<?xml version="1.0" encoding="utf-8"?>
<xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
  <xs:element name="EOC">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="DataSource" />
        <xs:element name="ScanType" type="ScanTypeEnum" />
		<xs:element name="RemediationAction" type="RemediationActionEnum" minOccurs="0" maxOccurs="1" />
        <xs:element ref="Threat" />
        <xs:element name="Activity">
          <xs:complexType>
            <xs:sequence>
              <xs:element minOccurs="0" maxOccurs="unbounded" name="OS">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element ref="Process" />
                    <xs:element ref="Files" />
                    <xs:element ref="Registry" />
                    <xs:element ref="Network" />                 
                  </xs:sequence>
                  <xs:attribute name="id" type="OS-id" use="required" />
                  <xs:attribute name="name" type="xs:string" use="required" />
                  <xs:attribute name="version" type="xs:string" use="required" />
                  <xs:attribute name="patch" type="xs:string" use="optional" />                
                </xs:complexType>
              </xs:element>
            </xs:sequence>
          </xs:complexType>
        </xs:element>     
      </xs:sequence>
      <xs:attribute name="creator" type="xs:string" use="required" />
      <xs:attribute name="version" type="xs:string" use="required" />
      <xs:attribute name="id" type="xs:string" use="required" />    
    </xs:complexType>
  </xs:element>
  
  <xs:element name="DataSource">
    <xs:complexType>
      <xs:attribute name="name" type="xs:string" use="required" />
      <xs:attribute name="id" type="xs:string" use="required" />
      <xs:attribute name="version" type="xs:string" use="required" />
    </xs:complexType>
  </xs:element>

  <xs:element name="Threat">
    <xs:complexType>
      <xs:sequence>
        <xs:element name="Description" type="xs:string" />
        <xs:element minOccurs="0"  maxOccurs="unbounded" name="File">
          <xs:complexType>
            <xs:sequence>
              <xs:element minOccurs="0"  maxOccurs="unbounded" ref="Hash" />
              <xs:element name="Matched" minOccurs="0"  maxOccurs="unbounded" type="FileMatch" />
            </xs:sequence>
            <xs:attribute name="name" type="xs:string" use="required" />
            <xs:attribute name="type" type="MalwareFileType" use="required" />
            <xs:attribute name="size" type="xs:unsignedLong" use="required" />
          </xs:complexType>
        </xs:element>
        <xs:element name="URL" type="xs:string" minOccurs="0"/>       
        <xs:element maxOccurs="1" minOccurs="0" name="SMTP-message">
          <xs:complexType>
            <xs:all>
              <xs:element name="Subject" type="xs:string" minOccurs="0"/>
              <xs:element minOccurs="0" name="STMP-header" type="xs:string"/>
              <xs:element minOccurs="0" name="Last-malware" type="xs:string"/>
              <xs:element minOccurs="0" name="Protocol" type="xs:string"/>
              <xs:element name="Date" type="xs:string"/>
            </xs:all>
            <xs:attribute name="id" type="xs:string" use="required"/>
          </xs:complexType>
        </xs:element>
        <xs:element minOccurs="0" name="User" />
        <xs:element name="Attacker">
          <xs:complexType>
            <xs:all>
              <xs:element name="IP" type="xs:string" minOccurs="0"/>
              <xs:element name="Host" type="xs:string" minOccurs="0"/>
              <xs:element name="Country" type="xs:string" minOccurs="0"/>              
            </xs:all>
          </xs:complexType>
        </xs:element>       
        <xs:element minOccurs="0" maxOccurs="unbounded"  name="Victim">
          <xs:complexType>
            <xs:all>
              <xs:element name="IP" type="xs:string" minOccurs="0"/>
              <xs:element name="Host" type="xs:string" minOccurs="0"/>
              <xs:element name="Port" type="xs:short" minOccurs="0"/> 
              <xs:element name="SMTP-to" type="xs:string" minOccurs="0"/>
              <xs:element name="SMTP-cc" type="xs:string" minOccurs="0"/>
            </xs:all>        
          </xs:complexType>
        </xs:element>            
        <xs:element minOccurs="0" name="proxy">
          <xs:complexType>
            <xs:attribute name="ip" type="xs:string" use="required" />
          </xs:complexType>
        </xs:element>
        <xs:element minOccurs="0" name="Application" type="xs:string" />
      </xs:sequence>
      <xs:attribute name="category" type="xs:string" use="required" />
      <xs:attribute name="type" type="xs:string" use="required" />
      <xs:attribute name="severity" type="xs:string" use="required" />
      <xs:attribute name="time" type="xs:string" use="required" />
    </xs:complexType>
  </xs:element>

