Cisco Cisco Firepower Management Center 2000 Entwickleranleitung

Version 5.3

Sourcefire 3D System eStreamer Integration Guide

696

Understanding Legacy Data Structures

Legacy Host Data Structures

Appendix B

Full Host Profile Data Block 5.2.x

The Full Host Profile data block for version 5.2.x contains a full set of data 

describing one host. It has the format shown in the graphic below and explained 

in the following table. Note that, except for List data blocks, the graphic does not 

show the fields of the encapsulated data blocks. These encapsulated data blocks 

are described separately in 

 on page 164. The Full Host Profile data block a block type value of 140. 

Generic List 

Block Type

uint32

Initiates a Generic List data block comprising 

Host Vulnerability data blocks conveying third 

party scan vulnerability data. This value is 

always 31.

Generic List 

Block Length

uint32

Number of bytes in the Generic List data block, 

including the list header and all encapsulated 

data blocks.

(Third Party 

Scan) Host 

Vulnerability 

Data Blocks *

variable

Host Vulnerability data blocks sourced from a 

third party scanner. Note that the host 

vulnerability IDs for these data blocks are the 

third party scanner IDs, not Sourcefire-detected 

IDs. See 

page 293 for a description of this data block. 

List Block Type

uint32

Initiates a List data block comprising Attribute 

Value data blocks conveying attribute data. This 

value is always 11.

List Block 

Length

uint32

Number of bytes in the List data block, including 

the list header and all encapsulated data blocks.

Attribute Value 

Data Blocks *

variable

List of Attribute Value data blocks. See 

 on page 253 for a description 

of the data blocks in this list.

Mobile

uint8

A true-false flag indicating whether the 

operating system is running on a mobile device.

Jailbroken

uint8

A true-false flag indicating whether the mobile 

device operating system is jailbroken.

VLAN 

Presence

uint8

Indicates whether a VLAN is present:
• 0 — Yes

• 1 — No

Full Host Profile Record 5.1.1 Fields (Continued)