Understanding Discovery & Connection Data Structures

Discovery and Connection Event Data Messages
- Discovery and Connection Event Record Types
Metadata for Discovery Events
Discovery Event Header 5.2+
Discovery and Connection Event Types and Subtypes
Host Discovery Structures by Event Type
Identity Conflict and Identity Timeout System Messages
Host IOC Set Messages
User Data Structures by Event Type
- User Modification Messages
- User Information Update Message Block

Understanding Discovery (Series 1) Blocks

Series 1 Data Block Header
Series 1 Primitive Data Blocks

Host Discovery and Connection Data Blocks

String Data Block
BLOB Data Block
List Data Block
Generic List Block
Sub-Server Data Block
Protocol Data Block
Integer (INT32) Data Block
Vulnerability Reference Data Block
VLAN Data Block
Server Banner Data Block
String Information Data Block
Attribute Address Data Block 5.2+
Attribute List Item Data Block
Attribute Value Data Block
Full Sub-Server Data Block
Operating System Data Block 3.5+
Policy Engine Control Message Data Block
Attribute Definition Data Block for 4.7+
User Protocol Data Block
User Client Application Data Block for 5.1.1+
User Client Application List Data Block
IP Address Range Data Block for 5.2+
Attribute Specification Data Block
Host IP Address Data Block
MAC Address Specification Data Block
Address Specification Data Block
Connection Chunk Data Block for 5.1.1+
Fix List Data Block
User Server Data Block
User Server List Data Block
User Hosts Data Block 4.7+
User Vulnerability Change Data Block 4.7+
User Criticality Change Data Block 4.7+
User Attribute Value Data Block 4.7+
User Protocol List Data Block 4.7+
Host Vulnerability Data Block 4.9.0+
Identity Data Block
Host MAC Address 4.9+
Secondary Host Update
Web Application Data Block for 5.0+
Connection Statistics Data Block 5.3.1+
Scan Result Data Block 5.2+
Host Server Data Block 4.10.0+
Full Host Server Data Block 4.10.0+
Server Information Data Block for 4.10.x, 5.0 - 5.0.2
Full Server Information Data Block
Generic Scan Results Data Block for 4.10.0+
Scan Vulnerability Data Block for 4.10.0+
Full Host Client Application Data Block 5.0+
Host Client Application Data Block for 5.0+
User Vulnerability Data Block 5.0+
Operating System Fingerprint Data Block 5.1+
Mobile Device Information Data Block for 5.1+
Host Profile Data Block for 5.2+
User Product Data Block 5.1+

User Data Blocks

User Account Update Message Data Block
User Information Data Block
User Login Information Data Block 5.1+

Discovery and Connection Event Series 2 Data Blocks

Access Control Rule Data Block
Access Control Rule Reason Data Block 5.1+
Security Intelligence Category Data Block 5.1+

Understanding Discovery &
Connection Data Structures

This chapter provides details about the data structures used in eStreamer messages for discovery and connection events, as well as the metadata for those events. Discovery and connection event messages use the same general message format and series of data blocks; the differences are in the contents of data blocks themselves.

Discovery events include two sub-categories of events:

Host discovery events, which identify new and changed hosts on your managed network, including the applications running on the hosts detected from the contents of the packets, and the host vulnerabilities.
User events, which report the detection of new users and user activity, such as logins.

Connection events report information about the session traffic between your monitored hosts and all other hosts. Connection information includes the first and last packet of the transaction, source and destination IP address, source and destination port, and the number of packets and bytes sent and received. If applicable, connection events also report the client application and URL involved in the session.

For information about requesting discovery or connection events from the eStreamer server, see Request Flags.

For information about the general structure of eStreamer event data messages, see Understanding the Organization of Event Data Messages.

See the following sections in this chapter for more information about discovery and connection event data structures:

Discovery and Connection Event Data Messages provides a high-level view of the structure that eStreamer uses for host discovery, user, and connection messages.
Discovery and Connection Event Record Types describes the record types for discovery and connection events.
Metadata for Discovery Events describes the metadata records that you can request for context information to convert numeric and coded data to text; for example, convert the user ID in an event to a user name.
Discovery Event Header 5.2+ describes the structure of the standard event header used in all discovery and connection messages, and the values that can occur in the event type and event subtype fields. The event type and subtype fields further define the structure of the data record carried in the message.
Host Discovery Structures by Event Type describes the structure of the data record that eStreamer uses for the various host discovery event types.
User Data Structures by Event Type describes the structure of the data record that eStreamer uses for the various user event types.
Understanding Discovery (Series 1) Blocks describes the series of data block structures that are used to convey complex records in discovery and connection event messages. Series 1 data blocks also appear in correlation events.
User Vulnerability Data Block 5.0+ describes other series 1 block structures that are used to convey complex user event records.

Tip See “Data Structure Examples” section for examples that illustrate sample discovery events.

Discovery and Connection Event Data Messages

eStreamer packages the data for discovery and connection events in the same message structure, which contains:

a record header that defines the record type
a discovery event header that identifies and characterizes the event, and specifically identifies the event type and subtype. For information, see Discovery Event Header 5.2+.
a data record consisting of a block header and a data block. Discovery and connection event data messages use series 1 data blocks. For information, see Host Discovery and Connection Data Blocks or User Vulnerability Data Block 5.0+.

Discovery and Connection Event Record Types

The following table lists the event record types for host discovery and connection events, and provides links to the event message structure for each record type. The list includes metadata record types as well. Some records contain a single data block which stores a specific piece of data. These data blocks are broken up into series 1 blocks that contain most types of data, and series 2 blocks that specifically contain discovery data. The table also indicates the status of each version (current or legacy). A current record is the latest version. A legacy record has been superseded by a later version but can still be requested from eStreamer.

