<?xml version="1.0" encoding="UTF-8"?>
<!-- edited with XMLSPY v5 rel. 3 U (http://www.xmlspy.com) by A.Demchenko (IODEF Schema) -->
<!--W3C Schema generated by XMLSPY v5 rel. 3 U (http://www.xmlspy.com)-->
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified">
	<!--
 ********************************************************************
 ********************************************************************
 *** Incident Object Description and Exchange Format XML Schema   ***
 ***               Version 01, March 2003                         ***
 ***                                                              ***
 ********************************************************************
 ********************************************************************
 -->
	<!--
 ====================================================================
 === SECTION 1. Attribute list declarations.                      ===
 ====================================================================
 -->
	<!--
 | Attributes of the IODEF element.  In general, the fixed value
 | of this attribute will change each time a new version of
 | the DTD is released.
 -->
	<!--
 ====================================================================
 === SECTION 3. Attribute value declarations.  Enumerated values  ===
 ===            for the many element-specific attribute lists.    ===
 ====================================================================
 -->
	<!--
 | Defines purpose of the Incident
 -->
	<xs:attribute name="purpose">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="handling"/>
				<xs:enumeration value="statistics"/>
				<xs:enumeration value="warning"/>
				<xs:enumeration value="other"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Defines restriction on access to an element's content 
 -->
	<xs:attribute name="restriction">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="default"/>
				<xs:enumeration value="public"/>
				<xs:enumeration value="need-to-know"/>
				<xs:enumeration value="private"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Expectation.category attributes
 -->
	<xs:attribute name="expectation">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="nothing"/>
				<xs:enumeration value="contact-site"/>
				<xs:enumeration value="contact-me"/>
				<xs:enumeration value="block"/>
				<xs:enumeration value="other"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Expectation.priority attributes
 -->
	<xs:attribute name="priority">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="low"/>
				<xs:enumeration value="medium"/>
				<xs:enumeration value="high"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the AdditionalData.type attribute.
 -->
	<xs:attribute name="adtype">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="boolean"/>
				<xs:enumeration value="byte"/>
				<xs:enumeration value="character"/>
				<xs:enumeration value="date-time"/>
				<xs:enumeration value="integer"/>
				<xs:enumeration value="ntpstamp"/>
				<xs:enumeration value="portlist"/>
				<xs:enumeration value="real"/>
				<xs:enumeration value="string"/>
				<xs:enumeration value="xml"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the RecordItem.type attribute
 -->
	<xs:attribute name="dtype">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="boolean"/>
				<xs:enumeration value="byte"/>
				<xs:enumeration value="character"/>
				<xs:enumeration value="date-time"/>
				<xs:enumeration value="integer"/>
				<xs:enumeration value="ntpstamp"/>
				<xs:enumeration value="portlist"/>
				<xs:enumeration value="real"/>
				<xs:enumeration value="string"/>
				<xs:enumeration value="file"/>
				<xs:enumeration value="path"/>
				<xs:enumeration value="url"/>
				<xs:enumeration value="xml"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the History.type attribute.
 -->
	<xs:attribute name="historycat">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="triaged"/>
				<xs:enumeration value="notification"/>
				<xs:enumeration value="shared-info"/>
				<xs:enumeration value="received-info"/>
				<xs:enumeration value="remediation"/>
				<xs:enumeration value="other"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Address.category attribute.
 -->
	<xs:attribute name="addrcat">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="unknown"/>
				<xs:enumeration value="atm"/>
				<xs:enumeration value="e-mail"/>
				<xs:enumeration value="lotus-notes"/>
				<xs:enumeration value="mac"/>
				<xs:enumeration value="sna"/>
				<xs:enumeration value="vm"/>
				<xs:enumeration value="ipv4-addr"/>
				<xs:enumeration value="ipv4-addr-hex"/>
				<xs:enumeration value="ipv4-net"/>
				<xs:enumeration value="ipv4-net-mask"/>
				<xs:enumeration value="ipv6-addr"/>
				<xs:enumeration value="ipv6-addr-hex"/>
				<xs:enumeration value="ipv6-net"/>
				<xs:enumeration value="ipv6-net-mask"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Contact.role attribute.
