- Legacy Intrusion Data Structures
- Legacy Malware Event Data Structures
- Legacy Discovery Data Structures
- Legacy Discovery Event Header
- Legacy Server Data Blocks
- Attribute Address Data Block for 4.5.x - 5.1.1.x
- Legacy Client Application Data Blocks
- Legacy Scan Result Data Blocks
- Scan Result Data Block 4.10.0 - 5.1.1.x
- Legacy Vulnerability Blocks
- Legacy User Login Data Blocks
- Legacy Host Profile Data Blocks
- Legacy OS Fingerprint Data Blocks
- Legacy Connection Data Structures
- Legacy File Event Data Structures
- Legacy Correlation Event Data Structures
- Legacy Host Data Structures
- Legacy Metadata Structures
Understanding Legacy Data Structures
This appendix contains information about data structures supported by eStreamer at previous versions of Sourcefire 3D System products.
If your client uses event stream requests with bits set to request data in older version formats, you can use the information in this appendix to identify the data structures of the data messages you receive.
Note that prior to version 5.0, separate detection engines were assigned IDs. For version 5.0+, devices are assigned IDs. Based on the version, data structures reflect this.
This appendix describes only data structures from version 4.9 or later of the Sourcefire 3D System. If you require documentation for structures from earlier data structure versions, contact Sourcefire Customer Support.
See the following sections for more information:
Legacy Intrusion Data Structures
■
HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#73394">Legacy Malware Event Data Structures
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#91178">Legacy Discovery Data Structures
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#52333">Legacy Connection Data Structures
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#69534">Legacy File Event Data Structures
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#82774">Legacy Correlation Event Data Structures
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#67057">Legacy Host Data Structures
Legacy Intrusion Data Structures
Intrusion Event (IPv4) Record for 4.9 - 4.10.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#67457">Intrusion Event (IPv6) Record for 4.10.2.3
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#54997">Intrusion Event (IPv4) Record 5.0.x - 5.1
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#97688">Intrusion Event (IPv6) Record 5.0.x - 5.1
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#12231">Intrusion Event Record 5.2.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#29338">Intrusion Event Record 5.1.1.x
Intrusion Event (IPv4) Record for 4.9 - 4.10.x
The fields in the intrusion event (IPv4) record are shaded in the following graphic. The record type is 104 for version 4.9+, where VLAN IDs are included. The table following the graphic includes details on the fields.
You request intrusion event records by setting the intrusion event flag—bit 6 in the Request Flags field—in the request message. If you enable bit 23, an extended event header is included in the record.
Events are uniquely identified by event ID, detection device ID, and event second.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
||||||||||||||||||||||||||||||||
The Intrusion Event (IPv4) Record 4.9 - 4.10.x Fields describes each intrusion event record data field.
Intrusion Event (IPv6) Record for 4.10.2.3
The fields in the intrusion event (IPv6) record are shaded in the following graphic. The record type is 105 for version 4.10.2.3, where VLAN IDs are included. The table following the graphic includes details on the fields.
You request intrusion event records by setting the intrusion event flag—bit 6 in the Request Flags field—in the request message. If you enable bit 23, an extended event header is included in the record.
Events are uniquely identified by event ID, detection device ID, and event second.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
||||||||||||||||||||||||||||||||
The Intrusion Event (IPv6) Record 4.10.2.3+ Fields describes each intrusion event record data field.
Intrusion Event (IPv4) Record 5.0.x - 5.1
The fields in the intrusion event (IPv4) record are shaded in the following graphic. The record type is 207.
You request intrusion event records by setting the intrusion event flag or the extended requests flag in the request message. See Request Flags and Submitting Extended Requests.
For version 5.0.x - 5.1 intrusion events, the event ID, the managed device ID, and the event second form a unique identifier.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
||||||||||||||||||||||||||||||||
The Intrusion Event (IPv4) Record Fields describes each intrusion event record data field.
Contains the identification number of the detecting managed device. You can obtain the managed device name by requesting Version 3 or 4 metadata. See Managed Device Record Metadata for more information. |
||
UNIX timestamp (seconds since 01/01/1970) of the event’s detection. |
||
Microsecond (one millionth of a second) increment of the timestamp of the event’s detection. |
||
Identification number of the Sourcefire 3D System preprocessor that generated the event. |
||
Identification number of the priority associated with the event. |
||
Destination IPv4 address used in the event, in address octets. |
||
The source port number if the event protocol type is TCP or UDP. |
||
The destination port number if the event protocol type is TCP or UDP. |
||
Impact flag value of the event. The low-order eight bits indicate the impact level. Values are:
The following impact level values map to specific priorities on the Defense Center. An X indicates the value can be 0 or 1: |
||
A policy ID number that acts as a unique identifier for the intrusion policy. |
||
The internal identification number for the user, if applicable. |
||
The internal identification number for the web application, if applicable. |
||
The internal identification number for the client application, if applicable. |
||
The internal identification number for the application protocol, if applicable. |
||
A rule ID number that acts as a unique identifier for the access control rule. |
||
A policy ID number that acts as a unique identifier for the access control policy. |
||
An interface ID number that acts as a unique identifier for the ingress interface. |
||
An interface ID number that acts as a unique identifier for the egress interface. |
||
A zone ID number that acts as a unique identifier for the ingress security zone. |
||
A zone ID number that acts as a unique identifier for the egress security zone. |
Intrusion Event (IPv6) Record 5.0.x - 5.1
The fields in the intrusion event (IPv6) record are shaded in the following graphic. The record type is 208.
You request intrusion event records by setting the intrusion event flag or the extended requests flag in the request message. See Request Flags and Submitting Extended Requests.
For version 5.0.x - 5.1 intrusion events, the event ID, the managed device ID, and the event second form a unique identifier.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
||||||||||||||||||||||||||||||||
The Intrusion Event (IPv6) Record Fields describes each intrusion event record data field.
Contains the identification number of the detecting device. You can obtain the managed device name by requesting Version 3 or 4 metadata. See Managed Device Record Metadata for more information. |
||
UNIX timestamp (seconds since 01/01/1970) of the event’s detection. |
||
Microsecond (one millionth of a second) increment of the timestamp of the event’s detection. |
||
Identification number of the Sourcefire 3D System preprocessor that generated the event. |
||
Identification number of the priority associated with the event. |
||
Destination IPv6 address used in the event, in address octets. |
||
The source port number if the event protocol type is TCP or UDP. If the protocol type is ICMP, this indicates the ICMP type. |
||
The destination port number if the event protocol type is TCP or UDP. If the protocol type is ICMP, this indicates the ICMP code. |
||
Impact flag value of the event. The low-order eight bits indicate the impact level. Values are:
The following impact level values map to specific priorities on the Defense Center. An X indicates the value can be 0 or 1: |
||
Indicates the ID of the VLAN where the packet originated. (Applies to 4.9+ events only.) |
||
A policy ID number that acts as a unique identifier for the intrusion policy. |
||
The internal identification number for the user, if applicable. |
||
The internal identification number for the web application, if applicable. |
||
The internal identification number for the client application, if applicable. |
||
The internal identification number for the application protocol, if applicable. |
||
A rule ID number that acts as a unique identifier for the access control rule. |
||
A policy ID number that acts as a unique identifier for the access control policy. |
||
An interface ID number that acts as a unique identifier for the ingress interface. |
||
An interface ID number that acts as a unique identifier for the egress interface. |
||
A zone ID number that acts as a unique identifier for the ingress security zone. |
||
A zone ID number that acts as a unique identifier for the egress security zone. |
Intrusion Event Record 5.2.x
The fields in the intrusion event record are shaded in the following graphic. The record type is 400 and the block type is 34.
You can request 5.2.x intrusion events from eStreamer only by extended request, for which you request event type code 12 and version code 5 in the Stream Request message (see Submitting Extended Requests for information about submitting extended requests).
For version 5.2.x intrusion events, the event ID, the managed device ID, and the event second form a unique identifier. The connection second, connection instance, and connection counter together form a unique identifier for the connection event associated with the intrusion event.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
||||||||||||||||||||||||||||||||
| Destination IP Address, continued |
||||||||||||||||||||||||||||||||
The Malware Event Data Block for 5.2.x Fields describes each intrusion event record data field.
