The following schema is for Macintosh.
<?xml version="1.0" encoding="UTF-8"?> <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" targetNamespace="http://www.trellix.com/alert/2014/AlertSchema" xmlns="http://www.trellix.com/alert/2014/AlertSchema"> <xs:include schemaLocation="MacintoshOSCDataSet.xsd" /> <xs:element name="alerts"> <xs:complexType> <xs:sequence> <xs:element ref="alert" minOccurs="0" maxOccurs="unbounded" /> </xs:sequence> <xs:attribute name="appliance" use="required" type="xs:string" /> <!-- Appliance ID, which is the MAC addr --> <xs:attribute name="appliance-id" use="optional" type="xs:string" /> <xs:attribute name="product" use="optional" type="ProductType" /> <xs:attribute name="version" use="optional" type="xs:string" /> <xs:attribute name="msg" type="xs:string" /> </xs:complexType> </xs:element> <xs:element name="alert"> <xs:complexType> <xs:all> <xs:element ref="explanation" minOccurs="0" /> <xs:element ref="src" minOccurs="0" /> <xs:element ref="alert-url" minOccurs="0" /> <xs:element ref="action" minOccurs="0" /> <xs:element ref="locations" minOccurs="0" /> <xs:element name="description" type="xs:string" minOccurs="0" /> <xs:element name="occurred" type="feDateTime" minOccurs="0" /> <xs:element minOccurs="0" name="dst"> <xs:complexType> <xs:all> <xs:element ref="mac" minOccurs="0" /> <xs:element name="port" type="xs:integer" minOccurs="0" /> <xs:element ref="ip" minOccurs="0" /> <xs:element name="smtp-to" type="xs:string" minOccurs="0" /> <xs:element name="smtp-cc" type="xs:string" minOccurs="0" /> </xs:all> </xs:complexType> </xs:element> <xs:element maxOccurs="1" minOccurs="0" name="smtp-message"> <xs:complexType> <xs:all> <xs:element name="subject" type="xs:string" minOccurs="0" /> <xs:element minOccurs="0" name="smtp-header" type="xs:string" /> <xs:element minOccurs="0" name="last-malware" type="xs:string" /> <xs:element minOccurs="0" name="protocol" type="xs:string" /> <xs:element name="date" type="xs:string" /> </xs:all> <xs:attribute name="id" type="xs:string" use="required" /> <xs:attribute name="queue-id" type="xs:string" use="optional" /> </xs:complexType> </xs:element> <xs:element name="interface" minOccurs="0"> <xs:complexType> <xs:simpleContent> <xs:extension base="xs:string"> <xs:attribute name="label" type="InterfaceLabel" /> <xs:attribute name="mode" type="InterfaceMode" /> </xs:extension> </xs:simpleContent> </xs:complexType> </xs:element> </xs:all> <!-- Appliance ID, which is the MAC addr --> <xs:attribute name="appliance-id" use="optional" type="xs:string" /> <xs:attribute name="id" use="required" type="xs:long" /> <xs:attribute name="root-infection" use="optional" type="xs:unsignedLong" /> <xs:attribute name="sensor-ip" use="optional" type="xs:string" /> <xs:attribute name="name" use="required" type="AlertType" /> <xs:attribute name="retroactive" use="optional" type="RetroActiveType" /> <xs:attribute name="severity" use="optional" type="AlertSeverity" /> <xs:attribute name="uuid" use="optional" type="xs:string" /> <xs:attribute name="ack" use="optional" type="xs:string" /> <xs:attribute name="product" use="optional" type="ProductType" /> <xs:attribute name="version" use="optional" type="xs:string" /> <xs:attribute name="sigid" use="optional" type="xs:int" /> <xs:attribute name="sensor" use="optional" type="xs:string" /> <xs:attribute name="sigrevision" use="optional" type="xs:int" /> <xs:attribute name="matchcount" use="optional" type="xs:long" /> <!