 -->
	<xs:attribute name="contactrole">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="creator"/>
				<xs:enumeration value="admin"/>
				<xs:enumeration value="tech"/>
				<xs:enumeration value="irt"/>
				<xs:enumeration value="cc"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Contact.type attribute.
 -->
	<xs:attribute name="contacttype">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="person"/>
				<xs:enumeration value="organisation"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Id.type attribute.
 -->
	<xs:attribute name="idtype">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="current-user"/>
				<xs:enumeration value="original-user"/>
				<xs:enumeration value="target-user"/>
				<xs:enumeration value="user-privs"/>
				<xs:enumeration value="current-group"/>
				<xs:enumeration value="group-privs"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Impact.completion attribute.
 -->
	<xs:attribute name="completion">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="failed"/>
				<xs:enumeration value="succeeded"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the File.category attribute.
 -->
	<xs:attribute name="filecat">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="current"/>
				<xs:enumeration value="original"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Impact.type attribute.
 -->
	<xs:attribute name="impacttype">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="none"/>
				<xs:enumeration value="admin"/>
				<xs:enumeration value="dos"/>
				<xs:enumeration value="file"/>
				<xs:enumeration value="recon"/>
				<xs:enumeration value="user"/>
				<xs:enumeration value="unknown"/>
				<xs:enumeration value="other"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Linkage.category attribute.
 -->
	<xs:attribute name="linkcat">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="hard-link"/>
				<xs:enumeration value="mount-point"/>
				<xs:enumeration value="reparse-point"/>
				<xs:enumeration value="shortcut"/>
				<xs:enumeration value="stream"/>
				<xs:enumeration value="symbolic-link"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the RegistryHandle.type attribute.
 -->
	<xs:attribute name="registrytype">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="internic"/>
				<xs:enumeration value="apnic"/>
				<xs:enumeration value="arin"/>
				<xs:enumeration value="lacnic"/>
				<xs:enumeration value="ripencc"/>
				<xs:enumeration value="ti"/>
				<xs:enumeration value="local"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Confidence.rating attribute.
 -->
	<xs:attribute name="rating">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="low"/>
				<xs:enumeration value="medium"/>
				<xs:enumeration value="high"/>
				<xs:enumeration value="numeric"/>
				<xs:enumeration value="unknown"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Impact.severity attribute.
 -->
	<xs:attribute name="severity">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="low"/>
				<xs:enumeration value="medium"/>
				<xs:enumeration value="high"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Node.category attribute.
 -->
	<xs:attribute name="nodecat">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="unknown"/>
				<xs:enumeration value="ads"/>
				<xs:enumeration value="afs"/>
				<xs:enumeration value="coda"/>
				<xs:enumeration value="dfs"/>
				<xs:enumeration value="dns"/>
				<xs:enumeration value="kerberos"/>
				<xs:enumeration value="nds"/>
				<xs:enumeration value="nis"/>
				<xs:enumeration value="nisplus"/>
				<xs:enumeration value="nt"/>
				<xs:enumeration value="wfw"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the NodeRole.category attribute.
 -->
	<xs:attribute name="noderolecat">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="client"/>
				<xs:enumeration value="server-internal"/>
				<xs:enumeration value="server-public"/>
				<xs:enumeration value="www"/>
				<xs:enumeration value="mail"/>
				<xs:enumeration value="messaging"/>
				<xs:enumeration value="streaming"/>
				<xs:enumeration value="voice"/>
				<xs:enumeration value="file"/>
				<xs:enumeration value="ftp"/>
				<xs:enumeration value="p2p"/>
				<xs:enumeration value="name"/>
				<xs:enumeration value="directory"/>
				<xs:enumeration value="credential"/>
				<xs:enumeration value="print"/>
				<xs:enumeration value="application"/>
				<xs:enumeration value="database"/>
				<xs:enumeration value="infra"/>
				<xs:enumeration value="log"/>
				<xs:enumeration value="other"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the Classification.origin attribute.
 -->
	<xs:attribute name="origin">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="bugtraqid"/>
				<xs:enumeration value="cve"/>
				<xs:enumeration value="certcc"/>
				<xs:enumeration value="vendor"/>
				<xs:enumeration value="local"/>
				<xs:enumeration value="other"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the User.category attribute.
