Cisco Cisco Firepower Management Center 2000 Guía Del Desarrollador

Descargar
Página de 536
 
3-65
FireSIGHT eStreamer Integration Guide
 
Chapter 3      Understanding Intrusion and Correlation Data Structures
  Understanding Series 2 Data Blocks
File Name
String Block Type (0)
String Block Length
File Name...
File Path
String Block Type (0)
String Block Length
File Path...
File SHA
Hash
String Block Type (0)
String Block Length
File SHA Hash...
File Size
File Type
File Timestamp
Parent File 
Name
String Block Type (0)
String Block Length
Parent File Name...
Parent File 
SHA Hash
String Block Type (0)
String Block Length
Parent File SHA Hash...
Event 
Description
String Block Type (0)
String Block Length
Event Description...
Device ID
Connection Instance
Connection Counter
Connection Event Timestamp
Direction
Source IP Address
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31