Table 4-1 Discovery and Connection Event Record Types
Record Type	Contains Block Type	Series	Description	Record Status	Data Format Described in...
10	139	1	New Host Detected	Current	New Host and Host Last Seen Messages
11	103	1	New TCP Server	Current	Server Messages
12	103	1	New UDP Server	Current	Server Messages
13	4	1	New Network Protocol	Current	New Network Protocol Message
14	4	1	New Transport Protocol	Current	New Transport Protocol Message
15	122	1	New Client Application	Current	Client Application Messages
16	103	1	TCP Server Information Update	Current	Server Messages
17	103	1	UDP Server Information Update	Current	Server Messages
18	53	1	OS Information Update	Current	Operating System Update Messages
19	N/A	N/A	Host Timeout	Current	IP Address Reused and Host Timeout/Deleted Messages
20	N/A	N/A	Host IP Address Reused	Current	IP Address Reused and Host Timeout/Deleted Messages
21	N/A	N/A	Host Deleted: Host Limit Reached	Current	IP Address Reused and Host Timeout/Deleted Messages
22	N/A	N/A	Hops Change	Current	Hops Change Message
23	N/A	N/A	TCP Port Closed	Current	TCP and UDP Port Closed/Timeout Messages
24	N/A	N/A	UDP Port Closed	Current	TCP and UDP Port Closed/Timeout Messages
25	N/A	N/A	TCP Port Timeout	Current	TCP and UDP Port Closed/Timeout Messages
26	N/A	N/A	UDP Port Timeout	Current	TCP and UDP Port Closed/Timeout Messages
27	N/A	N/A	MAC Information Change	Current	MAC Address Messages
28	N/A	N/A	Additional MAC Detected for Host	Current	MAC Address Messages
29	N/A	N/A	Host IP Address Changed	Current	IP Address Change Message
30	139	1	Host Last Seen	Current	New Host and Host Last Seen Messages
31	N/A	N/A	Host Identified as Router/Bridge	Current	Host Identified as a Bridge/Router Message
32	8	1	Vulnerability Change	Current	Vulnerability Change Message
33	144	1	Connection Statistics	Legacy	Connection Statistics Data Block 5.2.x
33	152	1	Connection Statistics	Legacy	Connection Statistics Data Block 5.3
33	154	1	Connection Statistics	Current	Connection Statistics Data Block 5.3.1+
34	14	1	VLAN Tag Information Update	Current	VLAN Tag Information Update Messages
35	122	1	Client Application Timeout	Current	Client Application Messages
42	35	1	NetBIOS Name Change	Current	Change NetBIOS Name Message
44	N/A	N/A	Host Dropped: Host Limit Reached	Current	IP Address Reused and Host Timeout/Deleted Messages
45	37	1	Update Banner	Current	Update Banner Message
46	55	1	Add Host Attribute	Current	Attribute Messages
47	55	1	Update Host Attribute	Current	Attribute Messages
48	55	1	Delete Host Attribute	Current	Attribute Messages
51	103	1	TCP Server Confidence Update	Legacy	Server Messages
52	103	1	UDP Server Confidence Update	Legacy	Server Messages
53	53	1	OS Confidence Update	Legacy	Operating System Update Messages
54	N/A	N/A	Fingerprint Metadata	Current	Fingerprint Record
55	N/A	N/A	Client Application Metadata	Current	Client Application Record
57	N/A	N/A	Vulnerability Metadata	Current	Vulnerability Record
58	N/A	N/A	Criticality Metadata	Current	Criticality Record
59	N/A	N/A	Network Protocol Metadata	Current	Network Protocol Record
60	N/A	N/A	Attribute Metadata	Current	Attribute Record
61	N/A	N/A	Scan Type Metadata	Current	Scan Type Record
63	N/A	N/A	Server Metadata	Current	Server Record
71	144	1	Connection Statistics	Legacy	Connection Statistics Data Block 5.2.x
71	152	1	Connection Statistics	Legacy	Connection Statistics Data Block 5.3
71	154	1	Connection Statistics	Current	Connection Statistics Data Block 5.3.1+
73	136	1	Connection Chunks	Current	Connection Chunk Message
74	N/A	N/A	User Set OS	Current	User Server and Operating System Messages
75	N/A	N/A	User Set Server	Current	User Server and Operating System Messages
76	83	1	User Delete Protocol	Current	User Protocol Messages
77	60	1	User Delete Client Application	Current	User Client Application Messages
78	78	1	User Delete Address	Current	User Add and Delete Host Messages
79	77	1	User Delete Server	Current	User Delete Server Message
80	80	1	User Set Valid Vulnerabilities	Current	User Set Vulnerabilities Messages for Version 4.6.1+
81	80	1	User Set Invalid Vulnerabilities	Current	User Set Vulnerabilities Messages for Version 4.6.1+
82	81	1	User Set Host Criticality	Current	User Set Host Criticality Messages
83	55	1	User Set Attribute Value	Current	Attribute Value Messages
84	82	1	User Delete Attribute Value	Current	Attribute Value Messages
85	78	1	User Add Host	Current	User Add and Delete Host Messages
86	N/A	N/A	User Add Server	Current	User Server and Operating System Messages
87	60	1	User Add Client Application	Current	User Client Application Messages
88	83	1	User Add Protocol	Current	User Protocol Messages
89	142	1	User Add Scan Result	Current	Add Scan Result Messages
90	N/A	N/A	Source Type Record	Current	Source Type Record
91	N/A	N/A	Source Application Record	Current	Source Application Record
92	120	1	User Dropped Change Event	Current	User Modification Messages
93	120	1	User Removed Change Event	Current	User Modification Messages
94	120	1	New User Identification Event	Current	User Modification Messages
95	121	1	User Login Change Event	Current	User Information Update Message Block
96	N/A	N/A	Source Detector Record	Current	Source Detector Record
98	N/A	N/A	User Record	Current	User Record
101	N/A	N/A	New OS Event	Current	New Operating System Messages
102	94	1	Identity Conflict Event	Current	Identity Conflict and Identity Timeout System Messages
103	94	1	Identity Timeout Event	Current	Identity Conflict and Identity Timeout System Messages
106	N/A	N/A	Third Party Scanner Vulnerability Record	Current	Third Party Scanner Vulnerability Record
107	122	1	Client Application Update	Current	Client Application Messages
109	N/A	N/A	Web Application Record	Current	Web Application Record
115	N/A	N/A	Security Zone Name Record	Current	Security Zone Name Record
116	14	2	Interface Name Record	Current	Interface Name Record
117	14	2	Access Control Policy Name Metadata	Current	Access Control Policy Name Record
118	14	2	Intrusion Policy Name Record	Current	Intrusion Policy Name Record
119	14	2	Access Control Rule ID Record	Current	Access Control Rule ID Record Metadata
120	N/A	N/A	Access Control Rule Action Record	Current	Access Control Rule Action Record Metadata
121	N/A	N/A	URL Category Record	Current	URL Category Record Metadata
122	N/A	N/A	URL Reputation Metadata	Current	URL Reputation Record Metadata
124	21	2	Access Control Rule Reason Metadata	Current	Access Control Rule Reason Metadata
160	7	1	Host IOC Set Messages	Current	Host IOC Set Messages
161	39	2	IOC Name Data Block	Current	IOC Name Data Block for 5.3+
280	22	2	Security Intelligence Category Metadata	Current	IOC State Data Block for 5.3+
281	N/A	N/A	Security Intelligence Source/Destination Metadata	Current	Security Intelligence Source/Destination Record

Metadata for Discovery Events

You request metadata by metadata version number. For the metadata version that corresponds to your version of the FireSIGHT System, see Understanding Metadata. For important information on how eStreamer streams metadata records, see Metadata Transmission.

