Xml Incident Notification Schema; Usage Guidelines And Conventions For Xml Incident Notification - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

XML Incident Notification Data File and Schema
</Data>
</CSMARS-NOTIFICATION>

XML Incident Notification Schema

The XML incident notification schema document (csmars-incident-notification-v1_0.xsd) can be
downloaded from the the following URL:
http://www.cisco.com/application/x-zip-compressed/en/us/guest/products/ps6840/c1225/ccmigration_09186a00806ba94b.zip

Usage Guidelines and Conventions for XML Incident Notification

All XML incident notification elements are defined in the XML incident notification schema. A WinZip
archive containing a component reference document generated from the schema is available for your
convenience at the following URL:
http://www.cisco.com/application/x-zip-compressed/en/us/guest/products/ps6840/c1225/ccmigration_09186a00806c27e3.zip
You can generate a similar document with the application of your choice, or view components, their
relationships, constraints, attributes, annotations, and usage guidelines within your XML development
environment.
MARS uses a best effort approach to create XML incident notification data. If an error occurs during
data compilation, MARS does not stop the process, but sends the data, even if it is partial. Validating the
data file against the schema would result in errors for these cases.
The following conventions are observed for XML incident notification data:
•
•
•
•
•
User Guide for Cisco Security MARS Local Controller
A-6
<NetBiosName />
<DefaultGateway>0.0.0.0</DefaultGateway>
<OperatingSystem id="0" />
</DeviceObj>
</Incident>
Character encoding is Unicode Transformation Format 8 (UTF-8)
The reported time zone would be the time zone of the local controller reporting the incident
Raw messages from reporting devices are XML-escaped in the data file. Your XML parser should
be able to unescape XML data.
If there is no value for an element available from MARS, the element is included in the data file as
an empty node. For instance, a DNS name may not be available for a device.
All date formats are Mmm dd, yyyy hh:mm:ss AM TZD
Mmm is the month (Jan, Feb, Mar. . . Dec)
–
dd is the day (1–9, 10–31)
–
yyyy is the year (0000–9999)
–
– hh:mm:ss is hours, minutes, seconds
hh are 1–9, 10–12
mm are 00–60
ss are 00–60
AM or PM
–
TZD is time zone designator (PDT, PST, MDT, MST, etc.)
–
Appendix A Cisco Security MARS XML API Reference
78-17020-01