Cisco Cisco Firepower Management Center 2000 Guia Do Programador
3-26
FireSIGHT eStreamer Integration Guide
Chapter 3 Understanding Intrusion and Correlation Data Structures
Intrusion Event and Metadata Record Types
The following table describes the fields in the Security Zone Name data block.
Interface Name Record
The eStreamer service transmits metadata containing information on the name of the interface associated
with an intrusion event or connection event within an Interface Name record, the format of which is
shown below. (Interface name information is sent when the Version 4 metadata flag—bit 20 in the
Request Flags field of a request message—is set. See
with an intrusion event or connection event within an Interface Name record, the format of which is
shown below. (Interface name information is sent when the Version 4 metadata flag—bit 20 in the
Request Flags field of a request message—is set. See
.) Note that the Record
Type field, which appears after the Message Length field, has a value of
116
, indicating an Interface
Name record. It contains a UUID String data block, block type 14 in the series 2 set of data blocks.
Table 3-13
Security Zone Name Data Block Fields
Field
Data Type
Description
Security Zone
Name Data Block
Type
Name Data Block
Type
uint32
Initiates a Security Zone Name data block. This value is always
14
. The block type is a series 2 block.
Security Zone
Name Data Block
Length
Name Data Block
Length
uint32
Length of the data block. Includes the number of bytes of data
plus the 8 bytes in the two data block header fields.
plus the 8 bytes in the two data block header fields.
Security Zone
UUID
UUID
uint8[16]
The unique identifier for the security zone associated with the
connection event.
connection event.
String Block Type
uint32
Initiates a String data block containing the name of the security
zone. This value is always
zone. This value is always
0
.
String Block
Length
Length
uint32
The number of bytes included in the security zone name String
data block, including eight bytes for the block type and header
fields plus the number of bytes in the name.
data block, including eight bytes for the block type and header
fields plus the number of bytes in the name.
Security Zone
Name
Name
string
The security zone name.
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Header Version (1)
Message Type (4)
Message Length
Record Type (116)
Record Length
Interface Name Data Block (14)
Interface Name Data Block Length
Interface UUID
String Block Type (0)