Cisco Cisco Firepower Management Center 2000 Guia Do Programador

Página de 536
 
4-8
FireSIGHT eStreamer Integration Guide
 
Chapter 4      Understanding Discovery & Connection Data Structures 
  Metadata for Discovery Events
The following table describes the fields in the Fingerprint record.
Client Application Record
The eStreamer service transmits the client application metadata for an event within a Client Application 
record, the format of which is shown below. (Client application metadata is sent when one of the 
metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See 
.) Note that the Record Type field, which appears after the Message Length field, has a 
value of 
55
, indicating a Client Application record.
The following table describes the fields in the Client Application record.
Table 4-2
Fingerprint Record Fields 
Field
Data Type
Description
Fingerprint UUID
uint8[16]
A fingerprint ID number that acts as a unique identifier for the 
operating system.
OS Name Length
uint32
The number of bytes included in the operating system name.
OS Name
string
The name of the operating system for the fingerprint.
OS Vendor Length
uint32
The number of bytes included in the operating system vendor name.
OS Vendor
string
The name of the operating system vendor for the fingerprint.
OS Version Length
uint32
The number of bytes included in the operating system version.
OS Version
string
The version of the operating system for the fingerprint.
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Header Version (1)
Message Type (4)
Message Length
Record Type (55)
Record Length
Application ID
Name Length
Name...
Table 4-3
Client Application Record Fields 
Field
Data Type
Description
Application ID
uint32
The application ID number for the client application.
Name Length
uint32
The number of bytes included in the name.
Name
string
The client application name.