Intrusion Detected Notification - 入侵检测通知 —— 检测到疑似入侵行为或命中入侵特征时上报

Go back Parent node: Security Incident Notification - 安全事件通知子树 —— 认证失败、入侵、恶意代码与策略违规类事件，1-9 事件类、10-19 处置与关闭类、20-99 预留扩展 (1.3.6.1.4.1.59719.0.4)

Technical information

Dot notation:	`1.3.6.1.4.1.59719.0.4.2`
ASN.1 notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) notifications(0) security-incident-notification(4) intrusion-detected-notification(2) }`
OID-IRI notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/Notifications/SecurityIncidentNotification/IntrusionDetectedNotification`
WEID notation:	`weid:P-1A2V-0-4-2-1`
DER encoding:	`06:0B:2B:06:01:04:01:83:D2:47:00:04:02`

Description

English:
Intrusion detected notification. Reported when a suspected intrusion behaviour is detected or when an intrusion signature is matched.
Status: registered but unused. No device or platform has emitted this notification. Before first use, define the detection source, the signature identifier format and the confidence level carried in the payload. The unused state shall be re-verified at each revision of this file.
Recommendation: Carry the five-tuple of the offending flow, the signature identifier and the recommended blocking action, so that the management station can decide between automatic blocking and manual review.
See also: 1.3.6.1.4.1.59719.0.4, 1.3.6.1.4.1.59719.6.5, 1.3.6.1.4.1.59719.2.400.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
入侵检测通知。检测到疑似入侵行为或命中入侵特征时上报。
状态：已注册但未使用。尚无设备或平台上报过本通知。首次使用前应定义检测来源、特征标识格式与载荷中携带的置信度。本文件每次修订时须重新核验该未使用状态。
建议：应携带违规流的五元组、特征标识与建议阻断动作，以便网管侧在自动阻断与人工复核之间作出决策。
关联节点：1.3.6.1.4.1.59719.0.4、1.3.6.1.4.1.59719.6.5、1.3.6.1.4.1.59719.2.400。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registration Authority

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

The RA does not want to publish their personal information.

Subordinate objects

ID	Base36	ASN.1 IDs (comma sep.)	IRI IDs (comma sep.)	RA	Comment	Created	Updated
No items available

Alternative Identifiers

Identifier	Description
aid:D276000186B200054278A5EC58FD51D1 (No PIX allowed)	OIDplus Information Object Application Identifier (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-fb4746badd2e	OIDplus Information Object Custom UUID (RFC 9562)
guid:25f917c1-6edc-32ef-9df3-26f3ac6a00f5	Name based version 3 / MD5 UUID with namespace UUID_NAMEBASED_NS_OID
guid:c129119c-7a4f-54dd-a6fb-1910d9a80a03	Name based version 5 / SHA1 UUID with namespace UUID_NAMEBASED_NS_OID
mac:82-76-58-FD-51-D1	OIDplus Information Object MAC address, Unicast (AAI)
mac:83-76-58-FD-51-D1	OIDplus Information Object MAC address, Multicast (AAI)
weid:P-1A2V-0-4-2-1	WEID notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=1492996561	OIDplus Information Object X.500 DN