Initiates an Intrusion Event data block. This value is always 34. |
||
Total number of bytes in the Intrusion Event data block, including eight bytes for the Intrusion Event block type and length fields, plus the number of bytes of data that follows. |
||
Contains the identification number of the detecting managed device. You can obtain the managed device name by requesting Version 3 or 4 metadata. See Managed Device Record Metadata for more information. |
||
UNIX timestamp (seconds since 01/01/1970) of the event’s detection. |
||
Microsecond (one millionth of a second) increment of the timestamp of the event’s detection. |
||
Identification number of the Sourcefire 3D System preprocessor that generated the event. |
||
Identification number of the priority associated with the event. |
||
The source port number if the event protocol type is TCP or UDP, or the ICMP type if the event is caused by ICMP traffic. |
||
The destination port number if the event protocol type is TCP or UDP, or the ICMP code if the event is caused by ICMP traffic. |
||
Impact flag value of the event. The low-order eight bits indicate the impact level. Values are:
The following impact level values map to specific priorities on the Defense Center. An X indicates the value can be 0 or 1: |
||
A policy ID number that acts as a unique identifier for the intrusion policy. |
||
The internal identification number for the user, if applicable. |
||
The internal identification number for the web application, if applicable. |
||
The internal identification number for the client application, if applicable. |
||
The internal identification number for the application protocol, if applicable. |
||
A rule ID number that acts as a unique identifier for the access control rule. |
||
A policy ID number that acts as a unique identifier for the access control policy. |
||
An interface ID number that acts as a unique identifier for the ingress interface. |
||
An interface ID number that acts as a unique identifier for the egress interface. |
||
A zone ID number that acts as a unique identifier for the ingress security zone. |
||
A zone ID number that acts as a unique identifier for the egress security zone. |
||
UNIX timestamp (seconds since 01/01/1970) of the connection event associated with the intrusion event. |
||
Numerical ID of the Snort instance on the managed device that generated the connection event. |
||
Value used to distinguish between connection events that happen during the same second. |
||
Intrusion Event Record 5.1.1.x
The fields in the intrusion event record are shaded in the following graphic. The record type is 400 and the block type is 25.
You can request 5.1.1.x intrusion events from eStreamer only by extended request, for which you request event type code 12 and version code 4 in the Stream Request message (see Submitting Extended Requests for information about submitting extended requests).
For version 5.1.1.x intrusion events, the event ID, the managed device ID, and the event second form a unique identifier. The connection second, connection instance, and connection counter together form a unique identifier for the connection event associated with the intrusion event.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
||||||||||||||||||||||||||||||||
| Destination IP Address, continued |
||||||||||||||||||||||||||||||||
The Intrusion Event Record 5.1.1 Fields describes each intrusion event record data field.
Initiates an Intrusion Event data block. This value is always 25. |
||
Total number of bytes in the Intrusion Event data block, including eight bytes for the Intrusion Event block type and length fields, plus the number of bytes of data that follows. |
||
Contains the identification number of the detecting managed device. You can obtain the managed device name by requesting Version 3 or 4 metadata. See Managed Device Record Metadata for more information. |
||
UNIX timestamp (seconds since 01/01/1970) of the event’s detection. |
||
Microsecond (one millionth of a second) increment of the timestamp of the event’s detection. |
||
Identification number of the Sourcefire 3D System preprocessor that generated the event. |
||
Identification number of the priority associated with the event. |
||
The source port number if the event protocol type is TCP or UDP, or the ICMP type if the event is caused by ICMP traffic. |
||
The destination port number if the event protocol type is TCP or UDP, or the ICMP code if the event is caused by ICMP traffic. |
||
Impact flag value of the event. The low-order eight bits indicate the impact level. Values are:
The following impact level values map to specific priorities on the Defense Center. An X indicates the value can be 0 or 1: |
||
A policy ID number that acts as a unique identifier for the intrusion policy. |
||
The internal identification number for the user, if applicable. |
||
The internal identification number for the web application, if applicable. |
||
The internal identification number for the client application, if applicable. |
||
The internal identification number for the application protocol, if applicable. |
||
A rule ID number that acts as a unique identifier for the access control rule. |
||
A policy ID number that acts as a unique identifier for the access control policy. |
||
An interface ID number that acts as a unique identifier for the ingress interface. |
||
An interface ID number that acts as a unique identifier for the egress interface. |
||
A zone ID number that acts as a unique identifier for the ingress security zone. |
||
A zone ID number that acts as a unique identifier for the egress security zone. |
||
UNIX timestamp (seconds since 01/01/1970) of the connection event associated with the intrusion event. |
||
Numerical ID of the Snort instance on the managed device that generated the connection event. |
||
Value used to distinguish between connection events that happen during the same second. |
Legacy Malware Event Data Structures
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#66120">Malware Event Data Block 5.1
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#94677">Malware Event Data Block 5.1.1.x
Malware Event Data Block 5.2.x
Malware Event Data Block 5.1
The eStreamer service uses the malware event data block to store information on malware events. These events contain information on malware detected or quarantined within a cloud, the detection method, and hosts and users affected by the malware. The malware event data block has a block type of 16 in the series 2 group of blocks. You request the event as part of the malware event record by setting the malware event flag—bit 30 in the request flags field—in the request message with an event version of 1 and an event code of 101.
The following graphic shows the structure of the malware event data block:
The Malware Event Data Block Fields describes the fields in the malware event data block.
Malware Event Data Block 5.1.1.x
The eStreamer service uses the malware event data block to store information on malware events. These events contain information on malware detected or quarantined within a cloud, the detection method, and hosts and users affected by the malware. The malware event data block has a block type of 24 in the series 2 group of blocks. You request the event as part of the malware event record by setting the malware event flag—bit 30 in the request flags field—in the request message with an event version of 2 and an event code of 101.
The following graphic shows the structure of the malware event data block:
The Malware Event Data Block for 5.1.1.x Fields describes the fields in the malware event data block.
Malware Event Data Block 5.2.x
The eStreamer service uses the malware event data block to store information on malware events. These events contain information on malware detected or quarantined within a cloud, the detection method, and hosts and users affected by the malware. The malware event data block has a block type of 33 in the series 2 group of blocks. You request the event as part of the malware event record by setting the malware event flag—bit 30 in the request flags field—in the request message with an event version of 3 and an event code of 101.
The following graphic shows the structure of the malware event data block:
The Malware Event Data Block for 5.2.x Fields describes the fields in the malware event data block.
Legacy Discovery Data Structures
Legacy Discovery Event Header
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#32203">Legacy Server Data Blocks
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#85326">Legacy Client Application Data Blocks
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#63275">Legacy Scan Result Data Blocks
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#92108">Legacy Vulnerability Blocks
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#61295">Legacy Host Profile Data Blocks
Legacy OS Fingerprint Data Blocks
Legacy Discovery Event Header
Discovery Event Header 4.8.0.2-5.1.1.x
Discovery and connection event messages contain a discovery event header. It conveys the type and subtype of the event, the time the event occurred, the device on which the event occurred, and the structure of the event data in the message. This header is followed by the actual host discovery, user, or connection event data. The structures associated with the different event type/subtype values are described in Host Discovery Structures by Event Type.
The event type and event subtype fields of the discovery event header identify the structure of the transmitted event message. Once the structure of the event data block is determined, your program can parse the message appropriately.
The shaded rows in the following diagram illustrate the format of the discovery event header.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
||||||||||||||||||||||||||||||||
The Discovery Event Header Fields describes the discovery event header.
ID number of the device that generated the discovery event. You can obtain the metadata for the device by requesting Version 3 and 4 metadata. See Managed Device Record Metadata for more information. |
||
UNIX timestamp (seconds since 01/01/1970) that the system generated the event. |
||
Microsecond (one millionth of a second) increment that the system generated the event. |
||
Event type (1000 for new events, 1001 for change events, 1002 for user input events, 1050 for full host profile). See Host Discovery Structures by Event Type for a list of available event types. |
||
Event subtype. See Host Discovery Structures by Event Type for a list of available event subtypes. |
||
Serial file number. This field is for Sourcefire internal use and can be disregarded. |
||
Event’s position in the serial file. This field is for Sourcefire internal use and can be disregarded. |
Legacy Server Data Blocks
For more information, see the following sections:
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#63182">Host Server Data Block for Version 4.9.0.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#99496">Web Application Data Block for 4.9.1 - 4.10.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#98018">Host Server Data Block for 4.9.1.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#67253">Full Server Data Block for 4.9.0.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#63363">Full Server Data Block for 4.9.1.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#27596">Server Information Data Block for 4.9.1 and Earlier
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#81706">Attribute Address Data Block for 4.5.x - 5.1.1.x
Host Server Data Block for Version 4.9.0.x
The Host Server data block conveys information about servers identified by the system, including the server port, the frequency of use, last use, and confidence, as well as lists of server information blocks and sub-server blocks for the host for the event. Host Server data blocks are contained in messages for new TCP and UDP servers and changes to TCP and UDP servers.
Server data for this data block for 4.9.0.x is encapsulated in lists of server information blocks rather than through individual fields, allowing for multiple servers.
The Host Server data block has a block type of 89.
An asterisk(*) next to a data block name in the following diagram indicates that multiple instances of the data block may occur.
