Cisco Cisco Firepower Management Center 2000 Guía Del Desarrollador
5-7
FireSIGHT System Database Access Guide
Chapter 5 Schema: Statistics Tracking Tables
geolocation_stats_current_timeframe
app_stats_current_timeframe Joins
The following table describes the joins you can perform on the
app_stats_current_
timeframe
tables.
app_stats_current_timeframe Sample Query
The following query returns the inbound and outbound traffic load associated with applications that have
low business relevance and high risk in the period of a day, for all managed devices connected to the
Defense Center.
low business relevance and high risk in the period of a day, for all managed devices connected to the
Defense Center.
SELECT start_time_sec, sum(bytes_in), sum(bytes_out)
FROM app_stats_current_day
WHERE business_relevance <= 2
AND risk >= 4 AND start_time_sec = unix_timestamp("2013-12-15");
geolocation_stats_current_timeframe
The
geolocation_stats_
timeframe
tables contain statistics regarding intrusion events based on location
levels. Statistics can be extracted based on impact level, device, and how the packets are handled.
For an understanding of the
current_day
,
current_month
, and
current_year
statistics tables, see
.
For more information on the
geolocation_stats_current_
timeframe
tables, see the following sections:
•
•
•
sensor_uuid
A unique identifier for the managed device, or
0
if
sensor_name
is
null
.
start_time_sec
The UNIX timestamp of the start of the measurement interval. For
information on specifying the start time, see
information on specifying the start time, see
.
Table 5-5
app_stats_current_timeframe Fields (continued)
Field
Description
Table 5-6
app_stats_current_timeframe Joins
You can join this table on...
And...
application_id