IODEF v2 / JSON · CBOR · XML

Exchange incident reports across three formats

Build, validate, and exchange IODEF v2 incident reports in Ruby. Work with JSON and CBOR from RFC 8727, plus supported XML structures from RFC 7970.

Quick startRuby
require "iodef"

document = IODEF::Document.build(lang: "en") do |doc|
  doc.add_incident(purpose: "reporting") do |incident|
    incident.incident_id = { id: "case-24", name: "response.example" }
    incident.generation_time = "2026-10-01T09:00:00Z"
    incident.description = ["Unexpected traffic", { value: "不審な通信", lang: "ja" }]
    incident.add_contact(role: "creator", type: "organization") do |contact|
      contact.contact_name = ["Response team"]
      contact.email = [{ "EmailTo" => "response@response.example" }]
    end
  end
end

json = document.to_json
copy = IODEF.parse(json)
copy.incidents.first.incident_id
copy.incidents.first.contacts.first.role # => "creator"
copy.incidents.first.description.text("ja") # => "不審な通信"
IODEF.validate(json) # => []

Installation

Add the gem to your Gemfile:

gem "iodef"

Run bundle install, then try the quick start. Requires Ruby 3.3 or later.

For supported dependencies and optional integrations, see the installation guide.

Scope & documentation

XML input must be UTF-8. XML Schema validation, XML Signature conversion, and ambiguous extension mappings are outside scope. Conversion preserves supported report data, not original XML formatting or signatures, and does not authenticate incident facts.

Read the full documentation for supported formats, examples, and API details.