-- ips rule name, this is used only for ips event added on : 03/17 2014 --> <xs:attribute name="signame" use="optional" type="xs:string" /> <xs:attribute name="vlan" use="optional" type="xs:integer" /> <xs:attribute name="class" use="optional" type="AlertCategoryType" /> <xs:attribute name="malicious" use="optional" type="xs:string" /> </xs:complexType> </xs:element> <xs:element name="explanation"> <xs:complexType> <xs:sequence> <!-- for ips events --> <xs:element minOccurs="0" name="ips-detected"> <xs:complexType> <xs:sequence> <xs:element maxOccurs="unbounded" minOccurs="0" ref="ips-event" /> </xs:sequence> </xs:complexType> </xs:element> <xs:element minOccurs="0" name="malware-detected"> <xs:complexType> <xs:sequence> <xs:element maxOccurs="unbounded" minOccurs="0" ref="malware" /> </xs:sequence> </xs:complexType> </xs:element> <xs:element minOccurs="0" name="cnc-services"> <xs:complexType> <xs:sequence> <xs:element maxOccurs="unbounded" minOccurs="0" ref="cnc-service" /> </xs:sequence> </xs:complexType> </xs:element> <xs:element name="os-changes" maxOccurs="unbounded" minOccurs="0"> <xs:complexType> <xs:complexContent> <xs:extension base="OSCChangeSet"> <xs:attribute name="osinfo" type="xs:string" /> <xs:attribute name="id" type="xs:long" /> <xs:attribute name="version" type="xs:string" use="optional" /> </xs:extension> </xs:complexContent> </xs:complexType> </xs:element> <xs:element minOccurs="0" name="static-analysis"> <xs:complexType> <xs:sequence> <xs:element maxOccurs="unbounded" minOccurs="0" ref="static" /> </xs:sequence> </xs:complexType> </xs:element> <xs:element name="service" type="xs:string" minOccurs="0" /> <xs:element ref="anomaly" minOccurs="0" /> <xs:element ref="target-application" minOccurs="0" /> <xs:element ref="target-os" minOccurs="0" /> <xs:element ref="osinfo" minOccurs="0" /> <xs:element ref="stolen_data" minOccurs="0" /> </xs:sequence> <xs:attribute name="analysis" use="optional" type="xs:NCName" /> <xs:attribute name="protocol" use="optional" type="xs:string" /> <xs:attribute name="urls" use="optional" type="xs:integer" /> </xs:complexType> </xs:element> <!-- ips related information --> <xs:element name="ips-event"> <xs:complexType> <xs:sequence> <xs:element name="sig-id" type="xs:string" minOccurs="0" /> <xs:element name="sig-revision" type="xs:string" minOccurs="0" /> <xs:element name="sig-name" type="xs:string" minOccurs="0" /> <xs:element name="match-count" type="xs:integer" minOccurs="0" /> <xs:element name="cve-id" type="xs:string" minOccurs="0" /> <xs:element name="action-taken" type="xs:string" minOccurs="0" /> <xs:element name="attack-mode" type="xs:string" minOccurs="0" /> <xs:element name="mvx-status" type="xs:string" minOccurs="0" /> </xs:sequence> </xs:complexType> </xs:element> <xs:element name="malware"> <xs:complexType mixed="false"> <xs:all maxOccurs="1" minOccurs="0"> <xs:element ref="note" minOccurs="0" /> <xs:element ref="url" minOccurs="0" /> <xs:element name="profile" type="xs:string" minOccurs="0" /> <xs:element name="md5sum" type="xs:string" minOccurs="0" /> <xs:element name="sha1" type="xs:string" minOccurs="0" /> <xs:element name="sha256" type="xs:string" minOccurs="0" /> <xs:element name="sha512" type="xs:string" minOccurs="0" /> <xs:element name="application" type="xs:string" minOccurs="0" /> <xs:element name="http-header" type="xs:string" minOccurs="0" /> <xs:element