The following diagram shows the format of the Host Server data block:
The Host Server Data 4.9.0.x Fields describes the fields of the Host Server data block:
Initiates a Host Server data block. This value is always 89. |
||
Total number of bytes in the Host Server data block, including the eight bytes in the Host Server block type and length fields plus the number of bytes of data that follows. |
||
UNIX timestamp that represents the last time the system detected the server in use. |
||
Initiates a Generic List data block. This value is always 31. |
||
Number of bytes in the Generic List block and encapsulated data blocks. This number includes the eight bytes of the generic list block header fields plus the number of bytes in all of the encapsulated data blocks. |
||
Encapsulated Server Information data blocks up to the maximum number of bytes in the list block length. |
||
Initiates a list of Sub-Server data blocks. This value is always 11. |
||
Number of bytes in the List data block, including eight bytes for the list block type and length fields plus the number of bytes in the encapsulated Sub-Server data blocks that follow. |
||
Initiates the first Sub-Server data block. This data block can be followed by other Sub-Server data blocks up to the limit defined in the list block length field. |
||
Total number of bytes in each Sub-Server data block, including the eight bytes in the Sub-Server block type and length fields plus the number of bytes of data that follows. |
||
Sub-server data as documented in Sub-Server Data Block. |
||
Web Application Data Block for 4.9.1 - 4.10.x
The web application data block has a block type of 97. Identity data blocks are used in Host Server, Full Server, Host Client Application, and Connection Statistics data blocks. The data block describes the web application type and application ID from HTTP client requests detected by the system.
For more information on the data blocks that incorporate this data block, see the following sections:
Host Server Data Block for Version 4.9.0.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#67253">Full Server Data Block for 4.9.0.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#49325">Host Client Application Data Block for 3.5 - 4.9.0.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#66412">Connection Statistics Data Block for 4.7 - 4.9.0.x
The following diagram shows the format of a Web Application data block 4.9.1+.
The Web Application Data Block Fields describes the fields of the Web Application data block:
Host Server Data Block for 4.9.1.x
The Host Server data block conveys information about servers identified by the system, including the server port, the frequency of use, last use, and confidence, as well as lists of server information blocks and Sub-Server blocks for the host for the event. Host Server data blocks are contained in messages for new TCP and UDP servers and changes to TCP and UDP servers. For more information, see Server Messages. Starting in 4.9.1, the data block includes a list of Web Application data blocks. Note that the Host Server data block has a block type of 98.
An asterisk(*) next to a data block name in the following diagram indicates that multiple instances of the data block may occur.
The following diagram shows the format of the Host Server data block:
The Host Server Data 4.9.0.x Fields describes the fields of the Host Server data block:
Initiates a Host Server data block. This value is always 98. |
||
Total number of bytes in the Host Server data block, including the eight bytes in the Host Server block type and length fields, plus the number of bytes of data that follows. |
||
UNIX timestamp that represents the last time the system detected the server in use. |
||
Initiates a Generic List data block. This value is always 31. |
||
Number of bytes in the Generic List block and encapsulated data blocks. This number includes the eight bytes of the generic list block header fields, plus the number of bytes in all of the encapsulated data blocks. |
||
Encapsulated Server Information data blocks up to the maximum number of bytes in the list block length. |
||
Initiates a list of Sub-Server data blocks. This value is always 11. |
||
Number of bytes in the List data block, including eight bytes for the list block type and length fields, plus the number of bytes in the encapsulated Sub-Server data blocks that follow. |
||
Initiates the first Sub-Server data block. This data block can be followed by other Sub-Server data blocks up to the limit defined in the list block length field. |
||
Total number of bytes in each Sub-Server data block, including the eight bytes in the Sub-Server block type and length fields, plus the number of bytes of data that follows. |
||
Sub-server data as documented in Sub-Server Data Block. |
||
Initiates a Generic List data block. This value is always 31. |
||
Number of bytes in the Generic List block and encapsulated Web Application data blocks. This number includes the eight bytes of the generic list block header fields, plus the number of bytes in all of the encapsulated Web Application data blocks. |
||
Encapsulated Web Application data blocks up to the maximum number of bytes in the list block length. |
Full Server Data Block for 4.9.0.x
The Full Server data block conveys information about a server, including the server port, the frequency of use and most recent update, server ID, vendor, product, and version, confidence of data accuracy, Sourcefire and third-party vulnerabilities related to that server for the host for the event, and source type and source identification. A Full Server data block for each TCP and UDP server on the host in the event is included in a list in the Full Host Profile data block. Changes for the 4.9.0.x data block include new source type and source ID fields and a 32-bit server ID field. The Full Server data block has a block type of 90.
An asterisk(*) next to a data block name in the following diagram indicates that multiple instances of the data block may occur.
The following diagram shows the format of the Full Server data block:
:
| (FireSIGHT for Third Party) Host Vulnerability Data Blocks*... |
||||||||||||||||||||||||||||||||
The Full Server Data Block 4.9.0.x Fields describes the components of the Full Server data block.
Initiates a Full Server data block. This value is always 90. |
||
Total number of bytes in the Full Server data block, including eight bytes for the full server block type and length fields plus the number of bytes of full server data that follows. |
||
Initiates a Generic List data block comprising server information data blocks conveying server data added by the system. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated server information data blocks. |
||
Server information data blocks containing information about servers on a host identified by the system. See Server Information Data Block for 4.9.1 and Earlier for a description of this data block. |
||
Initiates a Generic List data block comprising server information data blocks conveying server data added by a user. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated server information data blocks. |
||
Server information data blocks containing information about servers on a host added by a user. See Server Information Data Block for 4.9.1 and Earlier for a description of this data block. |
||
Initiates a Generic List data block comprising server information data blocks conveying server data added by a scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated server information data blocks. |
||
Server information data blocks containing information about servers on a host added by a scanner. See Server Information Data Block for 4.9.1 and Earlier for a description of this data block. |
||
Initiates a Generic List data block comprising server information data blocks conveying server data added by an application. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated server information data blocks. |
||
Server information data blocks containing information about servers on a host added by an application. See Server Information Data Block for 4.9.1 and Earlier for a description of this data block. |
||
Percentage of confidence of the system in its correct identification of the server. |
||
Initiates the BLOB data block, that contains banner data. This value is always 10. |
||
Total number of bytes in the BLOB data block, including eight bytes for the block type and length fields plus the number of bytes in the banner. |
||
First N bytes of the packet involved in the server event, where N is equal to or less than 256. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying VDB host vulnerability data for vulnerabilities identified by a third party scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Host Vulnerability data blocks. |
||
Host Vulnerability data blocks containing information about host vulnerabilities identified by Sourcefire. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying host vulnerability data generated by a third party scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Host Vulnerability data blocks. |
||
Host Vulnerability data blocks containing information about VDB vulnerability data for vulnerabilities identified by a third party scanner. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third party host vulnerability data generated by a third party scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Host Vulnerability data blocks. |
||
Host Vulnerability data blocks containing the original third party vulnerability data for vulnerabilities identified by a third party scanner. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a List data block comprising Full Sub-Server data blocks conveying server subtype data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields plus all encapsulated Server data blocks. This field is followed by zero or more Full Sub-Server data blocks. |
||
Initiates the first Full Sub-Server data block. This data block can be followed by other Full Sub-Server data blocks up to the limit defined in the list block length field. |
||
Total number of bytes in each Full Sub-Server data block, including the eight bytes in the Full Sub-Server block type and length fields plus the number of bytes of data that follows. |
||
Full Sub-Server data blocks containing sub-server information for the server. See Full Server Data Block for 4.9.1.x for a description of this data block. |
Full Server Data Block for 4.9.1.x
The Full Server data block conveys information about a server, including the server port, the frequency of use and most recent update, server ID, vendor, product, and version, confidence of data accuracy, Sourcefire and third-party vulnerabilities related to that server for the host for the event, and source type and source identification. A Full Server data block for each TCP and UDP server on the host in the event is included in a list in the Full Host Profile data block. The 4.9.1+ data block includes a new list of Web Application data blocks. The Full Server data block has a block type of 99.
An asterisk(*) next to a data block name in the following diagram indicates that multiple instances of the data block may occur.
The following diagram shows the format of the Full Server data block:
::
| (FireSIGHT for Third Party) Host Vulnerability Data Blocks*... |
||||||||||||||||||||||||||||||||
The Full Server Data Block 4.9.0.x Fields describes the components of the Full Server data block.