 -->
	<xs:attribute name="usercat">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="unknown"/>
				<xs:enumeration value="application"/>
				<xs:enumeration value="os-device"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 | Values for the System.spoofed attributes
 -->
	<xs:attribute name="spoofed">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="unknown"/>
				<xs:enumeration value="yes"/>
				<xs:enumeration value="no"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!-- 
 | Values for the System.category attribute
 -->
	<xs:attribute name="systemcat">
		<xs:simpleType>
			<xs:restriction base="xs:NMTOKEN">
				<xs:enumeration value="source"/>
				<xs:enumeration value="target"/>
				<xs:enumeration value="intermediate"/>
			</xs:restriction>
		</xs:simpleType>
	</xs:attribute>
	<!--
 ====================================================================
 ==  Element definitions                                           ==
 ====================================================================
 -->
	<!--
=====================================================================
 == IODEF-Document class                                           ==
 ====================================================================
 -->
	<xs:annotation>
		<xs:documentation>Root Element IODEF-Document</xs:documentation>
	</xs:annotation>
	<xs:element name="IODEF-Document">
		<xs:complexType>
			<xs:choice>
				<xs:element ref="Incident" maxOccurs="unbounded"/>
			</xs:choice>
			<xs:attribute name="version" type="xs:string" fixed="0.1"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ==  Incident class                                                ==
 ====================================================================
 -->
	<xs:annotation>
		<xs:documentation>Elements definition starts here with the definition of  
		top class Incident</xs:documentation>
	</xs:annotation>
	<xs:element name="Incident">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="IncidentID"/>
				<xs:element ref="AlternativeID" minOccurs="0"/>
				<xs:element ref="IncidentData"/>
				<xs:element ref="Description" minOccurs="0"/>
				<xs:element ref="RelatedActivity" minOccurs="0"/>
				<xs:element ref="AdditionalData" minOccurs="0" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction" default="default"/>
			<xs:attribute ref="purpose" use="required"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ==  IncidentID class                                              ==
 ====================================================================
 -->
	<xs:element name="IncidentID" type="IncidentIDType"/>
	<xs:complexType name="IncidentIDType">
		<xs:attribute name="name"/>
		<xs:attribute ref="restriction"/>
	</xs:complexType>
	<!--
 ====================================================================
 ==  AlternativeID class                                           ==
 ====================================================================
 -->
	<xs:element name="AlternativeID">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="IncidentID" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ==  RelatedActivity class                                         ==
 ====================================================================
 -->
	<xs:element name="RelatedActivity">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="IncidentID" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ===  AdditionalData class                                        ===
 ====================================================================
 -->
	<xs:element name="AdditionalData" type="AdditionalDataType"/>
	<xs:complexType name="AdditionalDataType">
		<xs:sequence>
			<xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
			<!-- (0,unbounded) elements from any (target and external) namespace -->
		</xs:sequence>
		<xs:attribute ref="adtype" use="required"/>
		<xs:attribute name="meaning" type="xs:string"/>
	</xs:complexType>
	<!--
 ====================================================================
 ===  IncidentData class                                          ===
 ====================================================================
 -->
	<xs:element name="IncidentData">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="Description" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Contact" maxOccurs="unbounded"/>
				<xs:element ref="ReportTime"/>
				<xs:element ref="DetectTime" minOccurs="0"/>
				<xs:element ref="StartTime" minOccurs="0"/>
				<xs:element ref="EndTime" minOccurs="0"/>
				<xs:element ref="Expectation" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Method" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Assessment" maxOccurs="unbounded"/>
				<xs:element ref="EventData" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="History" minOccurs="0"/>
				<xs:element ref="AdditionalData" minOccurs="0" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction" default="default"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ===  Contact class                                               ===
