Cisco Cisco Firepower Management Center 4000 Entwickleranleitung
Version 5.3
Sourcefire 3D System eStreamer Integration Guide
462
Understanding Legacy Data Structures
Legacy Intrusion Data Structures
Appendix B
Intrusion Event (IPv6) Record for 4.10.2.3
The fields in the intrusion event (IPv6) record are shaded in the following graphic.
The record type is 105 for version 4.10.2.3, where VLAN IDs are included. The
table following the graphic includes details on the fields.
You request intrusion event records by setting the intrusion event flag—bit 6 in
You request intrusion event records by setting the intrusion event flag—bit 6 in
the Request Flags field—in the request message. If you enable bit 23, an
extended event header is included in the record.
Events are uniquely identified by event ID, detection device ID, and event second.
Events are uniquely identified by event ID, detection device ID, and event second.
Blocked
uint8
Value indicating whether the event was blocked.
• 0 — not blocked
• 0 — not blocked
• 1 — blocked
• 2 — would be blocked (but not permitted by
configuration)
Reserved
uint32
Reserved. The display value is
MPLS Label:0
.
VLAN ID
uint16
Indicates the ID of the VLAN where the packet
originated. (Applies to 4.9+ events only.)
Pad
uint16
Reserved for future use.
Intrusion Event (IPv4) Record 4.9 - 4.10.x Fields (Continued)
F
IELD
D
ATA
T
YPE
D
ESCRIPTION
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Header Version (1)
Message Type (4)
Message Length
Record Type (105)
Record Length
eStreamer Server Timestamp (in events, only if bit 23 is set)
Reserved for Future Use (in events, only if bit 23 is set)
Detection Engine ID
Event ID
Event Second
Event Microsecond