For information on the structures of the various metadata records types for host discovery and user event records, see:

For metadata records for intrusion and correlation events, see Intrusion Event and Metadata Record Types.

Fingerprint Record

The eStreamer service transmits the fingerprint metadata for an event within a Fingerprint record, the format of which is shown below. (Fingerprint metadata is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 54, indicating a Fingerprint record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (54)
	Record Length
Fingerprint UUID	Fingerprint UUID
	Fingerprint UUID cont.
	Fingerprint UUID cont.
	Fingerprint UUID cont.
	OS Name Length
	OS Name...
	OS Vendor Length
	OS Vendor...
	OS Version Length
	OS Version...

The following table describes the fields in the Fingerprint record.

Table 4-2 Fingerprint Record Fields
Field	Data Type	Description
Fingerprint UUID	uint8[16]	A fingerprint ID number that acts as a unique identifier for the operating system.
OS Name Length	uint32	The number of bytes included in the operating system name.
OS Name	string	The name of the operating system for the fingerprint.
OS Vendor Length	uint32	The number of bytes included in the operating system vendor name.
OS Vendor	string	The name of the operating system vendor for the fingerprint.
OS Version Length	uint32	The number of bytes included in the operating system version.
OS Version	string	The version of the operating system for the fingerprint.

Client Application Record

The eStreamer service transmits the client application metadata for an event within a Client Application record, the format of which is shown below. (Client application metadata is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 55, indicating a Client Application record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (55)
	Record Length
	Application ID
	Name Length
	Name...

The following table describes the fields in the Client Application record.

Table 4-3 Client Application Record Fields
Field	Data Type	Description
Application ID	uint32	The application ID number for the client application.
Name Length	uint32	The number of bytes included in the name.
Name	string	The client application name.

Vulnerability Record

The eStreamer service transmits metadata containing vulnerability information for an event within a Vulnerability record, the format of which is shown below. (Vulnerability information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 57, indicating a Vulnerability record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (57)
	Record Length
	Vulnerability ID
	Impact
	Exploits								Remote								Entry Date Length
	Entry Date Length Cont.																Entry Date...
	Published Date Length
	Published Date...
	Modified Date Length
	Modified Date...
	Title Length
	Title...
	Short Description Length
	Short Description...
	Description Length
	Description...
	Technical Description Length
	Technical Description...
	Solution Length
	Solution...

The following table describes the fields in the Vulnerability record.

Table 4-4 Vulnerability Record Fields
Field	Data Type	Description
Vulnerability ID	uint32	The vulnerability ID number.
Impact	uint32	The vulnerability impact, corresponding to the impact level determined through correlation of intrusion data, host discovery events, and vulnerability assessments. The value can be from `1` to `10`, with `10` being the most severe. The impact value of a vulnerability is determined by the writer of the Bugtraq entry.
Exploits	uint8	Indicates whether known exploits exist for the vulnerability. Possible values include: `0` — Yes `1` — No
Remote	uint8	Indicates whether the vulnerability can be exploited across a network. Possible values include: `0` — Yes `1` — No Blank — Vulnerability to remote exploits unknown
Entry Date Length	uint32	The length of the entry date field.
Entry Date	string	The date the vulnerability was entered in the database.
Published Date Length	uint32	The length of the published date field.
Published Date	string	The date the vulnerability was published.
Modified Date Length	uint32	The length of the modified date field.
Modified Date	string	The date of the most recent modification to the vulnerability, if applicable.
Title Length	uint32	The length of the title field.
Title	string	The title of the vulnerability.
Short Description Length	uint32	The length of the short description field.
Short Description	string	A summary description of the vulnerability.
Description Length	uint32	The length of the description field.
Description	string	A general description of the vulnerability.
Technical Description Length	uint32	The length of the technical description field.
Technical Description	string	The technical description of the vulnerability.
Solution Length	uint32	The length of the solution field.
Solution	string	The solution to the vulnerability.

Criticality Record

The eStreamer service transmits metadata containing host criticality information for an event within a Criticality record, the format of which is shown below. (Criticality information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 58, indicating a Criticality record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (58)
	Record Length
	Criticality ID
	Name Length
	Name...

The following table describes the fields in the Criticality record.

Table 4-5 Criticality Record Fields
Field	Data Type	Description
Criticality ID	uint32	The criticality ID number.
Name Length	uint32	The number of bytes included in the criticality level.
Name	string	The criticality level.

Network Protocol Record

The eStreamer service transmits metadata containing network protocol information for an event within a Network Protocol record, the format of which is shown below. (Network protocol information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 59, indicating a Network Protocol record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (59)
	Record Length
	Network Protocol ID
	Name Length
	Name...

The following table describes the fields in the Network Protocol record.

Table 4-6 Network Protocol Record Fields
Field	Data Type	Description
Network Protocol ID	uint32	The network protocol ID number.
Name Length	uint32	The number of bytes included in the network protocol name.
Name	string	The name of the network protocol.

Attribute Record

The eStreamer service transmits metadata containing attribute information for an event within an Attribute record, the format of which is shown below. (Attribute information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 60, indicating an Attribute record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (60)
	Record Length
	Attribute ID
	Name Length
	Name...

The following table describes the fields in the Attribute record.

Table 4-7 Attribute Record Fields
Field	Data Type	Description
Attribute ID	uint32	The attribute ID number.
Name Length	uint32	The number of bytes included in the attribute name.
Name	string	The name of the attribute.

Scan Type Record

The eStreamer service transmits metadata containing scan type information for an event within a Scan Type record, the format of which is shown below. (Scan type information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 61, indicating a Scan Type record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (61)
	Record Length
	Scan Type ID
	Name Length
	Name...

The following table describes the fields in the Scan Type record.

Table 4-8 Scan Type Record Fields
Field	Data Type	Description
Scan Type ID	uint32	The scan type ID number.
Name Length	uint32	The number of bytes included in the scan type name.
Name	string	The name of the scan type.