 ===    - name
 ===    - RegistryHandle
 ===    - PostalAddress
 ===    - Email
 ===    - Telephone
 ===    - Fax
 ===    - TimeZone
 ===    - Contact (recursive)
====================================================================
 -->
	<xs:element name="Contact">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="name" minOccurs="0"/>
				<xs:element ref="Description" minOccurs="0"/>
				<xs:element ref="RegistryHandle" minOccurs="0"/>
				<xs:element ref="PostalAddress" minOccurs="0"/>
				<xs:element ref="Email" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Telephone" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Fax" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element name="TimeZone" type="xs:string" minOccurs="0"/>
				<xs:element ref="Contact" minOccurs="0" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="contactrole" use="required"/>
			<xs:attribute ref="contacttype" use="required"/>
			<xs:attribute ref="restriction"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="name">
		<xs:complexType>
			<xs:simpleContent>
				<xs:extension base="xs:string">
					<xs:attribute name="lang" type="xs:language"/>
				</xs:extension>
			</xs:simpleContent>
		</xs:complexType>
	</xs:element>
	<xs:element name="RegistryHandle">
		<xs:complexType>
			<xs:attribute ref="registrytype" use="optional" default="local"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="PostalAddress">
		<xs:complexType>
			<xs:attribute name="lang" type="xs:language"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="Email" type="xs:string"/>
	<xs:element name="Telephone" type="xs:decimal"/>
	<xs:element name="Fax" type="xs:decimal"/>
	<!--
 ====================================================================
 ===  Time-based classes                                          ===
 ===    - DateTime
 ===    - ReportTime
 ===    - DetectTime
 ===    - StartTime
 ===    - EndTime
 ====================================================================
 -->
	<xs:element name="DateTime" type="DateTimeType"/>
	<xs:element name="ReportTime" type="DateTimeType"/>
	<xs:element name="DetectTime" type="DateTimeType"/>
	<xs:element name="StartTime" type="DateTimeType"/>
	<xs:element name="EndTime" type="DateTimeType"/>
	<xs:complexType name="DateTimeType">
		<xs:attribute name="ntpstamp" type="xs:string" use="optional"/>
	</xs:complexType>
	<!--
 ====================================================================
 ===  History class                                               ===
 ===    - HistoryItem
 ====================================================================
 -->
	<xs:element name="History">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="HistoryItem" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction" default="default"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="HistoryItem">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="DateTime"/>
				<xs:element ref="IncidentID" minOccurs="0"/>
				<xs:element ref="Description" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction"/>
			<xs:attribute name="historycat"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ===  Expectation class                                           ===
 ====================================================================
 -->
	<xs:element name="Expectation">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="Description" maxOccurs="unbounded"/>
				<xs:element ref="Contact" minOccurs="0"/>
				<xs:element ref="StartTime" minOccurs="0"/>
				<xs:element ref="EndTime" minOccurs="0"/>
			</xs:sequence>
			<xs:attribute ref="restriction" default="default"/>
			<xs:attribute ref="priority"/>
			<xs:attribute ref="expectation"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ===  Method class                                                ===
 ===    - Classification
 ====================================================================
 -->
	<xs:element name="Method">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="Classification" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Description" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="Classification">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="name"/>
				<xs:element ref="url"/>
			</xs:sequence>
			<xs:attribute ref="origin" default="other"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ===  Assessment class                                            ===
 ===    - Impact
 ===    - TimeImpact
 ===    - MonetaryImpact
 ===    - LifeImpact
 ===    - Confidence
 ====================================================================
 -->
	<xs:element name="Assessment">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="Impact" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="TimeImpact" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="MonetaryImpact" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="LifeImpact" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Confidence" minOccurs="0"/>
