<?xml version="1.0" encoding="UTF-8"?>

<xs:schema targetNamespace="draft-ietf-inch-iodef-051.xsd" 
           elementFormDefault="qualified" 
           attributeFormDefault="unqualified" 
           xmlns:iodef="draft-ietf-inch-iodef-050.xsd" 
           xmlns:xs="http://www.w3.org/2001/XMLSchema" 
           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<xs:import namespace="http://www.w3.org/2000/09/xmldsig#" 
           schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/>

<!--
 ********************************************************************
 ********************************************************************
 *** Incident Object Description and Exchange Format XML Schema   ***
 ***               Version 05, November 2005                      ***
 ***               draft-ietf-inch-iodef-05                       ***
 ********************************************************************
 ********************************************************************
 -->

<!--
=====================================================================
 == IODEF-Document class                                           ==
 ====================================================================
-->
  <xs:annotation>
    <xs:documentation>Root Element IODEF-Document</xs:documentation>
  </xs:annotation>
  <xs:element name="IODEF-Document">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:Incident"/>
        <xs:element ref="ds:Signature" minOccurs="0" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute name="version" type="xs:string" fixed="1.00"/>
      <xs:attribute name="lang" type="xs:language"/>
    </xs:complexType>
  </xs:element>

<!--

 ====================================================================
 ===  Incident class                                          ===
 ====================================================================
-->
  <xs:element name="Incident">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:IncidentID"/>
        <xs:element ref="iodef:AlternativeID" minOccurs="0"/>
        <xs:element ref="iodef:RelatedActivity" minOccurs="0"/>
        <xs:element ref="iodef:DetectTime" minOccurs="0"/>
        <xs:element ref="iodef:StartTime" minOccurs="0"/>
        <xs:element ref="iodef:EndTime" minOccurs="0"/>
        <xs:element ref="iodef:ReportTime"/>
        <xs:element ref="iodef:Description" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Assessment" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Method" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Contact" maxOccurs="unbounded"/>
        <xs:element ref="iodef:EventData" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:History" minOccurs="0"/>
        <xs:element ref="iodef:AdditionalData" minOccurs="0" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute name="purpose" use="required">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="traceback"/>
            <xs:enumeration value="mitigation"/>
            <xs:enumeration value="reporting"/>
            <xs:enumeration value="other"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
      <xs:attribute name="lang" type="xs:language"/>
      <xs:attribute ref="iodef:restriction" default="private"/>
    </xs:complexType>
  </xs:element>
  <!--
 ====================================================================
 ==  IncidentID class                                              ==
 ====================================================================
 -->
  <xs:element name="IncidentID" type="iodef:IncidentIDType"/>
  <xs:complexType name="IncidentIDType" mixed="true">
    <xs:attribute name="name" type="xs:string" use="required"/>
  </xs:complexType>
  <!--
 ====================================================================
 ==  AlternativeID class                                           ==
 ====================================================================
 -->
  <xs:element name="AlternativeID">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:IncidentID" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction"/>
    </xs:complexType>
  </xs:element>
  <!--
 ====================================================================
 ==  RelatedActivity class                                         ==
 ====================================================================
 -->
  <xs:element name="RelatedActivity">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:IncidentID" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction"/>
    </xs:complexType>
  </xs:element>
  <!--
 ====================================================================
 ===  AdditionalData class                                        ===
 ====================================================================
 -->
  <xs:element name="AdditionalData" type="iodef:ExtensionType"/>

<!--
 ====================================================================
 ===  Contact class                                               ===
 ===    - ContactName
 ===    - RegistryHandle
 ===    - PostalAddress
 ===    - Email
 ===    - Telephone
 ===    - Fax
 ===    - TimeZone
 ===    - Contact (recursive)
====================================================================
 -->
  <xs:element name="Contact">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:ContactName" minOccurs="0"/>
        <xs:element ref="iodef:Description" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:RegistryHandle" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:PostalAddress" minOccurs="0"/>
        <xs:element ref="iodef:Email" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Telephone" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Fax" minOccurs="0"/>
        <xs:element ref="iodef:TimeZone" minOccurs="0"/>
        <xs:element ref="iodef:Contact" minOccurs="0" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute name="role">
        <xs:simpleType>
           <xs:restriction base="xs:NMTOKEN">
              <xs:enumeration value="creator"/>
              <xs:enumeration value="admin"/>
              <xs:enumeration value="tech"/>
              <xs:enumeration value="irt"/>
              <xs:enumeration value="cc"/>
           </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
      <xs:attribute name="type">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="person"/>
            <xs:enumeration value="organization"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
      <xs:attribute ref="iodef:restriction"/>
    </xs:complexType>
  </xs:element>