Server Record

The eStreamer service transmits metadata containing server information for an event within a Server record, the format of which is shown below. The application ID of the server’s application protocol provides the cross-reference to the metadata. (Server information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 63, indicating a Server record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (63)
	Record Length
	Application ID
	Name Length
	Name...

The following table describes the fields in the Server record.

Table 4-9 Server Record Fields
Field	Data Type	Description
Application ID	uint32	The application ID number of the application protocol.
Name Length	uint32	The number of bytes included in the server name.
Name	string	The name of the application protocol. For application ID 65535, the name is `unknown`.

Source Type Record

The eStreamer service transmits metadata containing information about the source application for an event within a Source Type record, the format of which is shown below. (Source type information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 90, indicating a Source Type record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (90)
	Record Length
	Source Type ID
	Name Length
	Name...

The following table describes the fields in the Source Type record.

Table 4-10 Source Type Record Fields
Field	Data Type	Description
Source Type ID	uint32	The identification number for the source type.
Name Length	uint32	The number of bytes included in the source type name.
Name	string	The name of the source type.

Source Application Record

The eStreamer service transmits metadata containing information about the source application for a host discovery event within a Source Application record, the format of which is shown below. (Source application information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 91, indicating a Source Application record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (91)
	Record Length
	Source Application ID
	Name Length
	Name...

The following table describes the fields in the Source Application record.

Table 4-11 Source Application Record Fields
Field	Data Type	Description
Source Application ID	uint32	The ID number for the source application.
Name Length	uint32	The number of bytes included in the source application name.
Name	string	The name of the source application.

Source Detector Record

The eStreamer service transmits metadata containing information about the source application for a host discovery event within a Source Type record, the format of which is shown below. (Source type information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 96, indicating a Source Detector record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (96)
	Record Length
	Source Detector ID
	Name Length
	Name...

The following table describes the fields in the Source Detector record.

Table 4-12 Source Detector Record Fields
Field	Data Type	Description
Source Detector ID	uint32	The ID string for the source detector.
Name Length	uint32	The number of bytes included in the source type name.
Name	string	The name of the source detector.

Third Party Scanner Vulnerability Record

The eStreamer service transmits metadata containing third-party vulnerability information for an event within a Third Party Scanner Vulnerability record, the format of which is shown below. (Vulnerability information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 106, indicating a Third Party Scanner Vulnerability record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (106)
	Record Length
	Vulnerability ID
	Scanner Type
	Title Length
	Title...
	Description Length
	Description...
	CVE ID Length
	CVE ID...
	BugTraq Length
	BugTraq ID...

The following table describes the fields in the Vulnerability record.

Table 4-13 Third Party Scanner Vulnerability Record Fields
Field	Data Type	Description
Vulnerability ID	uint32	The third-party vulnerability ID number.
Scanner Type	uint32	The third-party scanner type.
Title Length	uint32	The length of the title field.
Title	string	The title of the vulnerability.
Description Length	uint32	The length of the description field.
Description	string	A general description of the vulnerability.
CVE ID Length	uint32	The length of the CVE ID field.
CVE ID	string	The Common Vulnerabilities and Exposures (CVE) ID number for the vulnerability.
BugTraq ID Length	uint32	The length of the BugTraq ID field.
BugTraq ID	string	The BugTraq ID number for the vulnerability.

User Record

The eStreamer service transmits metadata containing information about users detected by the system within a User record, the format of which is shown below. (User information is sent when the Version 4 metadata and the policy event request flag—bits 20 and 22, respectively, in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 98, indicating a User record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (98)
	Record Length
	User ID
	Protocol
	Name Length
	Name...

The following table describes the fields in the User record.

Table 4-14 User Record Fields
Field	Data Type	Description
User ID	uint32	The ID string for the user.
Protocol	uint32	The protocol for the traffic where the user was detected.
Name Length	uint32	The number of bytes included in the user name.
Name	string	The name of the user.

Web Application Record

The system detects the content of HTTP traffic from websites, if available. Web application metadata for a host discovery event may include the specific type of content (for example, WMV or QuickTime).

The eStreamer service transmits the web application metadata for an event within a Web Application record, the format of which is shown below. (Web application metadata is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 109, indicating a Web Application record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (109)
	Record Length
	Application ID
	Name Length
	Name...

The following table describes the fields in the Web Application record.

Table 4-15 Web Application Record Fields
Field	Data Type	Description
Application ID	uint32	Application ID number of the web application.
Name Length	uint32	The number of bytes included in the name.
Name	string	The web application content name.

Intrusion Policy Name Record

The eStreamer service transmits metadata containing intrusion policy name information for a connection event within an Intrusion Policy Name record, the format of which is shown below. (Intrusion policy name information is sent when one of the metadata flags—version 4 metadata bit 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Intrusion Policy Name record field, which appears after the Message Length field, has a value of 118, indicating an Intrusion Policy Name record. It contains a UUID String data block, block type 14 in the series 2 set of data blocks.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (118)
	Record Length
	Intrusion Policy Name Data Block (14)
	Intrusion Policy Name Data Block Length
	Intrusion Policy UUID
	Intrusion Policy UUID, continued
	Intrusion Policy UUID, continued
	Intrusion Policy UUID, continued
	String Block Type (0)
	String Block Length
	Intrusion Policy Name...

The following table describes the fields in the Intrusion Policy Name data block.

Table 4-16 Intrusion Policy Name Data Block Fields
Field	Data Type	Description
Intrusion Policy Name Data Block Type	uint32	Initiates an Intrusion Policy Name data block. This value is always `14`. The block type is a series 2 block.
Intrusion Policy Name Data Block Length	uint32	Length of the data block. Includes the number of bytes of data plus the 8 bytes in the two data block header fields.
Intrusion Policy UUID	uint8[16]	The unique identifier for the intrusion policy associated with the connection event.
String Block Type	uint32	Initiates a String data block containing the name of the intrusion policy. This value is always `0`.
String Block Length	uint32	The number of bytes included in the intrusion policy name String data block, including eight bytes for the block type and header fields plus the number of bytes in the intrusion policy name.
Intrusion Policy Name	string	The intrusion policy name.

Access Control Rule Action Record Metadata

The eStreamer service transmits metadata containing the action associated with a triggered access control rule within an Access Control Rule Action record, the format of which is shown below. (Access Control Rule Action information is sent when the version 4 metadata flag—bit 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Access Control Rule Action record field, which appears after the Message Length field, has a value of 120, indicating an Access Control Rule Action record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (120)
	Record Length
	Access Control Rule Action ID
	Name Length
	Name...