			</xs:sequence>
			<xs:attribute ref="restriction"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="Impact">
		<xs:complexType>
			<xs:attribute ref="restriction"/>
			<xs:attribute ref="severity"/>
			<xs:attribute ref="completion"/>
			<xs:attribute ref="impacttype" use="optional" default="unknown"/>
			<xs:attribute name="lang" type="xs:language"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="TimeImpact">
		<xs:complexType>
			<xs:attribute ref="restriction"/>
			<xs:attribute ref="severity"/>
			<xs:attribute name="unit" use="required">
				<xs:simpleType>
					<xs:restriction base="xs:NMTOKEN">
						<xs:enumeration value="labor"/>
						<xs:enumeration value="elapsed"/>
						<xs:enumeration value="downtime"/>
					</xs:restriction>
				</xs:simpleType>
			</xs:attribute>
			<xs:attribute name="metric" default="hours">
				<xs:simpleType>
					<xs:restriction base="xs:NMTOKEN">
						<xs:enumeration value="days"/>
						<xs:enumeration value="hours"/>
						<xs:enumeration value="minutes"/>
						<xs:enumeration value="seconds"/>
					</xs:restriction>
				</xs:simpleType>
			</xs:attribute>
		</xs:complexType>
	</xs:element>
	<xs:element name="MonetaryImpact">
		<xs:complexType>
			<xs:attribute ref="restriction"/>
			<xs:attribute ref="severity"/>
			<xs:attribute name="currency" type="xs:string"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="LifeImpact">
		<xs:complexType>
			<xs:attribute ref="restriction"/>
			<xs:attribute ref="severity"/>
			<xs:attribute name="metric">
				<xs:simpleType>
					<xs:restriction base="xs:NMTOKEN">
						<xs:enumeration value="deaths"/>
						<xs:enumeration value="injuries"/>
					</xs:restriction>
				</xs:simpleType>
			</xs:attribute>
		</xs:complexType>
	</xs:element>
	<xs:element name="Confidence">
		<xs:complexType>
			<xs:attribute ref="rating" use="required"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 === EventData class                                              ===
 ====================================================================
 -->
	<xs:element name="EventData">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="Description" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Contact" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="ReportTime" minOccurs="0"/>
				<xs:element ref="DetectTime" minOccurs="0"/>
				<xs:element ref="StartTime" minOccurs="0"/>
				<xs:element ref="EndTime" minOccurs="0"/>
				<xs:element ref="Expectation" minOccurs="0"/>
				<xs:element ref="System" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Method" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Assessment" minOccurs="0"/>
				<xs:element ref="EventData" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="History" minOccurs="0"/>
				<xs:element ref="Record" minOccurs="0"/>
				<xs:element ref="AdditionalData" minOccurs="0" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction" default="default"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ===  System class                                                ===
 ===  Note. Represents merged Source and  Target classes of IDMF 
 ===  (sections 4.2.4.3, 4.2.4.4) 
 ====================================================================
 -->
	<xs:element name="System">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="Node"/>
				<xs:element ref="User" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Process" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Service" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="FileList" minOccurs="0"/>
			</xs:sequence>
			<xs:attribute ref="restriction"/>
			<xs:attribute name="interface" type="xs:string"/>
			<xs:attribute ref="systemcat"/>
			<xs:attribute ref="spoofed" default="unknown"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ===  FileList class               IDMEF (4.2.7.5)                    ===
 ===    - File
 ===        - access-time
 ===        - change-time
 ===        - create-time
 ===        - modify-time
 ===        - c-major-device
 ===        - c-minor-device
 ===        - data-size
 ===        - disk-size
 ===        - 
 ====================================================================
 -->
	<xs:element name="FileList">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="File" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="filecat"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="File">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="name"/>
				<xs:element ref="path"/>
				<xs:element ref="modify-time" minOccurs="0"/>
				<xs:element ref="access-time" minOccurs="0"/>
				<xs:element ref="create-time" minOccurs="0"/>
				<xs:element ref="data-size" minOccurs="0"/>
				<xs:element ref="disk-size" minOccurs="0"/>
				<xs:element ref="FileAccess" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Linkage" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Inode" minOccurs="0"/>
			</xs:sequence>
