 is out"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Dear all,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We are please ton announce IDMEFv2 V08 Draft with a lot of improvement.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/datatracker.ietf.org\/doc\/draft-lehmann-idmefv2\">https:\/\/datatracker.ietf.org\/doc\/draft-lehmann-idmefv2<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">(V07 was submitted last month but to buggy so please jump to V08)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Major changes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>We ultimately abandoned the vector class. Following feedback from ENG, we tried to clarify the difference between vector and source, and in several cases, especially for physical incidents, it&#8217;s complicated. Furthermore, the vector is often used for analysis, not detection.<\/li>\n\n\n\n<li>Complete redesign of most enumerations, especially alert.type with lots of new categories.\u00a0<\/li>\n\n\n\n<li>Long enumeration have been moved in appendix to ease draft reading<\/li>\n\n\n\n<li>Few modifications for incident reporting use cases with new incident status (open, closed, falsepositive and reported), source and target categories, EntitySector attribute\u00a0 and a new ReportTime attribute\u00a0<\/li>\n\n\n\n<li>Minor modifications: Some ID changed to optional, typos, etc.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Next modifications:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Add message Signature attributes (based on RFC 7515 :\u00a0\u00a0JSON Web Signature (JWS)<\/li>\n\n\n\n<li>Defining a way to deal with K8S incidents Source and Target identification (without new attributes &#8230;)<\/li>\n\n\n\n<li>Defining a new extension method mechanism inspired from public and private MIBs (first one should be to externalize some Report attributes and create &#8220;Report&#8221; extension)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Next steps:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>2026 May-June: A massive communication is starting to inform potential end users: Defence, Regulation, CERTs, etc.<\/li>\n\n\n\n<li>2026 End of July: We plan to be present at IETF 126 in Viennato start talking about submission (so we need some sponsoring before)<\/li>\n\n\n\n<li>2026 September: We plan to submit the draft in September so there will probably be several version before<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Keep testing and experimenting!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IDMEFv2 Task Force<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dear all, We are please ton announce IDMEFv2 V08 Draft with a lot of improvement.&nbsp; https:\/\/datatracker.ietf.org\/doc\/draft-lehmann-idmefv2 (V07 was submitted last month but to buggy so please jump to V08) Major changes: Next modifications: Next steps: Keep testing and experimenting! IDMEFv2 Task Force<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-878","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/posts\/878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/comments?post=878"}],"version-history":[{"count":1,"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/posts\/878\/revisions"}],"predecessor-version":[{"id":879,"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/posts\/878\/revisions\/879"}],"wp:attachment":[{"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/media?parent=878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/categories?post=878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.idmefv2.org\/index.php\/wp-json\/wp\/v2\/tags?post=878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}