  <xs:element name="ContactName" type="iodef:MLStringType" />

  <xs:element name="RegistryHandle">
    <xs:complexType mixed="true">
      <xs:attribute name="type">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="internic"/>
            <xs:enumeration value="apnic"/>
            <xs:enumeration value="arin"/>
            <xs:enumeration value="lacnic"/>
            <xs:enumeration value="ripe"/>
            <xs:enumeration value="afrinic"/>
            <xs:enumeration value="local"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
    </xs:complexType>
  </xs:element>
  <xs:element name="PostalAddress" type="iodef:MLStringType" />
  <xs:element name="Email" type="xs:string"/>
  <xs:element name="Telephone" type="xs:string"/>
  <xs:element name="Fax" type="xs:string"/>
<!--
 ====================================================================
 ===  Time-based classes                                          ===
 ====================================================================
 -->
  <xs:element name="DateTime" type="xs:dateTime"/>
  <xs:element name="ReportTime" type="xs:dateTime"/>
  <xs:element name="DetectTime" type="xs:dateTime"/>
  <xs:element name="StartTime" type="xs:dateTime"/>
  <xs:element name="EndTime" type="xs:dateTime"/>
  <xs:element name="TimeZone" type="iodef:TimeZoneType"/>
  <xs:simpleType name="TimeZoneType">
    <xs:restriction base="xs:string">
      <xs:pattern value="[+-][0-9][0-9][0-9][0-9]"/>
    </xs:restriction>
  </xs:simpleType>
  <!--
 ====================================================================
 ===  History class                                               ===
 ===    - HistoryItem
 ====================================================================
 -->
  <xs:element name="History">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:HistoryItem" minOccurs="1" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction" default="default"/>
    </xs:complexType>
  </xs:element>
  <xs:element name="HistoryItem">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:DateTime"/>
        <xs:element ref="iodef:IncidentID" minOccurs="0"/>
        <xs:element ref="iodef:Description" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction"/>
      <xs:attribute name="category" default="other">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="triaged"/>
            <xs:enumeration value="notification"/>
            <xs:enumeration value="shared-info"/>
            <xs:enumeration value="received-info"/>
            <xs:enumeration value="remediation"/>
            <xs:enumeration value="other"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
     </xs:complexType>
  </xs:element>
  <!--
 ====================================================================
 ===  Expectation class                                           ===
 ====================================================================
 -->
  <xs:element name="Expectation">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:Description" maxOccurs="unbounded"/>
        <xs:element ref="iodef:StartTime" minOccurs="0"/>
        <xs:element ref="iodef:EndTime" minOccurs="0"/>
        <xs:element ref="iodef:Contact" minOccurs="0"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction" default="default"/>
      <xs:attribute ref="iodef:severity"/>
      <xs:attribute name="category">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="nothing"/>
            <xs:enumeration value="contact-site"/>
            <xs:enumeration value="contact-me"/>
            <xs:enumeration value="investigate"/>
            <xs:enumeration value="block-host"/>
            <xs:enumeration value="block-network"/>
            <xs:enumeration value="block-port"/>
            <xs:enumeration value="rate-limit-host"/>
            <xs:enumeration value="rate-limit-network"/>
            <xs:enumeration value="rate-limit-port"/>
            <xs:enumeration value="other"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
    </xs:complexType>
  </xs:element>
  <!--
 ====================================================================
 ===  Method class                                                ===
 ===    - Classification
 ====================================================================
 -->
  <xs:element name="Method">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:Classification" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Description" minOccurs="0" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction"/>
    </xs:complexType>
  </xs:element>
  <xs:element name="Classification">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:name"/>
        <xs:element ref="iodef:url" minOccurs="0" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute name="origin" use="required">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="bugtraqid"/>
            <xs:enumeration value="cve"/>
            <xs:enumeration value="certcc"/>
            <xs:enumeration value="vendor"/>
            <xs:enumeration value="local"/>
            <xs:enumeration value="other"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
    </xs:complexType>
  </xs:element>
  <!--
 ====================================================================
 ===  Assessment class                                            ===
 ===    - Impact
 ===    - TimeImpact
 ===    - MonetaryImpact
 ===    - Confidence
 ====================================================================
 -->
  <xs:element name="Assessment">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:Impact" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:TimeImpact" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:MonetaryImpact" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Confidence" minOccurs="0"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction"/>
    </xs:complexType>
  </xs:element>