			<xs:attribute name="ident" type="xs:string" default="0"/>
			<xs:attribute ref="filecat" use="required"/>
			<xs:attribute name="fstype" type="xs:string" use="required"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="access-time" type="xs:string"/>
	<xs:element name="change-time" type="xs:string"/>
	<xs:element name="create-time" type="xs:string"/>
	<xs:element name="modify-time" type="xs:string"/>
	<xs:element name="c-major-device" type="xs:string"/>
	<xs:element name="c-minor-device" type="xs:string"/>
	<xs:element name="data-size" type="xs:string"/>
	<xs:element name="disk-size" type="xs:string"/>
	<xs:element name="major-device" type="xs:string"/>
	<xs:element name="minor-device" type="xs:string"/>
	<xs:element name="Linkage">
		<xs:complexType>
			<xs:choice>
				<xs:sequence>
					<xs:element ref="name"/>
					<xs:element ref="path"/>
				</xs:sequence>
				<xs:element ref="File"/>
			</xs:choice>
			<xs:attribute name="linkcat" use="required"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="FileAccess">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="UserId"/>
				<xs:element ref="permission" maxOccurs="unbounded"/>
			</xs:sequence>
		</xs:complexType>
	</xs:element>
	<xs:element name="permission" type="xs:string"/>
	<xs:element name="Inode">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="change-time" minOccurs="0"/>
				<xs:sequence minOccurs="0">
					<xs:element ref="number"/>
					<xs:element ref="major-device"/>
					<xs:element ref="minor-device"/>
				</xs:sequence>
				<xs:sequence minOccurs="0">
					<xs:element ref="c-major-device"/>
					<xs:element ref="c-minor-device"/>
				</xs:sequence>
			</xs:sequence>
		</xs:complexType>
	</xs:element>
	<!--
====================================================================
====== Node class                                        ===
 ===      - Address
 ===      - NodeRole
 ===      - Location
 ===      - name
 ===    Note. IODEF Node class is extended IDMEF Node class (4.2.7.1):     
 ===        <!ELEMENT Node ( location?, (name | Address), Address* )>
 ====================================================================
 -->
	<xs:element name="Node">
		<xs:complexType>
			<xs:sequence>
				<xs:sequence>
					<xs:choice>
						<xs:element ref="name"/>
						<xs:element ref="Address"/>
					</xs:choice>
					<xs:element ref="Address" minOccurs="0" maxOccurs="unbounded"/>
				</xs:sequence>
				<xs:element ref="DateTime" minOccurs="0"/>
				<xs:element ref="name" minOccurs="0"/>
				<xs:element ref="Address" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="Location" minOccurs="0"/>
				<xs:element ref="NodeRole" minOccurs="0" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="nodecat" default="unknown"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="Address">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="address"/>
				<xs:element ref="netmask" minOccurs="0"/>
			</xs:sequence>
			<xs:attribute ref="addrcat" default="unknown"/>
			<xs:attribute name="vlan-name" type="xs:string"/>
			<xs:attribute name="vlan-num" type="xs:string"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="address" type="xs:string"/>
	<xs:element name="netmask" type="xs:string"/>
	<xs:element name="Location">
		<xs:complexType>
			<xs:attribute name="lang" type="xs:language"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="NodeRole">
		<xs:complexType>
			<xs:attribute ref="noderolecat" default="other"/>
			<xs:attribute name="lang" type="xs:language"/>
		</xs:complexType>
	</xs:element>
	<!--
 ====================================================================
 ===  User class                                                  ===
 ===   - UserID
 ===  DTD  <!ELEMENT UserId (name | number | (name, number))>
 ====================================================================
 -->
	<xs:element name="User">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="UserId" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="usercat" default="unknown"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="UserId">
		<xs:complexType>
			<xs:choice>
				<xs:element ref="name"/>
				<xs:element ref="number"/>
				<xs:sequence>
					<xs:element ref="name"/>
					<xs:element ref="number"/>
				</xs:sequence>
			</xs:choice>
			<xs:attribute ref="idtype" default="original-user"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="number" type="xs:string"/>
	<!--
 ====================================================================
 ===  Process class                                               ===
 ===  IDMEF (4.2.7.3) 
 ===   <!ELEMENT Process (name, pid?, path?, arg*, env* )>
 ====================================================================
 -->
	<xs:element name="Process">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="name"/>
				<xs:element ref="pid" minOccurs="0"/>
				<xs:element ref="path" minOccurs="0"/>