Initiates a Full Server data block. This value is always 99. |
||
Total number of bytes in the Full Server data block, including eight bytes for the full server block type and length fields, plus the number of bytes of full server data that follows. |
||
Initiates a Generic List data block comprising server information data blocks conveying server data added by the system. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated server information data blocks. |
||
Server information data blocks containing information about servers identified on a host. See Server Information Data Block for 4.9.1 and Earlier for a description of this data block. |
||
Initiates a Generic List data block comprising server information data blocks conveying server data added by a user. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated server information data blocks. |
||
Server information data blocks containing information about servers on a host added by a user. See Server Information Data Block for 4.9.1 and Earlier for a description of this data block. |
||
Initiates a Generic List data block comprising server information data blocks conveying server data added by a scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated server information data blocks. |
||
Server information data blocks containing information about servers on a host added by a scanner. See Server Information Data Block for 4.9.1 and Earlier for a description of this data block. |
||
Initiates a Generic List data block comprising server information data blocks conveying server data added by an application. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated server information data blocks. |
||
Server information data blocks containing information about servers on a host added by an application. See Server Information Data Block for 4.9.1 and Earlier for a description of this data block. |
||
Percentage of confidence of the system in its correct identification of the server. |
||
Initiates the BLOB data block, that contains banner data. This value is always 10. |
||
Total number of bytes in the BLOB data block, including eight bytes for the block type and length fields, plus the number of bytes in the banner. |
||
First N bytes of the packet involved in the server event, where N is equal to or less than 256. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying VDB host vulnerability data for vulnerabilities identified by a third party scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Host Vulnerability data blocks. |
||
Host Vulnerability data blocks containing information about host vulnerabilities identified by Sourcefire. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third party host vulnerability data generated by a third party scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Host Vulnerability data blocks. |
||
Host Vulnerability data blocks containing information about VDB vulnerability data for vulnerabilities identified by a third party scanner. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying vulnerability data generated by a third party scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Host Vulnerability data blocks. |
||
Host Vulnerability data blocks containing the original third party vulnerability data for vulnerabilities identified by a third party scanner. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a List data block comprising Full Server Subtype data blocks conveying sub-server data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Server data blocks. This field is followed by zero or more Full Sub-Server data blocks. |
||
Initiates the first Full Sub-Server data block. This data block can be followed by other Full Sub-Server data blocks up to the limit defined in the list block length field. |
||
Total number of bytes in each Sub-Server data block, including the eight bytes in the Full Sub-Server block type and length fields, plus the number of bytes of data that follows. |
||
Full Sub-Server data blocks containing sub-servers for the server. See Full Server Data Block for 4.9.1.x for a description of this data block. |
||
Initiates a Generic List data block. This value is always 31. |
||
Number of bytes in the Generic List block and encapsulated Web Application data blocks. This number includes the eight bytes of the generic list block header fields, plus the number of bytes in all of the encapsulated Web Application data blocks. |
||
Encapsulated Web Application data blocks up to the maximum number of bytes in the list block length. |
Server Information Data Block for 4.9.1 and Earlier
The Server Information data block conveys information about a server, including the server ID, server vendor and version, and source information. The Server Information data block has a block type of 88. Server information data blocks are conveyed in lists within host server and full server data blocks. For more information see Host Server Data Block for Version 4.9.0.x and Full Server Data Block for 4.9.0.x.
The following diagram shows the format of the Server Information data block:
The Server Information Data Block 4.9.1 and Earlier Fields describes the components of the Server Information data block.
Attribute Address Data Block for 4.5.x - 5.1.1.x
The Attribute Address data block contains an attribute list item and is used within an Attribute Definition data block. It has a block type of 38.
The following diagram shows the basic structure of an Attribute Address data block:
The Attribute Address Data Block Fields describes the fields of the Attribute Address data block.
Legacy Client Application Data Blocks
For more information, see the following sections:
Host Client Application Data Block for 3.5 - 4.9.0.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#92433">Host Client Application Data Block for 4.9.1 - 4.10.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#61869">User Client Application Data Block for 5.1 and earlier
Host Client Application Data Block for 3.5 - 4.9.0.x
The Client Application data block for 3.5 - 4.9.0.x describes a client application and is used within legacy New Client Application events (event type 1001, subtype 7) and Client Application Timeout events (event type 1001, subtype 20). It has a block type of 42.
The following diagram shows the basic structure of a Client Application data block:
The Client Application Data Block 3.5 - 4.9.0.x Fields describes the fields of the Client Application data block.
Host Client Application Data Block for 4.9.1 - 4.10.x
The Client Application data block for 4.9.1 - 4.10.x describes a client application and is used within New Client Application events (event type 1001, subtype 7) and Client Application Timeout events (event type 1001, subtype 20). The Client Application data block for 4.9.1 - 4.10.x has a block type of 100. Its successor, introduced for 5.0+, has a block type of 122.
The following diagram shows the basic structure of a Client Application data block:
The Client Application Data Block for 4.9.1 - 4.10.x Fields describes the fields of the Client Application data block.
Initiates a Host Client Application data block. This value is always 100. |
||
Number of bytes in the Client Application data block, including eight bytes for the client application block type and length, plus the number of bytes in the client application data that follows. |
||
Number of times the system has detected the client application in use. |
||
UNIX timestamp that represents the last time the system detected the client in use. |
||
Identification number of the detected client application type, if applicable. |
||
Identification number of the detected client application, if applicable. |
||
Initiates a String data block for the client application version. This value is always 0. |
||
Number of bytes in the String data block for the client application name, including eight bytes for the string block type and length, plus the number of bytes in the client application version. |
||
Initiates a Generic List data block. This value is always 31. |
||
Number of bytes in the Generic List block and encapsulated Web Application data blocks. This number includes the eight bytes of the generic list block header fields, plus the number of bytes in all of the encapsulated Web Application data blocks. |
||
Encapsulated Web Application data blocks up to the maximum number of bytes in the list block length. For information on the encapsulated Web Application data blocks, see Web Application Data Block for 4.9.1 - 4.10.x. |
User Client Application Data Block for 5.1 and earlier
The User Client Application data block contains information about the source of the client application data, the identification number for the user who added the data, and the lists of IP address range data blocks. The User Client Application data block has a block type of 59.
The following diagram shows the basic structure of a User Client Application data block:
The User Client Application Data Block Fields describes the fields of the User Client Application data block.
Initiates a User Client Application data block. This value is always 59. |
||
Total number of bytes in the User Client Application data block, including eight bytes for the user client application block type and length fields, plus the number of bytes of user client application data that follows. |
||
Initiates a Generic List data block comprising IP Range Specification data blocks conveying IP address range data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated IP Range Specification data blocks. |
||
IP Range Specification data blocks containing information about the IP address ranges for the user input. See User Server Data Block for a description of this data block. |
||
The internal identification number for the application protocol, if applicable. |
||
The internal identification number of the detected client application, if applicable. |
||
Initiates a String data block that contains the client application version. This value is always 0. |
||
Number of bytes in the client application version String data block, including the string block type and length fields, plus the number of bytes in the version. |
||
Legacy Scan Result Data Blocks
For more information, see the following sections:
Generic Scan Results Data Block for 4.9.1.x and earlier
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#12259">Scan Result Data Block for 4.6.1 - 4.9.1.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#97453">Scan Result Data Block 4.10.0 - 5.1.1.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#38218">Scan Vulnerability Data Block for 4.9 - 4.9.1.x
User Product Data Block for 4.10.x, 5.0 - 5.0.x
Generic Scan Results Data Block for 4.9.1.x and earlier
The Generic Scan Results data block contains scan results and is used in the Scan Result Data Block for 4.6.1 - 4.9.1.x. The Generic Scan Results data block has a block type of 71.
The following diagram shows the basic structure of a Generic Scan Results data block:
The Generic Scan Result Data Block for 4.9.1.x and earlier Fields describes the fields of the Generic Scan Results data block.
Scan Result Data Block for 4.6.1 - 4.9.1.x
The Scan Result data block describes a vulnerability and is used within Add Scan Result events (event type 1002, subtype 11). The Scan Result data block has a block type of 72.
The following diagram shows the format of a Scan Result data block:
The Scan Result Data Block for 4.6.1 - 4.9.1.x Fields describes the fields of the Scan Result data block.
Initiates a Scan Result data block. This value is always 72. |
||
Number of bytes in the Scan Vulnerability data block, including eight bytes for the scan vulnerability block type and length fields, plus the number of bytes of scan vulnerability data that follows. |
||
Contains the user identification number for the user who imported the scan result or ran the scan that produced the scan result. |
||
Indicates how the results were added to the sensor. Values include: |
||
IP address of the host affected by the vulnerabilities in the result, in IP address octets. |
||
Port used by the sub-server affected by the vulnerabilities in the results. |
||
Initiates a List data block comprising Scan Vulnerability data blocks conveying transport protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Scan Vulnerability data blocks. This field is followed by zero or more Scan Vulnerability data blocks. |
||
Initiates a Scan Vulnerability data block describing a vulnerability detected during a scan. This value is always 44. |
||
Number of bytes in the Scan Vulnerability data block, including eight bytes for the scan vulnerability block type and length fields, plus the number of bytes in the scan vulnerability data that follows. |
||
Initiates a List data block comprising Scan Vulnerability data blocks conveying transport scan vulnerability data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Scan Vulnerability data blocks. This field is followed by zero or more Scan Vulnerability data blocks. |
||
Initiates a Generic Scan Results data block describing server and operating system data detected during a scan. This value is always 71. |
||
Number of bytes in the Generic Scan Results data block, including eight bytes for the generic scan results block type and length fields, plus the number of bytes in the scan result data that follows. |
||
Initiates a Generic List data block comprising User Product data blocks conveying host input data from a third party application. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated User Product data blocks. |
||
User Product data blocks with a block type of 65 containing host input data. See User Product Data Block for 4.10.x, 5.0 - 5.0.x for a description of this data block. |
Scan Result Data Block 4.10.0 - 5.1.1.x
The Scan Result data block describes a vulnerability and is used within Add Scan Result events (event type 1002, subtype 11). The Scan Result data block has a block type of 102.