  <xs:element name="Process">
    <xs:complexType>
      <xs:sequence>
        <xs:element minOccurs="0"  maxOccurs="unbounded" ref="Proc" />
      </xs:sequence>
    </xs:complexType>
  </xs:element>

  <xs:element name="Proc">
    <xs:complexType>
      <xs:sequence>
        <xs:choice minOccurs="0" maxOccurs="unbounded">
          <xs:element minOccurs="0"  maxOccurs="unbounded" ref="Hash" />
          <xs:element minOccurs="0"  maxOccurs="unbounded" ref="DLL" />
          <xs:element name="Matched" minOccurs="0"  maxOccurs="unbounded" type="FileMatch" />
        </xs:choice>
      </xs:sequence>
      <xs:attribute name="name" type="xs:string" use="required" />
      <xs:attribute name="commandline" type="xs:string" use="required" />
      <xs:attribute name="parent" type="xs:string" use="optional" />
      <xs:attribute name="action" type="ProcessActionType" use="required" /> 
    </xs:complexType>   
  </xs:element>
  
  <xs:element name="Hash">
    <xs:complexType>
      <xs:attribute name="name" type="HashType" use="required" />
      <xs:attribute name="value" type="xs:string" use="required" />
    </xs:complexType>
  </xs:element>

  <xs:element name="DLL">
    <xs:complexType>
      <xs:sequence minOccurs="0" maxOccurs="unbounded">
        <xs:element minOccurs="0" ref="Hash" />
        <xs:element name="Matched" minOccurs="0" type="FileMatch" />
      </xs:sequence>
      <xs:attribute name="name" type="xs:string" use="required" />
      <xs:attribute name="size" type="xs:unsignedLong" use="optional" />
    </xs:complexType>
  </xs:element>
  
  <xs:element name="Files">
    <xs:complexType>
      <xs:sequence>
        <xs:element minOccurs="0" maxOccurs="unbounded" ref="File" />
      </xs:sequence>
    </xs:complexType>
  </xs:element>
  
  <xs:element name="File">
    <xs:complexType>
      <xs:sequence minOccurs="0" maxOccurs="unbounded">
        <xs:element minOccurs="0" ref="Hash" />
        <xs:element name="Matched" minOccurs="0" type="FileMatch" />
      </xs:sequence>
      <xs:attribute name="name" type="xs:string" use="required" />
      <xs:attribute name="size" type="xs:unsignedLong" use="optional" />
      <xs:attribute name="process" type="xs:string" use="optional" />
      <xs:attribute name="action" type="FileActionType" use="required" />
    </xs:complexType>
  </xs:element>
  
  <xs:element name="Registry">
    <xs:complexType>
      <xs:sequence>
        <xs:element minOccurs="0" maxOccurs="unbounded" name="Reg">
          <xs:complexType>
            <xs:sequence>
            <xs:element name="Matched" minOccurs="0" maxOccurs="unbounded" type="RegistryMatch"/>
            </xs:sequence>
            <xs:attribute name="key" type="xs:string" use="required" />
            <xs:attribute name="name" type="xs:string" use="optional" />
            <xs:attribute name="value" type="xs:string" use="optional" />
            <xs:attribute name="process" type="xs:string" use="optional" />
            <xs:attribute name="action" type="RegActionType" use="required" />
          </xs:complexType>
        </xs:element>
      </xs:sequence>
    </xs:complexType>
  </xs:element>
  
  <xs:element name="Network">
    <xs:complexType>
      <xs:sequence>
        <xs:element minOccurs="0" maxOccurs="unbounded" name="Connection">
          <xs:complexType>
            <xs:attribute name="protocol" type="xs:string" use="required" />
            <xs:attribute name="destination" type="xs:string" use="required" />
            <xs:attribute name="port" type="xs:unsignedShort" use="required" />
            <xs:attribute name="direction" type="xs:string" use="optional" />
          </xs:complexType>
        </xs:element>
        <xs:element minOccurs="0" maxOccurs="unbounded" name="DNS">
          <xs:complexType>
            <xs:attribute name="type" type="xs:string" use="required" />
            <xs:attribute name="query" type="xs:string" use="required" />
            <xs:attribute name="response" type="xs:string" use="optional" />            
          </xs:complexType>
        </xs:element>
        <xs:element minOccurs="0" maxOccurs="unbounded" name="URL">
          <xs:complexType>
            <xs:attribute name="host" type="xs:string" use="required" />
            <xs:attribute name="method" type="xs:string" use="required" />
            <xs:attribute name="uri" type="xs:string" use="required" />
            <xs:attribute name="agent" type="xs:string" use="optional" />
          </xs:complexType>
        </xs:element>
      </xs:sequence>
    </xs:complexType>
  </xs:element>

