<?xml version="1.0" encoding="UTF-8"?>
<!-- edited with XMLSPY v5 rel. 3 U (http://www.xmlspy.com) by A.Demchenko (IODEF Schema) -->
<!--Sample XML file generated by XMLSPY v5 rel. 3 U (http://www.xmlspy.com)-->
<IODEF-Document xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="D:\My Documents\demch_projects\xml_projects\iodef\draft-ietf-inch-iodef-01updated.xsd" version="0.1">
	<Incident restriction="default" purpose="handling">
		<IncidentID name="Text" restriction="default"/>
		<AlternativeID restriction="default">
			<IncidentID name="Text" restriction="default"/>
		</AlternativeID>
		<IncidentData restriction="default">
			<Description lang="en-us"/>
			<Contact contactrole="creator" contacttype="person" restriction="default">
				<name lang="en-us">String</name>
				<Description lang="en-us"/>
				<RegistryHandle registrytype="local"/>
				<PostalAddress lang="en-us"/>
				<Email>String</Email>
				<Telephone>3.1415926535897932384626433832795</Telephone>
				<Fax>3.1415926535897932384626433832795</Fax>
				<TimeZone>String</TimeZone>
			</Contact>
			<ReportTime ntpstamp="String"/>
			<DetectTime ntpstamp="String"/>
			<StartTime ntpstamp="String"/>
			<EndTime ntpstamp="String"/>
			<Expectation restriction="default" priority="low" expectation="nothing">
				<Description lang="en-us"/>
				<Contact contactrole="creator" contacttype="person" restriction="default">
					<name lang="en-us">String</name>
					<Description lang="en-us"/>
					<RegistryHandle registrytype="local"/>
					<PostalAddress lang="en-us"/>
					<Email>String</Email>
					<Telephone>3.1415926535897932384626433832795</Telephone>
					<Fax>3.1415926535897932384626433832795</Fax>
					<TimeZone>String</TimeZone>
				</Contact>
				<StartTime ntpstamp="String"/>
				<EndTime ntpstamp="String"/>
			</Expectation>
			<Method restriction="default">
				<Classification origin="other">
					<name lang="en-us">String</name>
					<url>String</url>
				</Classification>
				<Description lang="en-us"/>
			</Method>
			<Assessment restriction="default">
				<Impact restriction="default" severity="low" completion="failed" impacttype="unknown" lang="en-us"/>
				<TimeImpact restriction="default" severity="low" unit="labor" metric="hours"/>
				<MonetaryImpact restriction="default" severity="low" currency="String"/>
				<LifeImpact restriction="default" severity="low" metric="deaths"/>
				<Confidence rating="low"/>
			</Assessment>
			<EventData restriction="default">
				<Description lang="en-us"/>
				<Contact contactrole="creator" contacttype="person" restriction="default">
					<name lang="en-us">String</name>
					<Description lang="en-us"/>
					<RegistryHandle registrytype="local"/>
					<PostalAddress lang="en-us"/>
					<Email>String</Email>
					<Telephone>3.1415926535897932384626433832795</Telephone>
					<Fax>3.1415926535897932384626433832795</Fax>
					<TimeZone>String</TimeZone>
				</Contact>
				<ReportTime ntpstamp="String"/>
				<DetectTime ntpstamp="String"/>
				<StartTime ntpstamp="String"/>
				<EndTime ntpstamp="String"/>
				<Expectation restriction="default" priority="low" expectation="nothing">
					<Description lang="en-us"/>
					<Contact contactrole="creator" contacttype="person" restriction="default">
						<name lang="en-us">String</name>
						<Description lang="en-us"/>
						<RegistryHandle registrytype="local"/>
						<PostalAddress lang="en-us"/>
						<Email>String</Email>
						<Telephone>3.1415926535897932384626433832795</Telephone>
						<Fax>3.1415926535897932384626433832795</Fax>
						<TimeZone>String</TimeZone>
					</Contact>
					<StartTime ntpstamp="String"/>
					<EndTime ntpstamp="String"/>
				</Expectation>
				<System restriction="default" interface="String" systemcat="source" spoofed="unknown">
					<Node nodecat="unknown">
						<name lang="en-us">String</name>
						<Address addrcat="unknown" vlan-name="String" vlan-num="String">
							<address>String</address>
							<netmask>String</netmask>
						</Address>
						<DateTime ntpstamp="String"/>
						<name lang="en-us">String</name>
						<Address addrcat="unknown" vlan-name="String" vlan-num="String">
							<address>String</address>
							<netmask>String</netmask>
						</Address>
						<Location lang="en-us"/>
						<NodeRole noderolecat="other" lang="en-us"/>
					</Node>
					<User usercat="unknown">
