IODEF v2 / JSON · CBOR · XML
Exchange incident reports across three formats
Build, validate, and exchange IODEF v2 incident reports in Ruby. Work with JSON and CBOR from RFC 8727, plus supported XML structures from RFC 7970.
require "iodef"
document = IODEF::Document.build(lang: "en") do |doc|
doc.add_incident(purpose: "reporting") do |incident|
incident.incident_id = { id: "case-24", name: "response.example" }
incident.generation_time = "2026-10-01T09:00:00Z"
incident.description = ["Unexpected traffic", { value: "不審な通信", lang: "ja" }]
incident.add_contact(role: "creator", type: "organization") do |contact|
contact.contact_name = ["Response team"]
contact.email = [{ "EmailTo" => "response@response.example" }]
end
end
end
json = document.to_json
copy = IODEF.parse(json)
copy.incidents.first.incident_id
copy.incidents.first.contacts.first.role # => "creator"
copy.incidents.first.description.text("ja") # => "不審な通信"
IODEF.validate(json) # => []
Build reports
Use typed incident and contact models with multilingual descriptions and explicit reporting identities.
Convert formats
Read and write JSON, built-in CBOR, and namespace-aware XML using the same document model.
Locate problems
Validate report structure with JSON Pointer diagnostics and configurable size, depth, and collection limits.
Installation
Add the gem to your Gemfile:
gem "iodef"
Run bundle install, then try the quick start. Requires Ruby 3.3 or later.
For supported dependencies and optional integrations, see the installation guide.
Scope & documentation
XML input must be UTF-8. XML Schema validation, XML Signature conversion, and ambiguous extension mappings are outside scope. Conversion preserves supported report data, not original XML formatting or signatures, and does not authenticate incident facts.
Read the full documentation for supported formats, examples, and API details.