Cisco Cisco Firepower Management Center 2000 Guía Del Desarrollador

Version 5.3

Sourcefire 3D System eStreamer Integration Guide

141

Understanding Intrusion and Correlation Data Structures

Understanding Series 2 Data Blocks

Chapter 3

The following graphic shows the structure of the malware event data block:

Byte

0

1

2

3

Bit

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

Malware Event Block Type (35)

Malware Event Block Length

Agent UUID

Agent UUID, continued

Agent UUID, continued

Agent UUID, continued

Cloud UUID

Cloud UUID, continued

Cloud UUID, continued

Cloud UUID, continued

Malware Event Timestamp

Event Type ID

Event Subtype ID

Detection Name

Detector ID

String Block Type (0)

String Block Type (0), 

cont.

String Block Length

String Block Length, 

cont.

Detection Name...

User

String Block Type (0)

String Block Length

User...

File Name

String Block Type (0)

String Block Length

File Name...

File Path

String Block Type (0)

String Block Length

File Path...