The following table describes the fields in the Access Control Rule Action record.

Table 4-17 Access Control Rule Action Record Fields
Field	Data Type	Description
Access Control Rule Action ID	uint32	ID number of the access control rule action.
Name Length	uint32	The number of bytes included in the name.
Name	string	The firewall rule action name.

URL Category Record Metadata

The eStreamer service transmits metadata containing the category name associated with a URL in a connection log within a URL Category record, the format of which is shown below. (URL category information is sent when the version 4 metadata flag—bit 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the record field, which appears after the Message Length field, has a value of 121, indicating a URL Category record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (121)
	Record Length
	URL Category ID
	Name Length
	Name...

The following table describes the fields in the URL Category record.

Table 4-18 URL Category Record Fields
Field	Data Type	Description
URL Category ID	uint32	ID number of the URL category.
Name Length	uint32	The number of bytes included in the name.
Name	string	The URL category name.

URL Reputation Record Metadata

The eStreamer service transmits metadata containing the reputation (that is, risk level) associated with a URL in a connection log within a URL Reputation record, the format of which is shown below. (URL reputation information is sent when the version 4 metadata flag—bit 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the URL Reputation metadata record field, which appears after the Message Length field, has a value of 122, indicating a URL Reputation metadata record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (122)
	Record Length
	URL Reputation ID
	Name Length
	Name...

The following table describes the fields in the URL Reputation record.

Table 4-19 URL Reputation Record Fields
Field	Data Type	Description
URL Reputation ID	uint32	ID number of the URL reputation.
Name Length	uint32	The number of bytes included in the name.
Name	string	The URL reputation name.

Access Control Rule Reason Metadata

The eStreamer service transmits metadata containing information about the reason an access control rule triggered an intrusion event or connection event within an Access Control Rule Reason record, the format of which is shown below. Access control rule reason metadata is sent when the Version 4 metadata flag—bit 20 in the Request Flags field of a request message—is set. See Request Flags. Note that the Record Type field, which appears after the Message Length field, has a value of 124, indicating an Access Control Rule Reason record. It contains an Access Control Rule Reason Block (as documented in Access Control Rule Reason Data Block 5.1+). The Access Control Rule Reason data block is block type 21 in series 2.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (124)
	Record Length
	Access Control Rule Reason Block Type (21)
	Access Control Rule Block Length
	Access Control Rule Reason																String Block Type (0)
	String Block Type (0), cont.																String Block Length
	String Block Length, cont.																Description...

The following table describes the fields in the Access Control Rule ID data block.

Table 4-20 Access Control Rule Reason Metadata Fields
Field	Data Type	Description
Access Control Rule Reason Block Type	uint32	Initiates an Access Control Rule Reason block. This value is always `21`. This is a series 2 data block.
Access Control Rule Reason Block Length	uint32	Total number of bytes in the Access Control Rule Reason block, including eight bytes for the Access Control Rule Reason block type and length fields, plus the number of bytes of data that follows.
Access Control Rule Reason	uint16	The reason the Access Control rule logged the connection.
String Block Type	uint32	Initiates a String data block containing the descriptive name associated with the access control rule reason. This value is always `0`.
String Block Length	uint32	The number of bytes included in the name String data block, including eight bytes for the block type and header fields plus the number of bytes in the Description field.
Description	string	Description of the Access Control rule reason.

IOC State Data Block for 5.3+

The IOC State data block provides information about an Indication of Compromise (IOC). It is block type of 150 in series 1. It is used by the host tracker to store information about a compromise on a host. The following diagram shows the structure of an IOC State data block:

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	IOC State Block Type (150)
	IOC State Block Length
	IOC ID Number
	Disabled								First Seen
	First Seen, continued								First Event ID
	First Event ID, cont.								First Device ID
	First Device ID, cont.								First Instance ID																First Connection Time
	First Connection Time, cont.																								First Counter
	First Counter, cont.								Last Seen
	Last Seen, cont.								Last Event ID
	Last Event ID, cont.								Last Device ID
	Last Device ID, cont.								Last Instance ID																Last Connection Time
	Last Connection Time, cont.																								Last Counter
	Last Counter, cont.

The following table describes the components of the IOC State data block.

Table 4-21 IOC State Data Block Fields
Field	Data Type	Description
IOC State Data Block Type	uint32	Initiates an IOC State data block. This value is always `150`.
IOC State Data Block Length	uint32	Total number of bytes in the IOC State data block, including eight bytes for the IOC State data block type and length fields, plus the number of bytes of data that follows.
IOC ID Number	uint32	Unique ID number for the compromise.
Disabled	uint8	Indicates whether the compromise has been disabled on the host: `0` - The compromise is not disabled. `1` - The compromise is disabled.
First Seen	uint32	Unix timestamp of when this compromise was first seen.
First Event ID	uint32	ID number of the event on which this compromise was first seen.
First Device ID	uint32	ID of the sensor which first detected the IOC.
First Instance ID	uint16	Numerical ID of the Snort instance on the managed device that first detected the compromise.
First Connection Time	uint32	Unix timestamp of the connection where this compromise was first seen.
First Counter	uint16	Counter for the connection on which this compromise was last seen. Used to differentiate between multiple connections occurring at the same time.
Last Seen	uint32	Unix timestamp of when this compromise was last seen
Last Event ID	uint32	ID number of the event on which this compromise was last seen.
Last Device ID	uint32	ID of the sensor which most recently detected the IOC.
Last Instance ID	uint16	Numerical ID of the Snort instance on the managed device that last detected the compromise.
Last Connection Time	uint32	Unix timestamp of the connection on which this compromise was last seen.
Last Counter	uint16	Counter for the connection on which this compromise was last seen. Used to differentiate between multiple connections occurring at the same time.

IOC Name Data Block for 5.3+

This is a data block that provides the category and event type for an Indication of Compromise (IOC). The record type is 161, with a block type of 39 in series 2. It is exposed as metadata for any event that has IOC information. These include malware events, file events, and intrusion events.

The following diagram shows the structure of an IOC Name data block:

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (161)
	IOC Name Block Type (39)
	IOC Name Block Length
	IOC ID Number
Category	String Block Type (0)
	String Block Length
	Category...
Event Type	String Block Type (0)
	String Block Length
	Event Type...

The following table describes the fields in the IOC Name data block.

