The following table gives the codes and descriptions for minor categories.
| Category Code | Category | Description |
| 001 | Vulnerability | Buffer/Heap Overflow |
| 002 | Vulnerability | Denial of Service (Crash/Reboot) |
| 003 | Vulnerability | Configuration Error |
| 004 | Vulnerability | Race Condition |
| 005 | Vulnerability | Invalid Input (Command Injection, Cross-Site Scripting, SQL Injection, etc.) |
| 006 | Vulnerability | Access Validation |
| 255 | Vulnerability | Other |
| 001 | Malicious Code | Worm |
| 002 | Malicious Code | Virus |
| 003 | Malicious Code | Trojan/Backdoor |
| 004 | Malicious Code | IRC Botnet/Blended Threat |
| 005 | Malicious Code | Phishing |
| 255 | Malicious Code | Other |
| 001 | DDoS | SYN Flood Attack |
| 002 | DDoS | Other Flood Attack (e.g., ACK, CPS, etc.) |
| 003 | DDoS | Iterative Application Attack (Hammer) |
| 255 | DDoS | Other |
| 001 | Security Policy | P2P |
| 002 | Security Policy | Chat and Instant Messaging |
| 003 | Security Policy | Streaming Media |
| 004 | Security Policy | Email Attachments |
| 005 | Security Policy | Forbidden Application Access or Service Request (Telnet, SMB Null Session, etc.) |
| 006 | Security Policy | Authentication Failure (Telnet login failed, brute force, etc.) |
| 007 | Security Policy | Spyware |
| 255 | Security Policy | Other |
| 001 | Reconnaissance or Suspicious Access | Port Scan |
| 002 | Reconnaissance or Suspicious Access | Suspicious Application Access |
| 003 | Reconnaissance or Suspicious Access | Suspicious Service Request |
| 004 | Reconnaissance or Suspicious Access | Host Scan |
| 255 | Reconnaissance or Suspicious Access | Other |
| 001 | Application or Protocol Anomaly | Protocol Anomaly |
| 002 | Application or Protocol Anomaly | Evasion Technique |
| 003 | Application or Protocol Anomaly | Application Anomaly |
| 255 | Application or Protocol Anomaly | Other Anomaly |
| 001 | Traffic Thresholds | Traffic Threshold |
| 002 | Traffic Thresholds | Application Threshold |
| 255 | Traffic Thresholds | Other |
| 001 | IP Filters | Deny |
| 002 | IP Filters | Accept |
| 255 | IP Filters | Other |