  <xs:element name="Impact">
    <xs:complexType>
      <xs:attribute ref="iodef:severity"/>
      <xs:attribute name="completion">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="failed"/>
            <xs:enumeration value="succeeded"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
      <xs:attribute name="type" use="optional" default="unknown">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="none"/>
            <xs:enumeration value="admin"/>
            <xs:enumeration value="dos"/>
            <xs:enumeration value="file"/>
            <xs:enumeration value="recon"/>
            <xs:enumeration value="user"/>
            <xs:enumeration value="unknown"/>
            <xs:enumeration value="other"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
      <xs:attribute name="lang" type="xs:language"/>
    </xs:complexType>
  </xs:element>

  <xs:element name="TimeImpact">
    <xs:complexType>
      <xs:simpleContent>
         <xs:extension base="xs:float">
           <xs:attribute ref="iodef:severity"/>
           <xs:attribute name="unit" use="required">
             <xs:simpleType>
               <xs:restriction base="xs:NMTOKEN">
                 <xs:enumeration value="labor"/>
                 <xs:enumeration value="elapsed"/>
                 <xs:enumeration value="downtime"/>
               </xs:restriction>
             </xs:simpleType>
           </xs:attribute>
           <xs:attribute name="metric" use="required">
             <xs:simpleType>
               <xs:restriction base="xs:NMTOKEN">
                 <xs:enumeration value="days"/>
                 <xs:enumeration value="hours"/>
                 <xs:enumeration value="minutes"/>
                 <xs:enumeration value="seconds"/>
               </xs:restriction>
             </xs:simpleType>
           </xs:attribute>
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>

  <xs:element name="MonetaryImpact">
    <xs:complexType>
      <xs:simpleContent>
        <xs:extension base="xs:float">
          <xs:attribute ref="iodef:severity"/>
          <xs:attribute name="currency" type="xs:string"/>
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>

  <xs:element name="Confidence">
    <xs:complexType>
      <xs:attribute name="rating" use="required">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="low"/>
            <xs:enumeration value="medium"/>
            <xs:enumeration value="high"/>
            <xs:enumeration value="numeric"/>
            <xs:enumeration value="unknown"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
    </xs:complexType>
  </xs:element>
<!--
 ====================================================================
 === EventData class                                              ===
 ====================================================================
 -->
  <xs:element name="EventData">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:Description" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:DetectTime" minOccurs="0"/>
        <xs:element ref="iodef:StartTime" minOccurs="0"/>
        <xs:element ref="iodef:EndTime" minOccurs="0"/>
        <xs:element ref="iodef:Contact" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Assessment" minOccurs="0"/>
        <xs:element ref="iodef:Method" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Flow" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Expectation" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Record" minOccurs="0"/>
        <xs:element ref="iodef:EventData" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:AdditionalData" minOccurs="0" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction" default="default"/>
    </xs:complexType>
  </xs:element>
<!--
 ====================================================================
 ===  Flow class                                                ===
 ====================================================================
 -->
  <xs:element name="Flow">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:System" maxOccurs="unbounded"/>
      </xs:sequence>
    </xs:complexType>
  </xs:element>
<!--
 ====================================================================
 ===  System class                                                ===
 ====================================================================
 -->
  <xs:element name="System">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:Node"/>
        <xs:element ref="iodef:Service" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:OperatingSystem" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Counter" minOccurs="0" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction"/>
      <xs:attribute name="interface" type="xs:string"/>
      <xs:attribute name="category">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="source"/>
            <xs:enumeration value="target"/>
            <xs:enumeration value="intermediate"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
      <xs:attribute name="spoofed" default="unknown">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="unknown"/>
            <xs:enumeration value="yes"/>
            <xs:enumeration value="no"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
    </xs:complexType>
  </xs:element>

