Cisco Cisco Firepower Management Center 2000 Entwickleranleitung
Version 5.3
Sourcefire 3D System eStreamer Integration Guide
63
Understanding the eStreamer Application Protocol
Understanding Metadata
Chapter 2
Understanding Metadata
The eStreamer server can provide metadata along with requested event records.
To receive metadata, you must explicitly request it. See the
on page 31 for information on how to request a given version of metadata. The
metadata provides context information for codes and numeric identifiers in the
event records. For example, an intrusion event contains only the internal identifier
of the detecting device, and the metadata provides the device’s name.
Metadata Transmission
If the request message specifies metadata, eStreamer sends the relevant
metadata record before it sends any related event records.
eStreamer keeps track of the metadata it has sent to the client and does not
eStreamer keeps track of the metadata it has sent to the client and does not
resend the same metadata record. The client should cache each received
metadata record. eStreamer does not keep a history of metadata transmissions
from one session to the next, so when a new session starts and a request
message specifies metadata, eStreamer restarts metadata streaming from
scratch.