Cisco Cisco Firepower Management Center 4000 Entwickleranleitung
Version 5.3
Sourcefire 3D System eStreamer Integration Guide
39
Understanding the eStreamer Application Protocol
Event Data Message Format
Chapter 2
Intrusion Event and Metadata Message Format
The graphic below shows the general structure of intrusion event and metadata
messages.
The following graphic shows the details of the record header portion of the
intrusion event and metadata message format. The record header fields are
shaded. The table that follows defines the fields.
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Message Header
Record Header
Data Record
...
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Header Version (1)
Message Type (3)
Message Length
Record Type
See
Record Length
eStreamer Server Timestamp
(for events only, not used in metadata records)
Reserved for Future Use
(for events only, not used in metadata records)
Data
...