Cisco Cisco Firepower Management Center 4000 Guía Del Desarrollador
Version 5.3
Sourcefire 3D System eStreamer Integration Guide
155
Understanding Intrusion and Correlation Data Structures
Understanding Series 2 Data Blocks
Chapter 3
String Block
Length
uint32
The number of bytes included in the name
String data block, including eight bytes for the
block type and header fields plus the number
of bytes in the Attack Scenarios field.
Attack
Scenarios
string
Examples of possible attacks.
String Block
Type
uint32
Initiates a String data block containing the
ease of attack associated with the rule. This
value is always 0.
String Block
Length
uint32
The number of bytes included in the name
String data block, including eight bytes for the
block type and header fields plus the number
of bytes in the Ease of Attack field.
Ease of Attack
string
Whether the attack is considered simple,
medium, hard, or difficult, and whether or not
is can be performed using a script.
String Block
Type
uint32
Initiates a String data block containing the
possible false positives associated with the
rule. This value is always 0.
String Block
Length
uint32
The number of bytes included in the name
String data block, including eight bytes for the
block type and header fields plus the number
of bytes in the False Positives field.
False Positives
string
Examples that may result in a false positive.
The default value is
None Known
.
String Block
Type
uint32
Initiates a String data block containing the
possible false negatives associated with the
rule. This value is always 0.
String Block
Length
uint32
The number of bytes included in the name
String data block, including eight bytes for the
block type and header fields plus the number
of bytes in the False Negatives field.
False Negatives
string
Examples that may result in a false negative.
The default value is
None Known
.
String Block
Type
uint32
Initiates a String data block containing the
corrective action associated with the rule. This
value is always 0.
Rule Documentation Data Block Fields (Continued)
F
IELD
D
ATA
T
YPE
D
ESCRIPTION