Cisco Cisco Firepower Management Center 4000 Entwickleranleitung

The Intrusion Impact Alert event contains information about impact events. It is transmitted when an 
intrusion event is compared to the system network map data and the impact is determined. It uses the 
standard record header with a record type of 9, followed by an Intrusion Impact Alert data block with a 
data block type of 20 in the series 1 group of blocks. (The Impact Alert data block is a type of series 1 
data block. For more information about series 1 data blocks, see 

You can request that eStreamer only transmit intrusion impact events by setting bit 5 in the Flags field 
of the request message. See 

 for more information 

about request messages. Version 1 of these alerts only handles IPv4. Version 2, introduced in 5.3, handles 
IPv6 events in addition to IPv4.

VLAN ID

uint16

Indicates the ID of the VLAN where the packet originated.

Pad

uint16

Reserved for future use.

Policy UUID

uint8[16]

A policy ID number that acts as a unique identifier for the intrusion 
policy.

User ID

uint32

The internal identification number for the user, if applicable.

Web 
Application ID

uint32

The internal identification number for the web application, if 
applicable.

Client 
Application ID

uint32

The internal identification number for the client application, if 
applicable.

Application 
Protocol ID

uint32

The internal identification number for the application protocol, if 
applicable.

Access Control 
Rule ID

uint32

A rule ID number that acts as a unique identifier for the access control 
rule.

Access Control 
Policy UUID

uint8[16]

A policy ID number that acts as a unique identifier for the access 
control policy.

Ingress Interface 
UUID

uint8[16]

An interface ID number that acts as a unique identifier for the ingress 
interface.

Egress Interface 
UUID

uint8[16]

An interface ID number that acts as a unique identifier for the egress 
interface.

Ingress Security 
Zone UUID

uint8[16]

A zone ID number that acts as a unique identifier for the ingress 
security zone.

Egress Security 
Zone UUID

uint8[16]

A zone ID number that acts as a unique identifier for the egress security 
zone.

Connection 
Timestamp

uint32

UNIX timestamp (seconds since 01/01/1970) of the connection event 
associated with the intrusion event.

Connection 
Instance ID

uint16

Numerical ID of the Snort instance on the managed device that 
generated the connection event.

Connection 
Counter

uint16

Value used to distinguish between connection events that happen 
during the same second.