Cisco Cisco Firepower Management Center 2000 Guia Do Programador

Página de 536
 
3-26
FireSIGHT eStreamer Integration Guide
 
Chapter 3      Understanding Intrusion and Correlation Data Structures 
  Intrusion Event and Metadata Record Types
The following table describes the fields in the Security Zone Name data block.
Interface Name Record
The eStreamer service transmits metadata containing information on the name of the interface associated 
with an intrusion event or connection event within an Interface Name record, the format of which is 
shown below. (Interface name information is sent when the Version 4 metadata flag—bit 20 in the 
Request Flags field of a request message—is set. See 
.) Note that the Record 
Type field, which appears after the Message Length field, has a value of 
116
, indicating an Interface 
Name record. It contains a UUID String data block, block type 14 in the series 2 set of data blocks.
Table 3-13
Security Zone Name Data Block Fields 
Field
Data Type
Description
Security Zone 
Name Data Block 
Type
uint32
Initiates a Security Zone Name data block. This value is always 
14
. The block type is a series 2 block.
Security Zone 
Name Data Block 
Length
uint32
Length of the data block. Includes the number of bytes of data 
plus the 8 bytes in the two data block header fields.
Security Zone 
UUID
uint8[16]
The unique identifier for the security zone associated with the 
connection event.
String Block Type
uint32
Initiates a String data block containing the name of the security 
zone. This value is always 
0
.
String Block 
Length
uint32
The number of bytes included in the security zone name String 
data block, including eight bytes for the block type and header 
fields plus the number of bytes in the name.
Security Zone 
Name
string
The security zone name.
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Header Version (1)
Message Type (4)
Message Length
Record Type (116)
Record Length
Interface Name Data Block (14)
Interface Name Data Block Length
Interface UUID
String Block Type (0)