Cisco Cisco Firepower Management Center 2000 Entwickleranleitung

Seite von 180
 
5-20
FireSIGHT System Database Access Guide
 
Chapter 5      Schema: Statistics Tracking Tables 
  user_stats_current_timeframe
user_stats_current_timeframe
The 
user_stats_current_
timeframe
 tables contain statistics on bandwidth usage and access control 
actions (connection allowed or denied) by user. You can also constrain queries on the managed device 
that monitored the traffic.
For an understanding of the 
current_day
current_month
, and 
current_year
 statistics tables, see 
.
For more information, see the following sections:
  •
  •
  •
user_stats_current_timeframe Fields
The following table describes the fields you can access in the 
user_stats_current_
timeframe
 tables.
user_stats_current_timeframe Joins
You cannot perform joins on the 
user_stats_current_
timeframe
 tables.
Table 5-16
user_stats_current_timeframe Fields 
Field
Description
bytes_in
The number of bytes of inbound traffic for the user in the measured interval.
bytes_out
The number of bytes of outbound traffic for the user in the measured interval.
connections_allowed
The number of connections allowed for this user in the measured time frame.
connections_denied
The number of connections denied for this user due to violation of an access control 
policy.
sensor_address
The IP address of the managed device that monitored the traffic. Format is 
ipv4_address,ipv6_address
.
sensor_id
The internal identification number of the managed device that detected the traffic.
sensor_name
The name of the managed device that detected the traffic.
sensor_uuid
A unique identifier for the managed device, or 
0
 if 
sensor_name
 is 
null
.
start_time_sec
The UNIX timestamp of the start of the measurement interval. For information on 
specifying the start time, see 
user_id
The internal identification number for the user who last logged into the host that 
generated the traffic.
username
User name for the user who last logged into the host that generated the traffic.