Cisco Cisco Firepower Management Center 2000 Guia Do Programador

Página de 180
 
5-12
FireSIGHT System Database Access Guide
 
Chapter 5      Schema: Statistics Tracking Tables 
  storage_stats_by_disposition_current_timeframe
storage_stats_by_disposition_current_timeframe
The 
storage_stats_by_disposition_
timeframe
 tables contain statistics for stores files. Statistics can be 
extracted based on bytes, connection, sensor, and time.
For an understanding of the 
current_day
current_month
, and 
current_year
 statistics tables, see 
.
For more information on the 
storage_stats_by_disposition_
timeframe
 tables, see the following 
sections:
  •
  •
  •
storage_stats_by_disposition_current_timeframe Fields
The following table describes the fields you can access in the 
storage_stats_by_disposition_current_
timeframe
 tables. All tables of this type contain the same 
fields.
Table 5-10
storage_stats_by_disposition_current_timeframe Fields 
Field
Description
bytes_written
The size of the file, in bytes.
disposition
The malware status of the file. Possible values include:
  •
CLEAN
 - The file is clean and does not contain malware.
  •
UNKNOWN
 - It is unknown whether the file contains malware.
  •
MALWARE
 - The file contains malware.
  •
UNAVAILABLE
 - The software was unable to send a request to the Cisco 
cloud for a disposition, or the Cisco cloud services did not respond to 
the request.
  •
CUSTOM SIGNATURE
 - The file matches a user-defined hash, and is 
treated in a fashion designated by the user.
number_dropped
Number of files of this disposition dropped.
number_stored
Number of files of this disposition stored.
sensor
ID of the device that detected the file.
sensor_address
The IP address of the managed device that generated the event. Format is 
ipv4_address,ipv6_address
.
sensor_name
The name of the managed device that generated the intrusion event.
sensor_uuid
A unique identifier for the managed device, or 
0
 if 
sensor_name
 is 
null
.
start_time_sec
The UNIX timestamp of the date and time the measurement interval starts. 
For detailed information, see 
.