Руководство Разработчика для Cisco Cisco Firepower Management Center 2000
Version 5.3
Sourcefire 3D System eStreamer Integration Guide
639
Understanding Legacy Data Structures
Legacy Correlation Event Data Structures
Appendix B
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11
1
2
1
3
1
4
1
5
1
6
1
7
1
8
1
9
2
0
2
1
2
2
2
3
2
4
2
5
2
6
2
7
2
8
2
9
3
0
3
1
Header Version (1)
Message Type (4)
Message Length
Record Type (112)
Record Length
eStreamer Server Timestamp (in events, only if bit 23 is set)
Reserved for Future Use (in events, only if bit 23 is set)
Correlation Block Type (107)
Correlation Block Length
Detection Engine ID
Event Second
Correlation Event ID
Policy ID
Rule ID
Priority
String Block Type (0)
Event
String Block Length
Description...
Event Type
Event Detection Engine ID
Signature ID
Signature Generator ID
Event Second
Event Microsecond
Event ID
Event Defined Mask
Event Impact Flags
IP Protocol
Network Protocol
Source IP