The purpose of the Intrusion Detection Exchange Format (IDEF) is to define data formats and exchange procedures for sharing information of interest to intrusion detection and response systems, and to the management systems which may need to interact with them. The goals and requirements of the IDEF are described in [2]. This Internet-Draft describes a proposed implementation of the data format component of the IDEF, using the Extensible Markup Language (XML) [3] to represent the class hierarchy defined by Debar and Huang [4]. The rationale for choosing XML is explained, a Document Type Definition (DTD) is developed, and examples are provided.