The following diagram shows the format of a Scan Result data block:
The Scan Result Data Block Fields describes the fields of the Scan Result data block.
Initiates a Scan Result data block. This value is always 102. |
||
Number of bytes in the Scan Vulnerability data block, including eight bytes for the scan vulnerability block type and length fields, plus the number of bytes of scan vulnerability data that follows. |
||
Contains the user identification number for the user who imported the scan result or ran the scan that produced the scan result. |
||
IP address of the host affected by the vulnerabilities in the result, in IP address octets. |
||
Port used by the sub-server affected by the vulnerabilities in the results. |
||
Initiates a List data block comprising Scan Vulnerability data blocks conveying transport Scan Vulnerability data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Scan Vulnerability data blocks. This field is followed by zero or more Scan Vulnerability data blocks. |
||
Initiates a Scan Vulnerability data block describing a vulnerability detected during a scan. This value is always 109. |
||
Number of bytes in the Scan Vulnerability data block, including eight bytes for the scan vulnerability block type and length fields, plus the number of bytes in the scan vulnerability data that follows. |
||
Initiates a List data block comprising Scan Vulnerability data blocks conveying transport Scan Vulnerability data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Scan Vulnerability data blocks. This field is followed by zero or more Scan Vulnerability data blocks. |
||
Initiates a Generic Scan Results data block describing server and operating system data detected during a scan. This value is always 108. |
||
Number of bytes in the Generic Scan Results data block, including eight bytes for the generic scan results block type and length fields, plus the number of bytes in the scan result data that follows. |
||
Initiates a Generic List data block comprising User Product data blocks conveying host input data from a third party application. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated User Product data blocks. |
||
User Product data blocks containing host input data. See User Product Data Block 5.1+ for a description of this data block. |
Scan Vulnerability Data Block for 4.9 - 4.9.1.x
The Scan Vulnerability data block describes a vulnerability and is used within Scan Result data blocks, that in turn are used in Add Scan Result events (event type 1002, subtype 11). For more information, see Scan Result Data Block for 4.6.1 - 4.9.1.x and Add Scan Result Messages. The Scan Vulnerability data block has a block type of 86.
The following diagram shows the format of a Scan Vulnerability data block:
The Scan Vulnerability Data Block for 4.9 - 4.9.1.x Fields describes the fields of the Scan Vulnerability data block.
User Product Data Block for 4.10.x, 5.0 - 5.0.x
The User Product data block conveys host input data imported from a third party application, including third party application string mappings. This data block is used in Scan Result Data Block 5.2+. The User Product data block has a block type of 65 for 4.10.x, and a block type of 118 for 5.0 - 5.0.x. The block types have the same structure.
An asterisk(*) next to a data block name in the following diagram indicates that multiple instances of the data block may occur.
The following diagram shows the format of the User Product data block:
The User Product Data Block Fields for 4.10.x, 5.0-5.0.x describes the components of the User Product data block.
Initiates a User Product data block. This value is 65 for version 4.10.x and 118 for version 5.0 - 5.0.x. |
||
Total number of bytes in the User Product data block, including eight bytes for the user product block type and length fields, plus the number of bytes in the user product data that follows. |
||
Initiates a Generic List data block comprising IP Range Specification data blocks conveying IP address range data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated IP Range Specification data blocks. |
||
IP Range Specification data blocks containing information about the IP address ranges for the user input. See IP Address Range Data Block for 5.2+ for a description of this data block. |
||
Indicates whether the user OS definition was deleted from the host: |
||
Initiates a String data block containing the custom vendor name specified in the user input. This value is always 0. |
||
Number of bytes in the custom vendor String data block, including eight bytes for the block type and length fields, plus the number of bytes in the vendor name. |
||
Initiates a String data block containing the custom product name specified in the user input. This value is always 0. |
||
Number of bytes in the custom product String data block, including eight bytes for the block type and length fields, plus the number of bytes in the product name. |
||
Initiates a String data block containing the custom version specified in the user input. This value is always 0. |
||
Number of bytes in the custom version String data block, including eight bytes for the block type and length fields, plus the number of bytes in the version. |
||
The identifier for a specific revision of a server or operating system in the Sourcefire database. |
||
The Sourcefire application identifier for the application protocol on the host server specified in user input. |
||
The identifier for the vendor of a third party operating system specified when the third party operating system is mapped to a Sourcefire 3D operating system definition. |
||
The product identification string of a third party operating system string specified when the third party operating system string is mapped to a Sourcefire 3D operating system definition. |
||
Initiates a String data block containing the major version number of the Sourcefire 3D operating system definition that a third party operating system string in the user input is mapped to. This value is always 0. |
||
Number of bytes in the major String data block, including eight bytes for the block type and length fields, plus the number of bytes in the version. |
||
Major version of the Sourcefire 3D operating system definition that a third party operating system string is mapped to. |
||
Initiates a String data block containing the minor version number of the Sourcefire 3D operating system definition that a third party operating system string is mapped to. This value is always 0. |
||
Number of bytes in the minor String data block, including eight bytes for the block type and length fields, plus the number of bytes in the version. |
||
Minor version number of the Sourcefire 3D operating system definition that a third party operating system string in the user input is mapped to. |
||
Initiates a String data block containing the revision number of the Sourcefire operating system definition that a third party operating system string in the user input is mapped to. This value is always 0. |
||
Number of bytes in the revision String data block, including eight bytes for the block type and length fields, plus the number of bytes in the revision number. |
||
Revision number of the Sourcefire 3D operating system definition that a third party operating system string in the user input is mapped to. |
||
Initiates a String data block containing the last major version of the Sourcefire 3D operating system definition that a third party operating system string is mapped to. This value is always 0. |
||
Number of bytes in the To Major String data block, including eight bytes for the block type and length fields, plus the number of bytes in the version. |
||
Last version number in a range of major version numbers of the Sourcefire 3D operating system definition that a third party operating system string in the user input is mapped to. |
||
Initiates a String data block containing the last minor version of the Sourcefire 3D operating system definition that a third party operating system string is mapped to. This value is always 0. |
||
Number of bytes in the To Minor String data block, including eight bytes for the block type and length fields, plus the number of bytes in the version. |
||
Last version number in a range of minor version numbers of the Sourcefire 3D operating system definition that a third party operating system string in the user input is mapped to. |
||
Initiates a String data block containing the Last revision number of the Sourcefire 3D operating system definition that a third party operating system string is mapped to. This value is always 0. |
||
Number of bytes in the To Revision String data block, including eight bytes for the block type and length fields, plus the number of bytes in the revision number. |
||
Last revision number in a range of revision numbers of the Sourcefire 3D operating system definitions that a third party operating system string in the user input is mapped to. |
||
Initiates a String data block containing the build number of the Sourcefire 3D operating system that the third party operating system string is mapped. This value is always 0. |
||
Number of bytes in the build String data block, including eight bytes for the block type and length fields, plus the number of bytes in the build number. |
||
Build number of the Sourcefire 3D operating system that the third party operating system string in the user input is mapped to. |
||
Initiates a String data block containing the patch number of the Sourcefire 3D operating system that the third party operating system string is mapped to. This value is always 0. |
||
Number of bytes in the patch String data block, including eight bytes for the block type and length fields, plus the number of bytes in the patch number. |
||
Patch number of the Sourcefire 3D operating system that the third party operating system string in the user input is mapped to. |
||
Initiates a String data block containing the extension number of the Sourcefire 3D operating system that the third party operating system string is mapped. This value is always 0. |
||
Number of bytes in the extension String data block, including eight bytes for the block type and length fields, plus the number of bytes in the extension number. |
||
Extension number of the Sourcefire 3D operating system that the third party operating system string in the user input is mapped to. |
||
Contains the unique identification number for the operating system. |
||
Initiates a Generic List data block comprising Fix List data blocks conveying user input data regarding what fixes have been applied to hosts in the specified IP address ranges. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Fix List data blocks. |
||
Fix List data blocks containing information about fixes applied to the hosts. See Fix List Data Block for a description of this data block. |
Legacy Vulnerability Blocks
See the following sections for more information:
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#44881">User Vulnerability Data Block 4.7 - 4.10.x
User Vulnerability Data Block 4.7 - 4.10.x
The User Vulnerability data block describes a vulnerability and is used within User Vulnerability Change data blocks, which in turn are used in User Set Valid Vulnerabilities events (event type 1002, subtype 1) and User Set Invalid Vulnerabilities events (event type 1002, subtype 2). The User Vulnerability data block has a block type of 79. For more information on User Vulnerability Change data blocks, see User Vulnerability Change Data Block 4.7+.
