Cisco Cisco Firepower Management Center 2000 Entwickleranleitung

Seite von 536
 
3-51
FireSIGHT eStreamer Integration Guide
 
Chapter 3      Understanding Intrusion and Correlation Data Structures
  Understanding Series 2 Data Blocks
UUID String Mapping Data Block
The eStreamer service uses the UUID String Mapping data block in various metadata messages to map 
UUID values to descriptive strings. The UUID String Mapping data block has a block type of 14 in series 
2.
The following diagram shows the structure of the UUID String Mapping data block.
The following table describes the fields in the UUID String Mapping data block.
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
UUID String Mapping Block Type (14)
UUID String Mapping Block Length
UUID
UUID, continued
UUID, continued
UUID, continued
String Block Type (0)
String Block Length
Name...
Table 3-31
UUID String Mapping Data Block Fields 
Field
Data Type
Description
UUID String 
Mapping Block Type
uint32
Initiates a UUID String Mapping block. This value is always 
14
.
UUID String 
Mapping Block 
Length
uint32
Total number of bytes in the UUID String Mapping block, 
including eight bytes for the UUID String Mapping block type 
and length fields, plus the number of bytes of data that follows. 
UUID
uint8[16]
The unique identifier for the event or other object the UUID 
identifies.
String Block Type
uint32
Initiates a String data block containing the descriptive name 
associated with the UUID. This value is always 
0
.
String Block Length
uint32
The number of bytes included in the name String data block, 
including eight bytes for the block type and header fields plus the 
number of bytes in the Name field.
Name
string
The descriptive name.