name="domain" type="xs:string" minOccurs="0" /> <xs:element name="user" type="xs:Name" minOccurs="0" /> <xs:element name="original" type="xs:string" minOccurs="0" /> <xs:element name="downloaded-at" type="feDateTime" minOccurs="0" /> <xs:element name="submitted-at" type="feDateTime" minOccurs="0" /> <xs:element name="executed-at" type="feDateTime" minOccurs="0" /> <xs:element minOccurs="0" name="objurl" type="xs:anyURI" /> </xs:all> <xs:attribute name="content" type="xs:string" /> <xs:attribute name="name" use="optional" type="xs:string" /> <xs:attribute name="original-infection-id" use="optional" type="xs:integer" /> <xs:attribute name="original-infection-type" use="optional" type="AlertType" /> <xs:attribute name="original-infection-url" use="optional" type="xs:string" /> <xs:attribute name="scan" type="xs:integer" /> <xs:attribute name="sid" type="xs:string" use="optional" /> <xs:attribute name="type" use="optional" type="xs:string" /> <xs:attribute name="stype" use="optional" type="xs:string" /> <xs:attribute name="archives" type="xs:integer" /> <xs:attribute name="parent" type="xs:long" /> <xs:attribute name="origid" type="xs:long" /> <xs:attribute name="malicious" type="xs:string" /> </xs:complexType> </xs:element> <xs:element name="note" type="xs:string" /> <xs:element name="url" type="xs:string" /> <xs:element name="cnc-service"> <xs:complexType> <xs:all> <xs:element name="address" type="xs:string" minOccurs="0" /> <xs:element ref="channel" minOccurs="0" /> <xs:element minOccurs="0" name="location" type="xs:string" /> </xs:all> <xs:attribute name="port" use="required" type="xs:integer" /> <xs:attribute name="protocol" use="optional" type="xs:NCName" /> <xs:attribute name="sname" use="optional" type="xs:string" /> <xs:attribute name="type" use="optional" type="xs:string" /> </xs:complexType> </xs:element> <xs:element name="channel" type="xs:string" /> <xs:element name="target-application" type="xs:string" /> <xs:element name="anomaly" type="xs:string" /> <xs:element name="target-os" type="xs:string" /> <xs:element name="osinfo" type="xs:string" /> <xs:element name="stolen_data"> <xs:complexType> <xs:sequence> <xs:element ref="info" minOccurs="0" /> </xs:sequence> <xs:attribute name="event_id" use="optional" type="xs:integer" /> <xs:attribute name="size" use="optional" type="xs:integer" /> </xs:complexType> </xs:element> <xs:element name="info"> <xs:complexType> <xs:sequence> <xs:element name="description" type="xs:string" minOccurs="0" /> <xs:element name="severity" type="xs:string" minOccurs="0" /> <xs:choice maxOccurs="unbounded" minOccurs="0"> <xs:element ref="field" /> </xs:choice> </xs:sequence> <xs:attribute name="decrypted" use="optional" type="xs:string" /> <xs:attribute name="encryption" use="optional" type="xs:string" /> <xs:attribute name="type" use="optional" type="xs:string" /> </xs:complexType> </xs:element> <xs:element name="field"> <xs:complexType> <xs:simpleContent> <xs:extension base="xs:string"> <xs:attribute name="name" use="optional" type="xs:string" /> </xs:extension> </xs:simpleContent> </xs:complexType> </xs:element> <xs:element name="src"> <xs:complexType> <xs:all maxOccurs="1" minOccurs="0"> <xs:element ref="ip" minOccurs="0" /> <xs:element ref="mac" minOccurs="0" /> <xs:element minOccurs="0" name="host" type="xs:string" /> <xs:element minOccurs="0" name="port" type="xs:integer" /> <xs:element