Table 4-22 IOC Name Data Block Fields
Field	Data Type	Description
IOC Name Data Block Type	uint32	Initiates an IOC Name data block. This value is always `39`.
IOC Name Data Block Length	uint32	Total number of bytes in the IOC Name data block, including eight bytes for the IOC Name data block type and length fields, plus the number of bytes of data that follows.
IOC ID Number	uint32	Unique ID number for the compromise.
String Block Type	uint32	Initiates a String data block containing the category associated with the compromise. This value is always `0`.
String Block Length	uint32	The number of bytes included in the name String data block, including eight bytes for the block type and header fields plus the number of bytes in the Category field.
Category	string	The category for the compromise. Possible values include: `CnC Connected` `Exploit Kit` `High Impact Attack` `Low Impact Attack` `Malware Detected` `Malware Executed` `Dropper Infection` `Java Compromise` `Word Compromise` `Adobe Reader Compromise` `Excel Compromise` `PowerPoint Compromise` `QuickTime Compromise`
String Block Type	uint32	Initiates a String data block containing the event type associated with the compromise. This value is always `0`.
String Block Length	uint32	The number of bytes included in the name String data block, including eight bytes for the block type and header fields plus the number of bytes in the Event Type field.
Event Type	string	The event type for the compromise. Possible values include: `Adobe Reader launched shell` `Dropper Infection Detected by FireAMP` `Excel Compromise Detected by FireAMP` `Excel launched shell` `Impact 1 Intrusion Event - attempted-admin` `Impact 1 Intrusion Event - attempted-user` `Impact 1 Intrusion Event - successful-admin` `Impact 1 Intrusion Event - successful-user` `Impact 1 Intrusion Event - web-application-attack` `Impact 2 Intrusion Event - attempted-admin` `Impact 2 Intrusion Event - attempted-user` `Impact 2 Intrusion Event - successful-admin` `Impact 2 Intrusion Event - successful-user` `Impact 2 Intrusion Event - web-application-attack` `Intrusion Event - exploit-kit` `Intrusion Event - malware-backdoor` `Intrusion Event - malware-CnC` `Java Compromise Detected by FireAMP` `Java launched shell` `PDF Compromise Detected by FireAMP` `PowerPoint Compromise Detected by FireAMP` `PowerPoint launched shell` `QuickTime Compromise Detected by FireAMP` `QuickTime launched shell` `Security Intelligence Event - CnC` `Suspected Botnet Detected by FireAMP` `Threat Detected by FireAMP - Subtype is 'executed'` `Threat Detected by FireAMP - Subtype is not 'executed'` `Threat Detected in File Transfer - Action is not 'block'` `Word Compromise Detected by FireAMP` `Word launched shell`

Security Intelligence Category Metadata

The eStreamer service transmits metadata containing information about the Security Intelligence category within a Security Intelligence Category record, the format of which is shown below. Access control rule reason metadata is sent when the Version 4 metadata flag—bit 20 in the Request Flags field of a request message—is set. See Request Flags. Note that the Record Type field, which appears after the Message Length field, has a value of 280, indicating a Security Intelligence Category record. It contains a Security Intelligence Category data block (as documented in Security Intelligence Category Data Block 5.1+). The Security Intelligence data block is block type 22 in series 2.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (280)
	Record Length
	Security Intelligence Category Block Type (22)
	Security Intelligence Category Block Length
	Security Intelligence List ID
	Access Control Policy UUID
	Access Control Policy UUID, continued
	Access Control Policy UUID, continued
	Access Control Policy UUID, continued
	String Block Type (0)
	String Block Length
	Security Intelligence List Name...

The following table describes the fields in the Security Intelligence Category record.

Table 4-23 Security Intelligence Category Metadata Fields
Field	Data Type	Description
Security Intelligence Category Block Type	uint32	Initiates an Security Intelligence Category data block. This value is always `22`. This is a series 2 data block.
Security Intelligence Category Block Length	uint32	Total number of bytes in the Security Intelligence Category block, including eight bytes for the Security Intelligence Category block type and length fields, plus the number of bytes of data that follows.
Security Intelligence List ID	uint32	The ID of the IP blacklist or whitelist triggered by the connection.
Access Control Policy UUID	uint8[16]	The UUID of the access control policy configured for Security Intelligence.
String Block Type	uint32	Initiates a String data block containing the descriptive name associated with the access control rule reason. This value is always `0`.
String Block Length	uint32	The number of bytes included in the name String data block, including eight bytes for the block type and header fields plus the number of bytes in the Security Intelligence List Name field.
Security Intelligence List Name	string	The name of the IP category blacklist or whitelist triggered by the connection.

Security Intelligence Source/Destination Record

The eStreamer service transmits metadata containing whether a Security Intelligence-detected IP address is a source IP address or destination IP address within a Security Intelligence Source/Destination record, the format of which is shown below. (The source/destination IP information is sent when one of the metadata flags—bits 1, 14, 15, or 20 in the Request Flags field of a request message—is set. See Request Flags.) Note that the Record Type field, which appears after the Message Length field, has a value of 281, indicating a Security Intelligence Source/Destination record.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type (281)
	Record Length
	Security Intelligence Source/Destination ID
	Security Intelligence Source/Destination Length
	Security Intelligence Source/Destination...

The following table describes the fields in the Security Intelligence Source/Destination record.

Table 4-24 Security Intelligence Source/Destination Record Fields
Field	Data Type	Description
Security Intelligence Source/ Destination ID	uint32	The Security Intelligence source/destination ID number.
Security Intelligence Source/ Destination Length	uint32	The number of bytes included in the Security Intelligence source/destination.
Security Intelligence Source/ Destination	string	Whether the detected IP address is a source or destination IP address.

Discovery Event Header 5.2+

Discovery and connection event messages contain a discovery event header. It conveys the type and subtype of the event, the time the event occurred, the device on which the event occurred, and the structure of the event data in the message. This header is followed by the actual host discovery, user, or connection event data. The structures associated with the different event type/subtype values are described in Host Discovery Structures by Event Type. This header has IPv6 support, and deprecates Discovery Event Header 5.0 - 5.1.1.x.

The event type and event subtype fields of the discovery event header identify the structure of the transmitted event message. After the structure of the event data block is determined, your program can parse the message appropriately.

The shaded rows in the following diagram illustrate the format of the discovery event header.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Header Version (1)																Message Type (4)
	Message Length
	Record Type
	Record Length
	eStreamer Server Timestamp (in events, only if bit 23 is set)
	Reserved for Future Use (in events, only if bit 23 is set)
Discovery Event Header	Device ID
	Legacy IP Address
	MAC Address
	MAC Address, continued																Has IPv6								Reserved for future use
	Event Second
	Event Microsecond
	Event Type
	Event Subtype
	File Number (Internal Use Only)
	File Position (Internal Use Only)
	IPv6 Address
	IPv6 Address, continued
	IPv6 Address, continued
	IPv6 Address, continued

The following table describes the discovery event header.