				<xs:element ref="arg" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="env" minOccurs="0" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute name="ident" type="xs:string" default="0"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="env" type="xs:string"/>
	<xs:element name="pid" type="xs:string"/>
	<!--
 ====================================================================
 ===  Service Class                                               ===
 ===    - port
 ===    - portlist
 ===    - protocol
 ===    - SNMPService
 ===    - WebService
 ===        - url, cgi, arg, http-method
 ===    - SNMPService
 ===        - oid, community, command
 ===   IDMEF (4.2.7.4) 
 ===   <!ELEMENT Service ((((name, port?) | (port, name?)) | portlist), protocol?,
 ===   SNMPService?, WebService? )>
 ====================================================================
 -->
	<xs:element name="Service">
		<xs:complexType>
			<xs:sequence>
				<xs:choice>
					<xs:choice>
						<xs:element ref="name"/>
						<xs:element ref="port"/>
						<xs:sequence>
							<xs:element ref="name"/>
							<xs:element ref="port"/>
						</xs:sequence>
					</xs:choice>
					<xs:element ref="portlist"/>
				</xs:choice>
				<xs:element ref="protocol" minOccurs="0"/>
				<xs:element ref="SNMPService" minOccurs="0"/>
				<xs:element ref="WebService" minOccurs="0"/>
			</xs:sequence>
			<xs:attribute name="ident" type="xs:string" default="0"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="port" type="xs:string"/>
	<xs:element name="portlist" type="xs:string"/>
	<xs:element name="protocol" type="xs:string"/>
	<!-- 
 ====== Web Service ======
 -->
	<xs:element name="WebService">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="url"/>
				<xs:element ref="cgi" minOccurs="0"/>
				<xs:element ref="http-method" minOccurs="0"/>
				<xs:element ref="arg" minOccurs="0" maxOccurs="unbounded"/>
			</xs:sequence>
		</xs:complexType>
	</xs:element>
	<xs:element name="cgi" type="xs:string"/>
	<xs:element name="arg" type="xs:string"/>
	<xs:element name="http-method" type="xs:string"/>
	<!--
 ====== SNMPService ======
 -->
	<xs:element name="SNMPService">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="oid" minOccurs="0"/>
				<xs:element ref="community" minOccurs="0"/>
				<xs:element ref="command" minOccurs="0"/>
			</xs:sequence>
		</xs:complexType>
	</xs:element>
	<xs:element name="oid" type="xs:string"/>
	<xs:element name="community" type="xs:string"/>
	<xs:element name="command" type="xs:string"/>
	<!--
 ====================================================================
 ===  Record class                                                ===
 ===    - RecordData
 ===    - Analyzer
 ===    - RecordItem
 ====================================================================
 -->
	<xs:element name="Record">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="RecordData" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="RecordData">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="Description" minOccurs="0" maxOccurs="unbounded"/>
				<xs:element ref="DateTime" minOccurs="0"/>
				<xs:element ref="Analyzer" minOccurs="0"/>
				<xs:element ref="RecordItem" maxOccurs="unbounded"/>
			</xs:sequence>
			<xs:attribute ref="restriction"/>
		</xs:complexType>
	</xs:element>
	<!--Element Analyzer of IODEF is re-used from IDMEF (4.2.4.1) -->
	<xs:element name="Analyzer">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="Node" minOccurs="0"/>
				<xs:element ref="Process" minOccurs="0"/>
			</xs:sequence>
			<xs:attribute name="analyzerid" type="xs:string" default="0"/>
			<xs:attribute name="manufacturer" type="xs:string"/>
			<xs:attribute name="model" type="xs:string"/>
			<xs:attribute name="version" type="xs:string"/>
			<xs:attribute name="class" type="xs:string"/>
			<xs:attribute name="ostype" type="xs:string"/>
			<xs:attribute name="osversion" type="xs:string"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="RecordItem" type="RecordItemType"/>
	<xs:complexType name="RecordItemType">
		<xs:complexContent>
			<xs:extension base="AdditionalDataType">
				<xs:attribute ref="dtype" use="optional"/>
			</xs:extension>
		</xs:complexContent>
	</xs:complexType>
	<!--
 ====================================================================
 === Miscellaneous simple classes                                 ===
 ===   - Description
 ===   - path
 ===   - url
 ====================================================================
 -->
	<xs:element name="Description">
		<xs:annotation>
			<xs:documentation xml:lang="en">Textual description, may use local languages</xs:documentation>
		</xs:annotation>
		<xs:complexType>
			<xs:attribute name="lang" type="xs:language"/>
		</xs:complexType>
	</xs:element>
	<xs:element name="path" type="xs:string"/>
	<xs:element name="url" type="xs:string"/>
	<!--
Full Copyright Statement

   Copyright (C) The Internet Society (2002).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgment

   Funding for the RFC Editor function is currently provided by the
   Internet Society.
-->
</xs:schema>