maxOccurs="1" minOccurs="0" name="domain" type="xs:string" /> <xs:element minOccurs="0" name="smtp-mail-from" type="xs:string" /> <xs:element minOccurs="0" name="repository" type="xs:anyURI" /> <xs:element minOccurs="0" ref="url" /> <xs:element name="proxy" type="xs:string" minOccurs="0" /> </xs:all> <xs:attribute name="vlan" use="optional" type="xs:integer" /> </xs:complexType> </xs:element> <xs:element name="ip" type="xs:string" /> <xs:element name="mac" type="xs:string" /> <xs:element name="alert-url" type="xs:anyURI" /> <xs:element name="action" type="xs:string" /> <xs:element name="locations" type="xs:string" /> <xs:element name="ati-data" type="xs:string" /> <xs:element name="static"> <xs:complexType> <xs:simpleContent> <xs:extension base="xs:string"> <xs:attribute name="version" type="xs:string" /> <xs:attribute name="tool" type="xs:string" form="unqualified" use="required" /> </xs:extension> </xs:simpleContent> </xs:complexType> </xs:element> <xs:simpleType name="RetroActiveType"> <xs:restriction base="xs:string"> <xs:enumeration value="yes" /> <xs:enumeration value="no" /> </xs:restriction> </xs:simpleType> <xs:simpleType name="AlertType"> <xs:restriction base="xs:string"> <xs:enumeration value="malware-callback" /> <xs:enumeration value="domain-match" /> <xs:enumeration value="infection-match" /> <xs:enumeration value="web-infection" /> <xs:enumeration value="malware-object" /> <xs:enumeration value="ips-event" /> <xs:enumeration value="riskware-callback" /> <xs:enumeration value="riskware-object" /> </xs:restriction> </xs:simpleType> <xs:simpleType name="feDateTime"> <xs:restriction base="xs:dateTime"> <xs:whiteSpace value="collapse" /> </xs:restriction> </xs:simpleType> <xs:simpleType name="AlertCategoryType"> <xs:restriction base="xs:string"> <xs:enumeration value="IPS" /> <xs:enumeration value="GENERIC" /> <xs:enumeration value="RISKWARE" /> </xs:restriction> </xs:simpleType> <xs:simpleType name="ProductType"> <xs:restriction base="xs:string"> <xs:enumeration value="Web MPS" /> <xs:enumeration value="Email MPS" /> <xs:enumeration value="File MPS" /> <xs:enumeration value="MAS" /> <xs:enumeration value="CMS" /> </xs:restriction> </xs:simpleType> <xs:simpleType name="AlertSeverity"> <xs:restriction base="xs:string"> <xs:enumeration value="crit" /> <xs:enumeration value="majr" /> <xs:enumeration value="minr" /> <xs:enumeration value="unkn" /> </xs:restriction> </xs:simpleType> <xs:simpleType name="AnalysisType"> <xs:restriction base="xs:string"> <xs:enumeration value="replay" /> <xs:enumeration value="malware" /> <xs:enumeration value="direct" /> <xs:enumeration value="binary" /> <xs:enumeration value="content" /> <xs:enumeration value="none" /> </xs:restriction> </xs:simpleType> <xs:simpleType name="InterfaceLabel"> <xs:restriction base="xs:string"> <xs:enumeration value="A" /> <xs:enumeration value="B" /> <xs:enumeration value="A1" /> <xs:enumeration value="B1" /> <xs:enumeration value="A2" /> <xs:enumeration value="B2" /> <xs:enumeration value="C" /> <xs:enumeration value="D" /> </xs:restriction> </xs:simpleType> <xs:simpleType name="InterfaceMode"> <xs:restriction base="xs:string"> <xs:enumeration value="inline" /> <xs:enumeration value="tap" /> <!-- for EX Series, we need below extra modes (tap is already included above) --> <xs:enumeration value="drop" /> <xs:enumeration value="block-email" /> <xs:enumeration value="monitor" /> </xs:restriction> </xs:simpleType> </xs:schema>