The following diagram shows the format of a User Vulnerability data block:
The User Vulnerability Data Block Fields describes the fields of the User Vulnerability data block:
Initiates a User Vulnerability data block. This value is always 22. |
||
Number of bytes in the User Vulnerability data block, including eight bytes for the user vulnerability block type and length fields, plus the number of bytes of user vulnerability data that follows. |
||
Initiates a Generic List data block comprising IP Range Specification data blocks conveying IP address range data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated IP Range Specification data blocks. |
||
IP Range Specification data blocks containing information about the IP address ranges for the user input. See IP Address Range Data Block for 5.2+ for a description of this data block. |
||
Contains the unique identification number for the vulnerability. |
||
Number of bytes in the String data block for the vulnerability name, including eight bytes for the string block type and length, plus the number of bytes in the vulnerability name. |
||
Legacy User Login Data Blocks
See the following sections for more information:
User Login Information Data Block for 5.0 - 5.0.2
User Login Information Data Block for 5.0 - 5.0.2
The User Login Information data block is used in User Information Update messages and conveys changes in login information for a detected user. For more information, see User Information Update Message Block.
The User Login Information data block has a block type of 121 for version 5.0 - 5.0.2.
The graphic below shows the format of the User Login Information data block:
The User Login Information Data Block Fields 5.0 - 5.0.2 describes the components of the User Login Information data block.
Legacy Host Profile Data Blocks
See the following sections for more information:
Host Profile Data Block for 4.9.x - 5.0.2
Host Profile Data Block for 4.9.x - 5.0.2
The following diagram shows the format of a Host Profile data block in 4.9 to 5.0.2. The Host Profile data block also does not include a host criticality value, but does include a VLAN presence indicator. In addition, a Host Profile data block can convey a NetBIOS name for the host. This Host Profile data block has a block type of 91.
An asterisk(*) next to a block type field in the following diagram indicates the message may contain zero or more instances of the series 1 data block.
The Host Profile Data Block for 4.9 - 5.0.2 Fields describes the fields of the host profile data block returned by version 4.9 to version 5.0.2.
Initiates the Host Profile data block for 4.9 to 5.0.2. This data block has a block type of 91. |
||
Number of bytes in the Host Profile data block, including eight bytes for the host profile block type and length fields, plus the number of bytes included in the host profile data that follows. |
||
IP address of the host described in the profile, in IP address octets. |
||
Indicates whether the host is in the primary or secondary network of the device that detected it: |
||
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a server fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Server Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a server fingerprint. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a client fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Client Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a client fingerprint. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using an SMB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (SMB Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using an SMB fingerprint. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a DHCP fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (DHCP Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a DHCP fingerprint. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a List data block comprising Server data blocks conveying TCP server data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Server data blocks. |
||
Number of bytes in the Server data block, including eight bytes for the server block type and length fields, plus the number of bytes of TCP server data that follows. |
||
Data fields describing a TCP server, as documented in Host Server Data Block for Version 4.9.0.x. |
||
Initiates a List data block comprising Server data blocks conveying UDP server data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Server data blocks. |
||
Initiates a Server data block describing a UDP server. This value is always 89. |
||
Number of bytes in the Server data block, including eight bytes for the server block type and length fields, plus the number of bytes of UDP server data that follows. |
||
Data fields describing a UDP server, as documented in Host Server Data Block for Version 4.9.0.x. |
||
Initiates a List data block comprising Protocol data blocks conveying network protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Protocol data blocks. This field is followed by zero or more Protocol data blocks. |
||
Initiates a Protocol data block describing a network protocol. This value is always 4. |
||
Number of bytes in the Protocol data block, including eight bytes for the protocol block type and length fields, plus the number of bytes in the protocol data that follows. |
||
Data field containing a network protocol number, as documented in Protocol Data Block. |
||
Initiates a List data block comprising Protocol data blocks conveying transport protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Protocol data blocks. This field is followed by zero or more transport protocol data blocks. |
||
Initiates a Protocol data block describing a transport protocol. This value is always 4. |
||
Number of bytes in the protocol data block, including eight bytes for the protocol block type and length, plus the number of bytes in the protocol data that follows. |
||
Data field containing a transport protocol number, as documented in Protocol Data Block. |
||
Initiates a List data block comprising MAC Address data blocks. This value is always 11. |
||
Number of bytes in the list, including the list header and all encapsulated MAC Address data blocks. |
||
Initiates a Host MAC Address data block. This value is always 95. |
||
Number of bytes in the Host MAC Address data block, including eight bytes for the Host MAC address block type and length fields, plus the number of bytes in the Host MAC address data that follows. |
||
Host MAC address data fields described in Host MAC Address 4.9+. |
||
UNIX timestamp that represents the last time the system detected host activity. |
||
VLAN identification number that indicates which VLAN the host is a member of. |
||
Initiates a Generic List data block comprising Client Application data blocks conveying client application data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated client application data blocks. |
||
Initiates a client application block. This value is always 5. |
||
Number of bytes in the client application block, including eight bytes for the client application block type and length fields, plus the number of bytes in the client application data that follows. |
||
Client application data fields describing a client application, as documented in Host Client Application Data Block for 5.0+. |
||
Initiates a string data block for the NetBIOS name. This value is set to 0 to indicate string data. |
||
Indicates the number of bytes in the NetBIOS name data block, including eight bytes for the string block type and length, plus the number of bytes in the NetBIOS name. |
||
Contains the NetBIOS name of the host described in the host profile. |
Legacy OS Fingerprint Data Blocks
See the following sections for more information:
Operating System Fingerprint Data Block for 4.9.x - 5.0.2
Operating System Fingerprint Data Block for 4.9.x - 5.0.2
The Operating System Fingerprint data block has a block type of 87. The block includes a fingerprint Universally Unique Identifier (UUID), as well as the fingerprint type, the fingerprint source type, and the fingerprint source ID. The following diagram shows the format of an Operating System Fingerprint data block for version 4.9.x to version 5.0.2.
The Operating System Fingerprint Data Block Fields describes the fields of the operating system fingerprint data block.
Legacy Connection Data Structures
For more information, see the following sections:
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#66412">Connection Statistics Data Block for 4.7 - 4.9.0.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#81800">Connection Statistics Data Block 4.9.1 - 4.10.1
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#87879">Connection Statistics Data Block 4.10.2.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#40016">Connection Statistics Data Block 5.0 - 5.0.2
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#36092">Connection Statistics Data Block 5.1
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#72601">Connection Chunk Data Block for 4.10.1 - 5.1
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#97897">The Connection Chunk Data Block Fields table describes the components of the Connection Chunk data block:
Connection Statistics Data Block for 4.7 - 4.9.0.x
The Connection Statistics data block is used in Connection Data messages. Changes to the Connection Statistics data block between 3.5 and 4.7 include the use of a server identification number rather than a server name and the addition of a client application type identification number and a domain name string. The Connection Statistics data block for 4.7 - 4.9.0 has a block type of 56.
For more information on the Connection Statistics Data message, see Connection Statistics Data Message.
The following diagram shows the format of a Connection data block for 4.7 - 4.9.0.x:
The Connection Statistics Data Block 4.7 - 4.9.0.x Fields describes the fields of the Connection Statistics data block returned by version 4.7.
Connection Statistics Data Block 4.9.1 - 4.10.1
The Connection Statistics data block is used in Connection Data messages. Changes to the Connection data block between 4.7 and 4.9.1+ include the addition of a list of Web Application data blocks. The Connection Statistics data block for 4.9.1 - 4.10.1 has a block type of 101.
For more information on the Connection Statistics Data message, see Connection Statistics Data Message.
The following diagram shows the format of a Connection Statistics data block for 4.9.1 - 4.10.1:
The Connection Statistics Data Block 4.9.1 - 4.10.1 Fields describes the fields of the Connection Statistics data block returned by 4.9.1 - 4.10.x1
Connection Statistics Data Block 4.10.2.x
The Connection Statistics data block is used in Connection Data messages. Changes to the Connection data block between 4.10.1 and 4.10.2 include the addition of NetFlow fields. The Connection Statistics data block for 4.10.2.x has a block type of 125.
For more information on the Connection Statistics Data message, see Connection Statistics Data Message.