Table 4-25 Discovery Event Header Fields
Field	Data Types	Description
Device ID	uint32	ID number of the device that generated the discovery event. You can obtain the metadata for the device by requesting Version 3 and 4 metadata. See Managed Device Record Metadata for more information.
Legacy IP Address	uint32	This field is reserved but no longer populated. The IPv4 address is stored in the IPv6 Address field. See IP Addresses for more information.
MAC Address	uint8[6]	MAC address of the host involved in the event.
Has IPv6	uint8	Flag indicating that the host has an IPv6 address.
Reserved for future use	uint8	Reserved for future use
Event Second	uint32	UNIX timestamp (seconds since 01/01/1970) that the system generated the event.
Event Microsecond	uint32	Microsecond (one millionth of a second) increment that the system generated the event.
Event Type	uint32	Event type ( `1000` for new events, `1001` for change events, `1002` for user input events, `1050` for full host profile). See Host Discovery Structures by Event Type for a list of available event types.
Event Subtype	uint32	Event subtype. See Host Discovery Structures by Event Type for a list of available event subtypes.
File Number	byte[4]	Serial file number. This field is for Cisco internal use and can be disregarded.
File Position	byte[4]	Event’s position in the serial file. This field is for Cisco internal use and can be disregarded.
IPv6 Address	uin8[16]	IPv6 address. This field is present and used if the Has IPv6 flag is set.

Discovery and Connection Event Types and Subtypes

The values in the Event Type and Event Subtype fields identify and classify the event contained in a host discovery or user data message. They also identify the structure of the data in the message.

The following table lists the event types and event subtypes for discovery and connection events.

Table 4-26 Discovery and Connection Events by Type and Subtype
Event Name	Event Type	Event Subtype
New Host	1000	1
New TCP Server	1000	2
New Network Protocol	1000	3
New Transport Protocol	1000	4
New IP to IP Traffic	1000	5
New UDP Server	1000	6
New Client Application	1000	7
New OS	1000	8
New IPv6 to IPv6 Traffic	1000	9
Host IP Address Changed	1001	1
OS Information Update	1001	2
Host IP Address Reused	1001	3
Vulnerability Change	1001	4
Hops Change	1001	5
TCP Server Information Update	1001	6
Host Timeout	1001	7
TCP Port Closed	1001	8
UDP Port Closed	1001	9
UDP Server Information Update	1001	10
TCP Port Timeout	1001	11
UDP Port Timeout	1001	12
MAC Information Change	1001	13
Additional MAC Detected for Host	1001	14
Host Last Seen	1001	15
Host Identified as Router/Bridge	1001	16
Connection Statistics	1001	17
VLAN Tag Information Update	1001	18
Host Deleted: Host Limit Reached	1001	19
Client Application Timeout	1001	20
NetBIOS Name Change	1001	21
NetBIOS Domain Change	1001	22
Host Dropped: Host Limit Reached	1001	23
Banner Update	1001	24
TCP Server Confidence Update	1001	25
UDP Server Confidence Update	1001	26
Identity Conflict	1001	29
Identity Timeout	1001	30
Secondary Host Update	1001	31
Client Application Update	1001	32
User Set Valid Vulnerabilities (Legacy)	1002	1
User Set Invalid Vulnerabilities (Legacy)	1002	2
User Delete Address (Legacy)	1002	3
User Delete Server (Legacy)	1002	4
User Set Host Criticality	1002	5
Host Attribute Add	1002	6
Host Attribute Update	1002	7
Host Attribute Delete	1002	8
Host Attribute Set Value (Legacy)	1002	9
Host Attribute Delete Value (Legacy)	1002	10
Add Scan Result	1002	11
User Set Vulnerability Qualification	1002	12
User Policy Control	1002	13
Delete Protocol	1002	14
Delete Client Application	1002	15
User Set Operating System	1002	16
User Account Seen	1002	17
User Account Update	1002	18
User Set Server	1002	19
User Delete Address (Current)	1002	20
User Delete Server (Current)	1002	21
User Set Valid Vulnerabilities (Current)	1002	22
User Set Invalid Vulnerabilities (Current)	1002	23
User Host Criticality	1002	24
Host Attribute Set Value (Current)	1002	25
Host Attribute Delete Value (Current)	1002	26
User Add Host	1002	27
User Add Server	1002	28
User Add Client Application	1002	29
User Add Protocol	1002	30
Reload App	1002	31
Account Delete	1002	32
Connection Statistics	1003	1
Connection Chunks	1003	2
New User Identity	1004	1
User Login	1004	2
Delete User Identity	1004	3
User Identity Dropped: User Limit Reached	1004	4
Host IOC Set Type	1008	1
Full Host Profile	1050	N/A

Tip For information about the data structure used for each event type/subtype, see Host Discovery Structures by Event Type.

Host Discovery Structures by Event Type

eStreamer builds host discovery event messages based on the event type indicated in the discovery event header. The following sub-sections describe the high-level structure for each event type:

The data block diagrams in the following sections depict the different record data blocks returned in host discovery event messages.

New Host and Host Last Seen Messages

New Host and Host Last Seen event messages have a standard discovery event header and a Host Profile data block (as documented in Host Profile Data Block for 5.2+). The Host Profile data block is block type 139 in series 1.

Note that the Host Last Seen message includes server information only for servers on the host that have changed within the Update Interval set in the discovery detection policy. In other words, only servers that have changed since the system last reported information will be included in the Host Last Seen message.

Note The Host Profile data block differs depending on which system version created the message. For information on legacy versions of the Host Profile data block, see Legacy Host Data Structures.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header
	Host Profile Data Block

Server Messages

The following TCP and UDP server event messages have a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a Server data block (as documented in Host Server Data Block 4.10.0+, block type 103 in series 1):

New TCP Server
New UDP Server
TCP Server Information Update
UDP Server Information Update
TCP Server Confidence Update
UDP Server Confidence Update

Note The Server data block differs depending on which system version created the message. For information on the legacy versions of the Server data block, see Understanding Legacy Data Structures.

Each of these events uses the following format:

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header
	Server Data Block

New Network Protocol Message

A New Network Protocol event message has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a two-byte field for the network protocol (using protocol values described in following table).