  <xs:simpleType name="HashType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="MD5"/>
      <xs:enumeration value="SHA1"/>
      <xs:enumeration value="SHA256"/>
    </xs:restriction>
  </xs:simpleType>
  
  <xs:simpleType name="MalwareFileType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="PE"/>
      <xs:enumeration value="PDF"/>
      <xs:enumeration value="XLS"/>
      <xs:enumeration value="PPT"/>
      <xs:enumeration value="JAR"/>
      <xs:enumeration value="APK"/>
      <xs:enumeration value="ZIP"/>
      <xs:enumeration value="CAB"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="ProcessActionType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="create"/>
      <xs:enumeration value="delete"/>
      <xs:enumeration value="hide"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="FileActionType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="create"/>
      <xs:enumeration value="delete"/>      
      <xs:enumeration value="hide"/>
      <xs:enumeration value="write"/>
      <xs:enumeration value="read"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="RegActionType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="create"/>
      <xs:enumeration value="set"/>
      <xs:enumeration value="delete"/>
      <xs:enumeration value="read"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:complexType name="FileMatch">
    <xs:attribute type="ResultEnum" name="result" use="required" />
    <xs:attribute type="RemediationEnum" name="remediation" default="UNSUPPORTED" use="optional" />		
    <xs:attribute type="xs:string" name="value" use="optional" />
    <xs:attribute type="HashType" name="hashType" use="optional" />
    <xs:attribute type="xs:string" name="hashValue" use="optional" />
    <xs:attribute type="xs:unsignedInt" name="remediationsubstate" use="optional" />
  </xs:complexType>

  <xs:complexType name="RegistryMatch">
    <xs:attribute type="ResultEnum" name="result" use="required" />
    <xs:attribute type="xs:string" name="valueName" use="optional" />
    <xs:attribute type="xs:string" name="valueType" use="optional" />
    <xs:attribute type="xs:string" name="valueData" use="optional" />
    <xs:attribute type="xs:string" name="key" use="optional" />
  </xs:complexType>

  <xs:simpleType name="ResultEnum">
    <xs:restriction base="xs:string">
      <!-- In order of decreasing certainty. -->
      <xs:enumeration value="HASH_MATCH" />
      <xs:enumeration value="FULL_MATCH" />
      <xs:enumeration value="PARTIAL_MATCH" />
      <xs:enumeration value="NO_MATCH" />
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="RemediationEnum">
    <xs:restriction base="xs:string">
      <xs:enumeration value="UNSUPPORTED" />
      <xs:enumeration value="SUCCEEDED" />
      <xs:enumeration value="PARTIAL" />
      <xs:enumeration value="FAILED" />
    </xs:restriction>
  </xs:simpleType>  
  
  <xs:simpleType name="ScanTypeEnum">
    <xs:restriction base="xs:string">
      <xs:enumeration value="FULL_SCAN" />
      <xs:enumeration value="QUICK_SCAN" />
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="RemediationActionEnum">
    <xs:restriction base="xs:string">
      <xs:enumeration value="NONE" />
      <xs:enumeration value="REMEDIATE" />
    </xs:restriction>
  </xs:simpleType>
  
  <xs:simpleType name="OS-id">
    <xs:restriction base="xs:unsignedInt">
      <!-- default/missing data-->
      <xs:enumeration value="0"/> 
      <!-- W2K-->
      <xs:enumeration value="1"/>
      <!-- WinXP, W2K3-->
      <xs:enumeration value="2"/>
      <!-- WinVista-->
      <xs:enumeration value="3"/>
      <!-- Win7, W2K8-->
      <xs:enumeration value="4"/>
      <!-- Win8, W2K12-->
      <xs:enumeration value="5"/>
      <!-- Mac -->
      <xs:enumeration value="20"/>
      <!-- IOS-->
      <xs:enumeration value="40"/>
      <!-- Android -->
      <xs:enumeration value="60"/>
    </xs:restriction>
  </xs:simpleType>
  
</xs:schema>