<!--
====================================================================
=== Node class                                                   ===
====================================================================
-->
  <xs:element name="Node">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:name" minOccurs="0"/>
        <xs:element ref="iodef:Address" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Location" minOccurs="0"/>
        <xs:element ref="iodef:DateTime" minOccurs="0"/>
        <xs:element ref="iodef:NodeRole" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Counter" minOccurs="0" maxOccurs="unbounded"/>
      </xs:sequence>
    </xs:complexType>
  </xs:element>
  <xs:element name="Address">
    <xs:complexType>
      <xs:simpleContent>
        <xs:extension base="xs:string">
          <xs:attribute name="category">
            <xs:simpleType>
              <xs:restriction base="xs:NMTOKEN">
                <xs:enumeration value="asn"/>
                <xs:enumeration value="atm"/>
                <xs:enumeration value="e-mail"/>
                <xs:enumeration value="mac"/>
                <xs:enumeration value="ipv4-addr"/>
                <xs:enumeration value="ipv4-net"/>
                <xs:enumeration value="ipv4-net-mask"/>
                <xs:enumeration value="ipv6-addr"/>
                <xs:enumeration value="ipv6-net"/>
                <xs:enumeration value="ipv6-net-mask"/>
              </xs:restriction>
            </xs:simpleType>
          </xs:attribute>
          <xs:attribute name="vlan-name" type="xs:string"/>
          <xs:attribute name="vlan-num" type="xs:integer"/>
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>

  <xs:element name="Location" type="xs:string"/>

  <xs:element name="NodeRole">
    <xs:complexType mixed="true">
      <xs:attribute name="category" use="required">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="client"/>
            <xs:enumeration value="server-internal"/>
            <xs:enumeration value="server-public"/>
            <xs:enumeration value="www"/>
            <xs:enumeration value="mail"/>
            <xs:enumeration value="messaging"/>
            <xs:enumeration value="streaming"/>
            <xs:enumeration value="voice"/>
            <xs:enumeration value="file"/>
            <xs:enumeration value="ftp"/>
            <xs:enumeration value="p2p"/>
            <xs:enumeration value="name"/>
            <xs:enumeration value="directory"/>
            <xs:enumeration value="credential"/>
            <xs:enumeration value="print"/>
            <xs:enumeration value="application"/>
            <xs:enumeration value="database"/>
            <xs:enumeration value="infra"/>
            <xs:enumeration value="log"/>
            <xs:enumeration value="other"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
      <xs:attribute name="lang" type="xs:language"/>
    </xs:complexType>
  </xs:element>
<!--
 ====================================================================
 ===  Service Class                                               ===
 ====================================================================
 -->
  <xs:element name="Service">
    <xs:complexType>
      <xs:sequence>
        <xs:choice>
          <xs:element ref="iodef:port"/>
          <xs:element ref="iodef:portlist"/>
        </xs:choice>
        <xs:element ref="iodef:Application" minOccurs="0"/>
      </xs:sequence>
      <xs:attribute name="ip_version" type="xs:integer" default="4"/>
      <xs:attribute name="ip_protocol" type="xs:integer"/>
    </xs:complexType>
  </xs:element>
  <xs:element name="port" type="xs:integer"/>
  <xs:element name="portlist" type="xs:string"/>

<!--
 ====================================================================
 ===  Application and OperatingSystem class                       ===
 ====================================================================
 -->
  <xs:complexType name="SoftwareType">
    <xs:sequence>
      <xs:element ref="iodef:url" minOccurs="0"/>
    </xs:sequence>
    <xs:attribute name="swid" type="xs:string" default="0"/>
    <xs:attribute name="configid" type="xs:string" default="0"/>
    <xs:attribute name="vendor" type="xs:string"/>
    <xs:attribute name="family" type="xs:string"/>
    <xs:attribute name="name" type="xs:string"/>
    <xs:attribute name="version" type="xs:string"/>
    <xs:attribute name="patch" type="xs:string"/>
  </xs:complexType>


  <xs:element name="Application" type="iodef:SoftwareType" />
  <xs:element name="OperatingSystem" type="iodef:SoftwareType" />
<!-- 
 ====================================================================
 ===  Counter class                                              ===
 ====================================================================
 -->
  <xs:element name="Counter">
    <xs:complexType>
      <xs:attribute name="type">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
            <xs:enumeration value="packet"/>
            <xs:enumeration value="session"/>
            <xs:enumeration value="event"/>
            <xs:enumeration value="other"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:attribute>
      <xs:attribute name="meaning" type="xs:string" use="optional"/>
    </xs:complexType>
  </xs:element>
 <!--
 ====================================================================
 ===  Record class                                                ===
 ====================================================================
 -->
  <xs:element name="Record">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:RecordData" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction"/>
    </xs:complexType>
  </xs:element>
  <xs:element name="RecordData">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="iodef:DateTime" minOccurs="0"/>
        <xs:element ref="iodef:Description" minOccurs="0" maxOccurs="unbounded"/>
        <xs:element ref="iodef:Application" minOccurs="0"/>

