Cisco Cisco Firepower Management Center 2000 Entwickleranleitung
Version 5.3
Sourcefire 3D System eStreamer Integration Guide
458
Understanding Legacy Data Structures
Legacy Intrusion Data Structures
Appendix B
Legacy Intrusion Data Structures
•
•
•
•
•
•
Intrusion Event (IPv4) Record for 4.9 - 4.10.x
The fields in the intrusion event (IPv4) record are shaded in the following graphic.
The record type is 104 for version 4.9+, where VLAN IDs are included. The table
following the graphic includes details on the fields.
You request intrusion event records by setting the intrusion event flag—bit 6 in
You request intrusion event records by setting the intrusion event flag—bit 6 in
the Request Flags field—in the request message. If you enable bit 23, an
extended event header is included in the record.
Events are uniquely identified by event ID, detection device ID, and event second.
Events are uniquely identified by event ID, detection device ID, and event second.
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Header Version (1)
Message Type (4)
Message Length
Record Type (104)
Record Length
eStreamer Server Timestamp (in events, only if bit 23 is set)
Reserved for Future Use (in events, only if bit 23 is set)
Detection Engine ID
Event ID
Event Second
Event Microsecond
Rule ID (Signature ID)
Generator ID
Rule Revision
Classification ID