						<UserId idtype="original-user">
							<name lang="en-us">String</name>
						</UserId>
					</User>
					<Process ident="0">
						<name lang="en-us">String</name>
						<pid>String</pid>
						<path>String</path>
						<arg>String</arg>
						<env>String</env>
					</Process>
					<Service ident="0">
						<name lang="en-us">String</name>
						<protocol>String</protocol>
						<SNMPService>
							<oid>String</oid>
							<community>String</community>
							<command>String</command>
						</SNMPService>
						<WebService>
							<url>String</url>
							<cgi>String</cgi>
							<http-method>String</http-method>
							<arg>String</arg>
						</WebService>
					</Service>
					<FileList filecat="current">
						<File ident="0" filecat="current" fstype="String">
							<name lang="en-us">String</name>
							<path>String</path>
							<modify-time>String</modify-time>
							<access-time>String</access-time>
							<create-time>String</create-time>
							<data-size>String</data-size>
							<disk-size>String</disk-size>
							<FileAccess>
								<UserId idtype="original-user">
									<name lang="en-us">String</name>
								</UserId>
								<permission>String</permission>
							</FileAccess>
							<Linkage linkcat="Text">
								<name lang="en-us">String</name>
								<path>String</path>
							</Linkage>
							<Inode>
								<change-time>String</change-time>
								<number>String</number>
								<major-device>String</major-device>
								<minor-device>String</minor-device>
								<c-major-device>String</c-major-device>
								<c-minor-device>String</c-minor-device>
							</Inode>
						</File>
					</FileList>
				</System>
				<Method restriction="default">
					<Classification origin="other">
						<name lang="en-us">String</name>
						<url>String</url>
					</Classification>
					<Description lang="en-us"/>
				</Method>
				<Assessment restriction="default">
					<Impact restriction="default" severity="low" completion="failed" impacttype="unknown" lang="en-us"/>
					<TimeImpact restriction="default" severity="low" unit="labor" metric="hours"/>
					<MonetaryImpact restriction="default" severity="low" currency="String"/>
					<LifeImpact restriction="default" severity="low" metric="deaths"/>
					<Confidence rating="low"/>
				</Assessment>
				<History restriction="default">
					<HistoryItem restriction="default" historycat="Text">
						<DateTime ntpstamp="String"/>
						<IncidentID name="Text" restriction="default"/>
						<Description lang="en-us"/>
					</HistoryItem>
				</History>
				<Record restriction="default">
					<RecordData restriction="default">
						<Description lang="en-us"/>
						<DateTime ntpstamp="String"/>
						<Analyzer analyzerid="0" manufacturer="String" model="String" version="String" class="String" ostype="String" osversion="String">
							<Node nodecat="unknown">
								<name lang="en-us">String</name>
								<Address addrcat="unknown" vlan-name="String" vlan-num="String">
									<address>String</address>
									<netmask>String</netmask>
								</Address>
								<DateTime ntpstamp="String"/>
								<name lang="en-us">String</name>
								<Address addrcat="unknown" vlan-name="String" vlan-num="String">
									<address>String</address>
									<netmask>String</netmask>
								</Address>
								<Location lang="en-us"/>
								<NodeRole noderolecat="other" lang="en-us"/>
							</Node>
							<Process ident="0">
								<name lang="en-us">String</name>
								<pid>String</pid>
								<path>String</path>
								<arg>String</arg>
								<env>String</env>
							</Process>
						</Analyzer>
						<RecordItem adtype="boolean" meaning="String" dtype="boolean"/>
					</RecordData>
				</Record>
				<AdditionalData adtype="boolean" meaning="String"/>
			</EventData>
			<History restriction="default">
				<HistoryItem restriction="default" historycat="Text">
					<DateTime ntpstamp="String"/>
					<IncidentID name="Text" restriction="default"/>
					<Description lang="en-us"/>
				</HistoryItem>
			</History>
			<AdditionalData adtype="boolean" meaning="String"/>
		</IncidentData>
		<Description lang="en-us"/>
		<RelatedActivity restriction="default">
			<IncidentID name="Text" restriction="default"/>
		</RelatedActivity>
		<AdditionalData adtype="boolean" meaning="String"/>
	</Incident>
</IODEF-Document>