The following diagram shows the format of a Connection Statistics data block for 4.10.2.x:
The Connection Statistics Data Block 4.10.2 Fields describes the fields of the Connection Statistics data block returned by 4.10.2.
Connection Statistics Data Block 5.0 - 5.0.2
The Connection Statistics data block is used in Connection Data messages. Changes to the Connection data block between 4.10.x and 5.0 include addition of new fields with configuration parameters introduced in 5.0 (security zone, ingress and egress interface, URL category and reputation, and user, plus fields for additional tracking information such as violated policy and rule). The Connection Statistics data block for version 5.0 - 5.0.2 has a block type of 115. For more information on the Connection Statistics Data message, see Connection Statistics Data Message.
The following diagram shows the format of a Connection Statistics data block for 5.0 - 5.0.2:
::
The Connection Statistics Data Block 5.0 - 5.0.2 Fields describes the fields of the Connection Statistics data block for 5.0 - 5.0.2.
Connection Statistics Data Block 5.1
The Connection Statistics data block is used in Connection Data messages. Changes to the Connection data block between 5.0.2 and 5.1 include the addition of new fields with configuration parameters introduced in 5.1 (rule action reason, monitor rules, Security Intelligence source/destination, Security Intelligence layer). The Connection Statistics data block for version 5.1 has a block type of 126. For more information on the Connection Statistics Data message, see Connection Statistics Data Message.
The following diagram shows the format of a Connection Statistics data block for 5.1:
::
The Connection Statistics Data Block 5.1 Fields describes the fields of the Connection Statistics data block for 5.1.
Connection Statistics Data Block 5.2.x
The connection statistics data block is used in connection data messages. Changes to the connection data block between versions 5.1.1 and 5.2 include the addition of new fields to support geolocation. The connection statistics data block for version 5.2.x has a block type of 144 in the series 1 group of blocks. It deprecates block type 137, The Connection Chunk Data Block Fields table describes the components of the Connection Chunk data block:.
For more information on the Connection Statistics Data message, see Connection Statistics Data Message.
The following diagram shows the format of a Connection Statistics data block for 5.2+:
::
The Connection Statistics Data Block 5.2.x Fields describes the fields of the Connection Statistics data block for 5.2.x:
Connection Chunk Data Block for 4.10.1 - 5.1
The Connection Chunk data block conveys connection data detected by a NetFlow device. The Connection Chunk data block has a block type of 66 for pre-4.10.1 versions. For version 4.10.1 - 5.1, it has a block type of 119.
The following diagram shows the format of the Connection Chunk data block:
The Connection Chunk Data Block Fields describes the components of the Connection Chunk data block:
Connection Statistics Data Block 5.1.1.x
The connection statistics data block is used in connection data messages. Changes to the connection data block between versions 5.1 and 5.1.1 include the addition of new fields to identify associated intrusion events. The connection statistics data block for version 5.1.1.x has a block type of 137. It deprecates block type 126, Connection Statistics Data Block 5.1. For more information on the Connection Statistics Data message, see Connection Statistics Data Message.
The following diagram shows the format of a Connection Statistics data block for 5.1.1:
::
The Connection Statistics Data Block 5.1.1.x Fields describes the fields of the Connection Statistics data block for 5.1.1.x.
Legacy File Event Data Structures
The following topics describe other legacy file event data structures:
File Event for 5.1.1.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#61479">File Event for 5.2.x
File Event SHA Hash for 5.1.1-5.2.x
File Event for 5.1.1.x
The file event contains information on files that are sent over the network. This includes the connection information, whether the file is malware, and specific information to identify the file. The file event has a block type of 23 in the series 2 group of blocks.
The following graphic shows the structure of the File Event data block.:
| Destination IP Address, continued |
||||||||||||||||||||||||||||||||
The File Event Data Block Fields describes the fields in the file event data block:
File Event for 5.2.x
The file event contains information on files that are sent over the network. This includes the connection information, whether the file is malware, and specific information to identify the file. The file event has a block type of 32 in the series 2 group of blocks. It supersedes block type 23. New fields have been added to track source and destination country, as well as the client and web application instances.
The following graphic shows the structure of the File Event data block:
| Destination IP Address, continued |
||||||||||||||||||||||||||||||||
The File Event Data Block Fields describes the fields in the file event data block:
File Event SHA Hash for 5.1.1-5.2.x
The eStreamer service uses the File Event SHA Hash data block to contain metadata of the mapping of the SHA hash of a file to its filename. The block type is 26 in the series 2 list of data blocks. It can be requested if file log events have been requested in the extended requests—event code 111—and either bit 20 is set or metadata is requested with an event version of 4 and an event code of 21.
The following diagram shows the structure of a file event hash data block:
The File Event SHA Hash 5.1.1-5.2.x Data Block Fields describes the fields in the file event SHA hash data block.
Legacy Correlation Event Data Structures
The following topics describe other legacy correlation (compliance) data structures:
Correlation Event for 4.8.0.2 - 4.9.1.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#54409">Correlation Event for 4.10.x
Correlation Event for 5.0 - 5.0.2
Correlation Event for 4.8.0.2 - 4.9.1.x
Correlation events contain information about policy violations and are transmitted when correlation policies are violated. The Defense Center uses the standard message header with a record type of 97, followed by a correlation data block with a type of 84. The source and destination user ID fields were added in the 4.7.0.2 - 4.8 version.
You can request that eStreamer transmit 4.8.0.2 - 4.9.1.x correlation events by setting bit 22 in the Flags field of a request message. If you enable bit 23, an extended event header is included in the record.
To request user record metadata along with the policy event data, you must request policy event data using bit 22 and request version 4 metadata (bit 20). For more information, see User Record.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
|||||||||||||||||||||||||||||||||
The Correlation Event Data 4.8.0.2 - 4.9.1.x Fields describes each data field in a correlation event.
Indicates a correlation event data block follows. This field always has a value of 84. |
||
Length of the correlation data block, that includes 8 bytes for the correlation block type and length plus the correlation data that follows. |
||
ID of the detection engine or Defense Center that generated the correlation event. A value of zero indicates the Defense Center. You can obtain detection engine names and the detection engine UUIDs that correlate to them by requesting Version 3 metadata. See Detection Engine Record for 4.6.1 - 4.10.x for more information. |
||
UNIX timestamp indicating the time that the event was detected (in seconds from 01/01/1970). |
||
Identification number of the correlation policy that was violated. See Server Record for information about how to obtain policy identification numbers from the database. |
||
Identification number of the correlation rule that triggered to violate the policy. See Server Record for information about how to obtain policy identification numbers from the database. |
||
Priority assigned to the event. This is an integer value from 0 to 5. |
||
Initiates a string data block that contains the policy violation event description. This value is always set to 0. |
||
Number of bytes in the event description string block, which includes four bytes for the string block type and four bytes for the string block length, plus the number of bytes in the description. |
||
Indicates whether the correlation event was triggered by an intrusion, discovery, or user event: |
||
Identification number of the detection engine that generated the intrusion or discovery event that triggered the correlation event. You can obtain detection engine IDs and the detection engine UUIDs that correlate to them by requesting Version 3 metadata. See Detection Engine Record for 4.6.1 - 4.10.x for more information. |
||
If the event was an intrusion event, indicates the rule identification number that corresponds with the event. Otherwise, the value is 0. |
||
If the event was an intrusion event, indicates the ID number of the Sourcefire 3D System preprocessor or rules engine that generated the event. |
||
UNIX timestamp indicating the time that the event was detected (in seconds from 01/01/1970). |
||
Microsecond (one millionth of a second) increment that the event was detected. |
||
Set bits in this field indicate which of the fields that follow in the message are valid. See Event Defined Values for a list of each bit value. |
||
Impact level of the event. The low-order six bits are used and the impact is determined by how the bits are set. Values are:
On the Defense Center, the following values map to specific priorities. An X indicates that the value can be 0 or 1: |
||
IP address of the source host in the event, in IP address octets. |
||
A fingerprint ID number that acts a unique identifier for the source host’s operating system. See Server Record for information about obtaining the values that map to the fingerprint IDs. |
||
Identification number for the user logged into the source host, as identified by the system. |
||
Identification number for the server running on the source host. |
||
IP address of the destination host associated with the policy violation (if applicable). This value will be 0 if there is no destination IP address. |
||
Destination host’s VLAN identification number, if applicable. |
||
A fingerprint ID number that acts as a unique identifier for the destination host’s operating system. See Server Record for information about obtaining the values that map to the fingerprint IDs. |
||
Identification number for the user logged into the destination host, as identified by the system. |
||
Identification number for the server running on the source host. |
Event Data Mask Field Values
The Event Defined Values describes each Event Defined Mask value.
Correlation Event for 4.10.x
Correlation events contain information about policy violations and are transmitted when correlation policies are violated. The Defense Center uses the standard message header with a record type of 112, followed by a correlation data block with a type of 107.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
|||||||||||||||||||||||||||||||||
The Correlation Event 4.10.x Data Fields describes each data field in a correlation event.
