<CMSI_example>
<!-- 

Using CMSI - an example  

This file shows how a common model of system information
(see http://www.cert-verbund.de/cmsi) can be used to provide
machine-readable system information, for example within
an XML-exchange formats for advisories 
(see http://www.cert-verbund.de/daf).

Let us assume that there is a vulnerability in a system
component of the Windows 2000 product family running service
pack 2.

In the following, we show, how this information can be
given in different granularities. Let us start with
a CERT that only provides very coarse information
of the form "There is a vulnerability in Windows."
That could be expressed as follows:
-->

<system_list>
 <system>
  <system_part type="platform">
    <instance tag="win"/>
  </system_part>
  <system_part type="software">
   <instance tag="app"/>
  </system_part>
 </system>
</system_list>

<!-- 
Above, two machine-readable identifiers defined within an 
exemplary model of system information
(see http://www.cert-verbund.de/cmsi/data/cert_verbund_cmsi.xml)
are used:

- 'win' for the category of Windows OSes
- 'app' for all applications: because an OS component
  is vulnerable, basically all applications are affected.

A different CERT might want to give a little more information:
-->

<system_list>
 <system>
  <system_part type="platform">
    <instance tag="w2k">
     <attribute_value tag="patchlevel">
      <value>SP2</value>
     </attribute_value>
    </instance>
  </system_part>
  <system_part type="software">
   <instance tag="app"/>
  </system_part>
 </system>
</system_list>

<!--
Above, again two machine-readable identifiers  are used:

- 'w2x' for the Windows 2000 product family
- 'app' for all applications

In addition, an attribute defined in the examplary model
is used: the model defines that the Windows 2000 product
family has an attribute 'patchlevel' and specifies a
regular expression describing the allowed syntax for it.

Finally, yet another CERT might want to inform
also about the different products within the Windows 2000
product family:
--> 

<system_list>
 <system>
  <system_part type="platform">
    <instance tag="w2k:prof">
     <attribute_value tag="patchlevel">
      <value>SP2</value>
     </attribute_value>
    </instance>
    <instance tag="w2k:server">
     <attribute_value tag="patchlevel">
      <value>SP2</value>
     </attribute_value>
    </instance>
    <instance tag="w2k:aserver">
     <attribute_value tag="patchlevel">
      <value>SP</value>
     </attribute_value>
    </instance>
    <instance tag="w2k:dserver">
     <attribute_value tag="patchlevel">
      <value>SP2</value>
     </attribute_value>
    </instance>
  </system_part>
  <system_part type="software">
   <instance tag="app"/>
  </system_part>
 </system>
</system_list>

<!--

Here, the identifier "w2k" for the product family
is appended with identifiers for the products within
the family. All in all we have:

- 'w2k:prof' for Windows 2000 Professional 
- 'w2k:server' for Windows 2000 Server 
- 'w2k:aserver' for Windows 2000 Advanced Server
- 'w2k:dserver' for Windows 2000 Datacenter Server 
-->
</CMSI_example>

