Overview

XARF, short for the eXtended Abuse Reporting Format, is a standardized set of schemas developed by Abusix and a community of abuse reporters, network, and DNS operations for describing abusive behavior or content. Several government CERTs, enterprises, large ISPs, large Cloud Hosting Companies, Universities, and other organizations have also adopted XARF.

Attacks on the internet can come from various sources, such as unauthorized use of trademarks, copyright, or other intellectual property; dangerous content, such as phishing and hosted malware; or illegal content, like child exploitation. Identifying the source, such as a public network provider, ISP, hosting provider, or DNS provider, is critical for stopping these attacks or taking down illegal content. Reporting these issues is vital for internet infrastructure.

Unfortunately, reporting abuse is currently disorganized and cluttered, as evidenced by our need for over 500 unique parsers to support our customers. This lack of a "standardized language" or standard set of field names and sets for reporting different types of abuse to DNS operators or Network Operators is the primary cause of the inefficiency in the industry today. Most solutions are custom-built on the reporting side and the receiving end. Exceptions include MARF (Message Abuse Reporting Format) and XARF (Extensible Abuse Reporting Format).

Simplicity is the primary advantage of using XARF to report "DNS and Public Network" fraud, abuse, and Vulnerability Management.

XARF reporting schemas are structured so that each incident record must contain a minimum set of information for reporting abuse or vulnerabilities from a public network or across DNS.

The approach, which looks at the minimum first, and then what is helpfully extensible or unique, makes XARF efficient and light compared to the far more detailed government and large enterprise incident attack forensics.

XARF is transport neutral.

Today, XARF schemas are used in email, RESTful APIs, streams, UDP, and perhaps in other transports we are unaware of.

Initially designed to be shared via email, borrowing the three-mime-part framework from the popular MARF (Message Abuse Reporting Format). XARF was designed to make email reporting of abuse far simpler. That said, XARF, as a language containing a minimum number of fields for incident reporting, with standardized field names, in JSON schemas, has been far more important to those that understand its power.

The metadata in abuse reports from over 20,000 reporters over 10 years at some of the largest public network providers in the world has been evaluated daily. Over 120 types of abuse incidents have been identified. It's from this constant and ongoing effort that XARF standards have been developed. While the published standards today describe the most common metadata in reports, we recognize that some XARF report types have yet to be published.

Along with this, Abusix has developed a highly efficient backbone that unifies all incident types and their common elements, as well as well as being flexible and extensible to handle meta-data elements that are new or different.

XARF provides the world simplicity, speed, and safety.

XARF makes it easier for reporters to get incidents addressed by public networks and DNS operators by using a common language, regardless of transport.

It also means all the incidents fit together in one big schema, making it far simpler and more useful to share information across networks about network abuse and vulnerabilities.

XARF is an open, community-driven effort that provides free schema specifications. Anyone may participate or use XARF to aid them in reporting public network abuse, fraud, or vulnerability using common field descriptors and schemas, making it easier for networks receiving the information to act quickly.

This will help you learn more about Submitting data via the API to Data Channels