Security Incident Notification - 安全事件通知子树 —— 认证失败、入侵、恶意代码与策略违规类事件，1-9 事件类、10-19 处置与关闭类、20-99 预留扩展

Go back Parent node: Notifications - 通知与告警标识弧 —— 承载于 SNMP Trap/Inform、syslog 与内部事件消息的清曜私有事件类型标识 (1.3.6.1.4.1.59719.0)

Technical information

Dot notation:	`1.3.6.1.4.1.59719.0.4`
ASN.1 notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) notifications(0) security-incident-notification(4) }`
OID-IRI notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/Notifications/SecurityIncidentNotification`
WEID notation:	`weid:P-1A2V-0-4-1`
DER encoding:	`06:0A:2B:06:01:04:01:83:D2:47:00:04`

Description

English:
Security incident notification subtree. Covers authentication failure, intrusion, malicious code and policy violation events, and is the notification counterpart of the security running state objects under 1.3.6.1.4.1.59719.6.
Numbering convention: 1 to 9 for incident-detection notifications, 10 to 19 for incident-handling and incident-closing notifications, 20 to 99 reserved for future extension. Incident notifications shall never carry credential material, session tokens or personal data in the payload.
Status: registered but unused. No security incident notification identifier has been emitted by any device or platform. Before first use, define the severity mapping and the evidence fields to be retained for each incident type. The unused state shall be re-verified at each revision of this file.
Recommendation: Correlate every security incident notification with the audit objects (1.3.6.1.4.1.59719.6.3) and the threat objects (1.3.6.1.4.1.59719.6.5), and never use the notification payload as the only record of the incident.
See also: 1.3.6.1.4.1.59719.0.4.1 to 1.3.6.1.4.1.59719.0.4.10, 1.3.6.1.4.1.59719.6.3, 1.3.6.1.4.1.59719.6.5.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
安全事件通知子树。覆盖认证失败、入侵、恶意代码与策略违规类事件，是 1.3.6.1.4.1.59719.6 下安全运行状态对象在通知维度的对应弧。
编号规则：1-9 为事件发现类通知，10-19 为事件处置与关闭类通知，20-99 预留未来扩展。安全通知载荷中不得携带凭证、会话令牌或个人数据。
状态：已注册但未使用。尚无设备或平台上报过任何安全事件通知标识。首次使用前应定义各类事件的严重级别映射与需留存的证据字段。本文件每次修订时须重新核验该未使用状态。
建议：每条安全事件通知应与审计对象（1.3.6.1.4.1.59719.6.3）和威胁对象（1.3.6.1.4.1.59719.6.5）建立关联，且不得以通知载荷作为事件的唯一记录。
关联节点：1.3.6.1.4.1.59719.0.4.1 至 1.3.6.1.4.1.59719.0.4.10、1.3.6.1.4.1.59719.6.3、1.3.6.1.4.1.59719.6.5。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registration Authority

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

The RA does not want to publish their personal information.

Subordinate objects

ID	Base36	ASN.1 IDs (comma sep.)	IRI IDs (comma sep.)	RA
1	1	auth-failure-notification	AuthFailureNotification	tsingyao
2	2	intrusion-detected-notification	IntrusionDetectedNotification	tsingyao
3	3	malware-detected-notification	MalwareDetectedNotification	tsingyao
4	4	policy-violation-notification	PolicyViolationNotification	tsingyao
10	A	security-incident-cleared-notification	SecurityIncidentClearedNotification	tsingyao

Alternative Identifiers

Identifier	Description
aid:D276000186B200054278A5EC197B0553 (No PIX allowed)	OIDplus Information Object Application Identifier (ISO/IEC 7816)
aid:D276000186F62B0601040183D2470004 (No PIX allowed)	Application Identifier (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-22c8aff43443	OIDplus Information Object Custom UUID (RFC 9562)
guid:4abef660-b0b1-3798-9f6a-98146114b13e	Name based version 3 / MD5 UUID with namespace UUID_NAMEBASED_NS_OID
guid:ce486059-90b4-585b-930b-dfdc77a32d1f	Name based version 5 / SHA1 UUID with namespace UUID_NAMEBASED_NS_OID
mac:F2-87-19-7B-05-53	OIDplus Information Object MAC address, Unicast (AAI)
mac:F3-87-19-7B-05-53	OIDplus Information Object MAC address, Multicast (AAI)
weid:P-1A2V-0-4-1	WEID notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=427492691	OIDplus Information Object X.500 DN