        <xs:element ref="iodef:RecordPattern" minOccurs="0" maxOccurs="unbounded" />
        <xs:element ref="iodef:RecordItem"  maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute ref="iodef:restriction"/>
    </xs:complexType>
  </xs:element>


  <xs:element name="RecordPattern">
    <xs:complexType>
      <xs:simpleContent>
        <xs:extension base="xs:string">
          <xs:attribute name="type" use="required">
            <xs:simpleType>
              <xs:restriction base="xs:NMTOKEN">
                <xs:enumeration value="regex"/>
                <xs:enumeration value="binary"/>
                <xs:enumeration value="xpath"/>
              </xs:restriction>
            </xs:simpleType>
          </xs:attribute>
          <xs:attribute name="offset" type="xs:integer" use="optional" />
          <xs:attribute name="offsetunit" use="optional" default="line">
            <xs:simpleType>
              <xs:restriction base="xs:NMTOKEN">
                <xs:enumeration value="line"/>
                <xs:enumeration value="byte"/>
              </xs:restriction>
            </xs:simpleType>
          </xs:attribute>
          <xs:attribute name="instance" type="xs:integer" use="optional" />
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>

  <xs:element name="RecordItem" type="iodef:ExtensionType"/>
<!--
 ====================================================================
 === Miscellaneous simple classes                                 ===
 ====================================================================
 -->

  <xs:element name="Description" type="iodef:MLStringType" />

  <xs:element name="name" type="xs:string"/>
  <xs:element name="url" type="xs:string"/>

<!--
 ====================================================================
 === Complex Data Types                                           ===
 ====================================================================
 -->

 <xs:complexType name="MLStringType">
   <xs:simpleContent>
     <xs:extension base="xs:string">
       <xs:attribute name="lang" type="xs:language"/>
     </xs:extension>
   </xs:simpleContent>
 </xs:complexType>

  <xs:complexType name="ExtensionType">
    <xs:simpleContent>
    <xs:extension base="xs:string">
      <xs:attribute name="type" use="required">
      <xs:simpleType>
        <xs:restriction base="xs:NMTOKEN">
          <xs:enumeration value="boolean"/>
          <xs:enumeration value="byte"/>
          <xs:enumeration value="character"/>
          <xs:enumeration value="date-time"/>
          <xs:enumeration value="integer"/>
          <xs:enumeration value="ntpstamp"/>
          <xs:enumeration value="portlist"/>
          <xs:enumeration value="real"/>
          <xs:enumeration value="string"/>
          <xs:enumeration value="file"/>
          <xs:enumeration value="path"/>
          <xs:enumeration value="frame"/>
          <xs:enumeration value="packet"/>
          <xs:enumeration value="ipv4-packet"/>
          <xs:enumeration value="ipv6-packet"/>
          <xs:enumeration value="url"/>
          <xs:enumeration value="xml"/>
        </xs:restriction>
      </xs:simpleType>
      </xs:attribute>
      <xs:attribute name="meaning" type="xs:string"/>
      <xs:attribute name="formatid" type="xs:string"/>
      <xs:attribute ref="iodef:restriction"/>
    </xs:extension>
  </xs:simpleContent>

  </xs:complexType>

<!--
 ====================================================================
 === Global attribute list declarations.                          ===
 ====================================================================
 -->

<!--
 | @restriction: defines restrictions on access to an element's content 
 -->
  <xs:attribute name="restriction">
    <xs:simpleType>
      <xs:restriction base="xs:NMTOKEN">
        <xs:enumeration value="default"/>
        <xs:enumeration value="public"/>
        <xs:enumeration value="need-to-know"/>
        <xs:enumeration value="private"/>
      </xs:restriction>
    </xs:simpleType>
  </xs:attribute>

 <!--
  | @severity: conveys the severity or priority of something
  -->
 <xs:attribute name="severity">
   <xs:simpleType>
      <xs:restriction base="xs:NMTOKEN">
        <xs:enumeration value="low"/>
        <xs:enumeration value="medium"/>
        <xs:enumeration value="high"/>
      </xs:restriction>
   </xs:simpleType>
 </xs:attribute>

</xs:schema>