Byte

Bit

Discovery Event Header

Network Protocol

New Transport Protocol Message

A New Transport Protocol event message has a standard discovery event header (as documented in Discovery Event Header 5.2+, block type 4 in series 1) and a one-byte field for the transport protocol number (using values described in following table).

Byte

Bit

Discovery Event Header

Transport Protocol

Client Application Messages

New Client Application, Client Application Update, and Client Application Timeout events have the same format and contain a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a Client Application data block (see Host Client Application Data Block for 5.0+, block type 122 in series 1). The discovery event header has a different record type, event type, and event subtype, depending on the event transmitted.

Note The Client Application data block differs depending on the system version that created the message. For information on the legacy version of the Client Application data block, see Understanding Legacy Data Structures.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	Client Application Data Block

IP Address Change Message

The following host discovery messages have a standard discovery event header (as documented in Discovery Event Header 5.2+) and two different forms, structures, one with four bytes for the IP address and one with 16 bytes for the IP address.

Four bytes are used for the IP address (in IP address octets) in the following case:

New IPv4 to IPv4 Traffic
Host IP Address Changed, when the RNA event version is less than 10

Byte

Bit

Discovery Event Header

IP Address

16 bytes are used for the IP address in the following cases:

New IPv6 to IPv6 Traffic
Host IP Address Changed, when the RNA event version is 10

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header
	IP Address
	IP Address, continued
	IP Address, continued
	IP Address, continued

Operating System Update Messages

The OS Information Update event message has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by an Operating System data block (as documented in Operating System Data Block 3.5+, block type 53 in series 1).

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	Operating System Data Block

IP Address Reused and Host Timeout/Deleted Messages

The following host event messages have a standard discovery event header (as documented in Discovery Event Header 5.2+) with no other data:

Host IP Address Reused
Host Timeout
Host Deleted: Host Limit Reached
Host Dropped: Host Limit Reached

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header

Vulnerability Change Message

A Vulnerability Change event message has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a Vulnerability Reference data block (as documented in Vulnerability Reference Data Block, block type 8 in series 1).

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	Vulnerability Reference Data Block

Hops Change Message

A Hops Change event message has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a one-byte field for the hops count.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	Hops

TCP and UDP Port Closed/Timeout Messages

TCP and UDP Port Closed and Port Timeout event messages have a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a two-byte field for the port number.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	Port

MAC Address Messages

MAC Information Change and Additional MAC Detected for Host messages have a standard discovery event header (as documented in Discovery Event Header 5.2+), 1 byte for the TTL value, 6 bytes for the MAC address, and 1 byte to indicate whether the MAC address was detected via ARP/DHCP traffic as the actual MAC address.

Note If you receive MAC address messages from a system running version 4.9.x, you must check for the length of the MAC address data block and decode accordingly. If the data block is 8 bytes in length (16 bytes with the header), see MAC Address Messages. If the data block is 12 bytes in length (20 bytes with the header), see Host MAC Address 4.9+.

Note that the MAC address data block header is not used within MAC Information Change and Additional MAC Detected for Host messages.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	TTL
	MAC Address																								ARP/DHCP

Host Identified as a Bridge/Router Message

A Host Identified as a Bridge/Router event message has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a four-byte field for the value that matches the host type:

0 - host
1 - router
2 - bridge

Byte

Bit

Discovery Event Header

Host Type

VLAN Tag Information Update Messages

The VLAN Tag Information Update event has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by VLAN data block (as documented in VLAN Data Block). The VLAN Data block is block type 14 in the series 1 group of blocks.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	VLAN Data Block

Change NetBIOS Name Message

A Change NetBIOS Name event message has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a String Information data block (as documented in String Information Data Block). The String Information data block is block type 35 in series 1.

Note The Change NetBIOS Domain event is not currently generated by the FireSIGHT System.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	String Information Data Block

Update Banner Message

An Update Banner event message has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a Server Banner data block (as documented in Server Banner Data Block). The server banner data block is block type 37 in series 1.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	Server Banner Data Block

Policy Control Message

The Policy Control Message event has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a Policy Control Message data block. The format of the Policy Control Message data block differs depending on the system version. For information on policy control message data block format for the current version, see Policy Engine Control Message Data Block.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	Policy Control Message Data Block

Connection Statistics Data Message

The Connection Statistics event has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a Connection Statistics data block. The documentation of each version of the Connection Statistics data block includes the system versions that use it. For information on the connection statistics data block format for version 5.3.1+, see Connection Statistics Data Block 5.3.1+.

Note The Connection Statistics data block differs depending on which system version created the message. For information on legacy versions, see the Connection Statistics data block in Understanding Legacy Data Structures.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	Connection Statistics Data Block

Connection Chunk Message

The Connection Chunk event has a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by a Connection Chunk data block. The format differs depending on the system version. For information on connection chunk data block format for the current version, see Connection Chunk Data Block for 5.1.1+. The Connection Chunk data block is block type 136 in series 1.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	Connection Chunk Data Block

User Set Vulnerabilities Messages for Version 4.6.1+

User Set Valid Vulnerabilities, User Set Invalid Vulnerabilities, and User Vulnerability Qualification messages use the same data format: the standard discovery event header (see Discovery Event Header 5.2+) followed by a User Vulnerability change data block (see User Vulnerability Change Data Block 4.7+, block type 80 in series 1). They are differentiated by record type, event type, and event subtype.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	User Vulnerability Change Data Block

User Add and Delete Host Messages

The following host input event messages have the standard discovery event header (see Discovery Event Header 5.2+) followed by a User Hosts data block (see User Hosts Data Block 4.7+, block type 78 in series 1):

User Delete Address
User Add Hosts

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	User Hosts Data Block

User Delete Server Message

User Delete Server messages have the standard discovery event header (see Discovery Event Header 5.2+) followed by a User Server List data block (see User Server List Data Block). The User Server List data block is block type 77 in series 1.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	User Server List Data Block

User Set Host Criticality Messages

User Set Host Criticality messages have the standard discovery event header (see Discovery Event Header 5.2+) followed by a User Criticality Change data block (see User Criticality Change Data Block 4.7+). The User Criticality Change data block is block type 81 in series 1.

Byte	0								1								2								3
Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
	Discovery Event Header


	User Criticality Change Data Block

Attribute Messages

The following event messages have a standard discovery event header (as documented in Discovery Event Header 5.2+) followed by an Attribute Definition data block (as documented in Attribute Definition Data Block for 4.7+, block type 55 in series 1):

Add Host Attribute
Update Host Attribute
Delete Host Attribute