Cisco Cisco Firepower Management Center 4000 개발자 가이드
A-12
FireSIGHT eStreamer Integration Guide
Appendix A Data Structure Examples
Intrusion Event Data Structure Examples
In the preceding example, the following event information appears:
0 0 1 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 1 1 1 0 0 1 0 1 0 0 1 1
0 0 1 0 0 0 0 0 0 1 1 1 0 0 1 0 0 1 1 0 0 1 0 1 0 1 1 1 0 0 0 1
0 1 1 1 0 1 0 1 0 1 1 0 0 1 0 1 0 1 1 1 0 0 1 1 0 1 1 1 0 1 0 0
0 0 1 0 0 0 0 0 0 1 1 0 0 1 1 0 0 1 1 0 1 1 1 1 0 1 1 1 0 0 1 0
0 0 1 0 0 0 0 0 0 1 1 1 0 0 0 0 0 1 1 0 1 1 1 1 0 1 1 1 0 1 0 0
0 1 1 0 0 1 0 1 0 1 1 0 1 1 1 0 0 1 1 1 0 1 0 0 0 1 1 0 1 0 0 1
0 1 1 0 0 0 0 0 1 0 1 1 0 1 1 0 0 0 0 1 0 0 0 0 0 1 1 0 1 1 0 1
0 1 1 0 0 0 0 1 0 1 1 0 1 1 0 0 0 1 1 1 0 1 1 1 0 1 1 0 0 0 0 1
0 1 1 1 0 0 1 0 0 1 1 0 0 1 0 1 0 0 1 0 0 0 0 0 0 1 0 1 0 0 1 1
0 1 1 0 0 0 0 1 0 1 1 0 0 1 1 0 0 1 1 0 0 1 0 1 0 1 0 0 0 1 1 1
0 1 1 1 0 1 0 1 0 1 1 0 0 0 0 1 0 1 1 1 0 0 1 0 0 1 1 0 0 1 0 0
0 0 1 0 0 0 0 0 0 1 1 1 0 1 0 0 0 1 1 0 0 1 1 1 0 0 1 0 0 0 0 0
0 1 1 0 0 1 0 0 0 1 1 0 1 1 1 1 0 1 1 0 1 1 0 1 0 1 1 0 0 0 0 1
0 1 1 0 1 0 0 1 0 1 1 0 1 1 1 0 0 0 1 0 0 0 0 0 0 0 1 1 0 0 1 1
0 0 1 1 0 1 1 0 0 0 1 1 0 0 0 0 0 0 1 0 1 1 1 0 0 1 1 0 0 0 1 1
0 1 1 0 1 1 1 0
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Number Description
1
The first two bytes of this line indicate the standard header value of
1
. The second two bytes
indicate that the message is a data message (that is, message type four).
2
This line indicates that the message that follows is
129
bytes.
3
This line indicates a record type value of
66
, which represents a rule message record.
4
This line indicates that the rule message record that follows is
121
bytes long.
5
This line indicates that the generator identification number is
1
, the rules engine.
6
This line indicates that the rule identification number is
28069
.
7
This line indicates that the rule revision number is
1
.
8
This line indicates that the rule identification number rendered to the FireSIGHT System is
28069
.