Руководство Разработчика для Cisco Cisco Firepower Management Center 4000
A-7
FireSIGHT eStreamer Integration Guide
Appendix A Data Structure Examples
Intrusion Event Data Structure Examples
Example of a Packet Record
The following diagram shows an example packet record:
4
This line indicates that the data that follows is
50
bytes long.
5
This line contains a value of
20
, indicating that an intrusion impact alert data block follows.
6
This line indicates that the length of the impact alert block, including the impact alert block
header, is
header, is
50
bytes.
7
This line indicates that the event identification number is
201256
.
8
This line indicates that the event is collected from device number
2
.
9
This line indicates that the event occurred at second
1087223700
.
10
This line indicates that
1
(red, vulnerable) is the impact level associated with the event.
11
This line indicates that the IP address associated with the violation event is
172.16.1.22
.
12
This line indicates that there is no destination IP address associated with the violation
(values are set to
(values are set to
0
).
13
This line indicates that a string block follows, containing a string block length and a text
string which, in this case, contains the impact name. For more information about string
blocks, see
string which, in this case, contains the impact name. For more information about string
blocks, see
.
14
This line indicates that the total length of the string block, including the string block
indicator and length is
indicator and length is
18
bytes. This includes 10 bytes for the impact description and 8
bytes for the string header.
15
This line indicates that the description of the impact is “Vulnerable.”
Number
Description
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0
2
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 0 1 1 1 0 1
3
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0
4
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 0 1 0 1 0 1
5
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1
6
0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 1 1 1 0 1 1 0 1 1 0 0 1 1 0
7
0 0 1 1 1 1 1 1 0 0 0 0 0 1 0 0 0 1 1 1 1 1 1 1 0 1 1 1 0 0 1 0
8
0 0 1 1 1 1 1 1 0 0 0 0 0 1 0 0 0 1 1 1 1 1 1 1 0 1 1 1 0 1 0 0
9
0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 0 0 0 0 1 1 0 0 1 1 1 0 1
10
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1