Indicates a correlation event data block follows. This field always has a value of 107. |
||
Length of the correlation data block, which includes 8 bytes for the correlation block type and length plus the correlation data that follows. |
||
ID of the detection engine or Defense Center that generated the correlation event. A value of zero indicates the Defense Center. You can obtain detection engine IDs and the detection engine UUIDs that correlate to them by requesting Version 3 metadata. See Detection Engine Record for 4.6.1 - 4.10.x for more information. |
||
UNIX timestamp indicating the time that the event was detected (in seconds from 01/01/1970). |
||
Identification number of the correlation policy that was violated. See Server Record for information about how to obtain policy identification numbers from the database. |
||
Identification number of the correlation rule that triggered to violate the policy. See Server Record for information about how to obtain policy identification numbers from the database. |
||
Priority assigned to the event. This is an integer value from 0 to 5. |
||
Initiates a string data block that contains the correlation violation event description. This value is always set to 0. |
||
Number of bytes in the event description string block, which includes four bytes for the string block type and four bytes for the string block length, plus the number of bytes in the description. |
||
Indicates whether the correlation event was triggered by an intrusion, discovery, or user activity event: |
||
Identification number of the detection engine that generated the intrusion or discovery event that triggered the correlation event. You can obtain detection engine IDs and the detection engine UUIDs that correlate to them by requesting Version 3 metadata. See Detection Engine Record for 4.6.1 - 4.10.x for more information. |
||
If the event was an intrusion event, indicates the rule identification number that corresponds with the event. Otherwise, the value is 0. |
||
If the event was an intrusion event, indicates the ID number of the Sourcefire 3D System preprocessor or rules engine that generated the event. |
||
UNIX timestamp indicating the time that the event was detected (in seconds from 01/01/1970). |
||
Microsecond (one millionth of a second) increment that the event was detected. |
||
Set bits in this field indicate which of the fields that follow in the message are valid. See Event Defined Values for a list of each bit value. |
||
Impact level of the event. The low-order seven bits are used and the impact is determined by how the bits are set. Values are:
On the Defense Center, the following values map to specific priorities. An X indicates that the value can be 0 or 1: |
||
IP address of the source host in the event, in IP address octets. |
||
A fingerprint ID number that acts a unique identifier for the source host’s operating system. See Server Record for information about obtaining the values that map to the fingerprint IDs. |
||
Identification number for the user logged into the source host, as identified by the system. |
||
Identification number for the server running on the source host. |
||
IP address of the destination host associated with the policy violation (if applicable). This value will be 0 if there is no destination IP address. |
||
Destination host’s VLAN identification number, if applicable. |
||
A fingerprint ID number that acts as a unique identifier for the destination host’s operating system. See Server Record for information about obtaining the values that map to the fingerprint IDs. |
||
Identification number for the user logged into the destination host, as identified by the system. |
||
Identification number for the server running on the source host. |
||
Value indicating what happened to the packet that triggered the intrusion event. |
Event Data Mask Field Values
The Event Defined Values describes each value in the Event Defined Mask.
Correlation Event for 5.0 - 5.0.2
Correlation events (called compliance events in pre-5.0 versions) contain information about correlation policy violations. This message uses the standard eStreamer message header and specifies a record type of 112, followed by a correlation data block of type 116. Data block type 116 differs from its predecessor (block type 107) in including additional information about the associated security zone and interface.
You can request 5.0+ correlation events from eStreamer only by extended request, for which you request event type code 31 and version code 7 in the Stream Request message (see Submitting Extended Requests for information about submitting extended requests). You can optionally enable bit 23 in the flags field of the initial event stream request message, to include the extended event header. You can also enable bit 20 in the flags field to include user metadata.
| eStreamer Server Timestamp (in events, only if bit 23 is set) |
|||||||||||||||||||||||||||||||||
Note that the record structure includes a String block type, which is a block in series 1. For information about series 1 blocks, see Understanding Discovery (Series 1) Blocks.
Indicates a correlation event data block follows. This field always has a value of 107. See Understanding Discovery (Series 1) Blocks. |
||
Length of the correlation data block, which includes 8 bytes for the correlation block type and length plus the correlation data that follows. |
||
Internal identification number of the managed device or Defense Center that generated the correlation event. A value of zero indicates the Defense Center. You can obtain managed device names by requesting Version 3 metadata. See Managed Device Record Metadata for more information. |
||
UNIX timestamp indicating the time that the correlation event was generated (in seconds from 01/01/1970). |
||
Identification number of the correlation policy that was violated. See Server Record for information about how to obtain policy identification numbers from the database. |
||
Identification number of the correlation rule that triggered to violate the policy. See Server Record for information about how to obtain policy identification numbers from the database. |
||
Priority assigned to the event. This is an integer value from 0 to 5. |
||
Initiates a string data block that contains the correlation violation event description. This value is always set to 0. For more information about string blocks, see String Data Block. |
||
Number of bytes in the event description string block, which includes four bytes for the string block type and four bytes for the string block length, plus the number of bytes in the description. |
||
Indicates whether the correlation event was triggered by an intrusion, host discovery, or user event: |
||
Identification number of the device that generated the event that triggered the correlation event. You can obtain device name by requesting Version 3 metadata. See Managed Device Record Metadata for more information. |
||
If the event was an intrusion event, indicates the rule identification number that corresponds with the event. Otherwise, the value is 0. |
||
If the event was an intrusion event, indicates the ID number of the Sourcefire 3D System preprocessor or rules engine that generated the event. |
||
UNIX timestamp indicating the time of the event that triggered the correlation policy rule (in seconds from 01/01/1970). |
||
Microsecond (one millionth of a second) increment that the event was detected. |
||
Set bits in this field indicate which of the fields that follow in the message are valid. See Event Defined Values for a list of each bit value. |
||
Impact flag value of the event. The low-order eight bits indicate the impact level. Values are:
The following impact level values map to specific priorities on the Defense Center. An X indicates the value can be 0 or 1: |
||
Identifier of the IP protocol associated with the event, if applicable. |
||
IP address of the source host in the event, in IP address octets. |
||
A fingerprint ID number that acts a unique identifier for the source host’s operating system. See Server Record for information about obtaining the values that map to the fingerprint IDs. |
||
Identification number for the user logged into the source host, as identified by the system. |
||
Identification number for the server running on the source host. |
||
IP address of the destination host associated with the policy violation (if applicable). This value will be 0 if there is no destination IP address. |
||
Destination host’s VLAN identification number, if applicable. |
||
A fingerprint ID number that acts as a unique identifier for the destination host’s operating system. See Server Record for information about obtaining the values that map to the fingerprint IDs. |
||
Identification number for the user logged into the destination host, as identified by the system. |
||
Identification number for the server running on the source host. |
||
Value indicating what happened to the packet that triggered the intrusion event. |
||
An interface ID that acts as the unique identifier for the ingress interface associated with correlation event. |
||
An interface ID that acts as the unique identifier for the egress interface associated with correlation event. |
||
A zone ID that acts as the unique identifier for the ingress security zone associated with correlation event. |
||
A zone ID that acts as the unique identifier for the egress security zone associated with correlation event. |
The Event Defined Values describes each Event Defined Mask value.
Legacy Host Data Structures
To request these structures, you must use a Host Request Message. To request a legacy structure, the Host Request Message must use an older format. See Host Request Message Format for more information.
The following topics describe legacy host data structures, including both host profile and full host profile structures:
Full Host Profile Data Block 4.8
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#53427">Full Host Profile Data Block 4.9 - 4.10.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#10759">Full Host Profile Data Block 5.0 - 5.0.2
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#56861">Full Host Profile Data Block 5.1.1
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#13247">Full Host Profile Data Block 5.2.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#56606">Host Profile Data Block for 5.1.x
■ HREF="/c/en/us/td/docs/security/firesight/5311/api/estreamer/EventStreamerIntegrationGuide/AppBLegacyDataStructures.html#98083">IP Range Specification Data Block for 4.7.x - 5.1.1.x
Full Host Profile Data Block 4.8
The Full Host Profile data block contains a full set of data describing one host. The eStreamer server generates and transmits Full Host Profile data blocks in host request data messages, which it sends in response to host request messages submitted by the client. The full host profile data block for 4.8 has the format shown in the following graphic. Note that the graphic shows all fields in the record, but the content details of nested data blocks are omitted. For information about the fields in the encapsulated blocks, see the subsections of this guide that described the data block in question. The Full Host Profile Data Block for version 4.8 has a data block type value of 47.
An asterisk(*) next to a data block name in the following diagram indicates that multiple instances of the data block may occur.
The Full Host Profile Data Block 4.8 describes the components of the Full Host Profile record.
Number of network hops from the host to the detection device. |
||
Percentage of confidence of Sourcefire in correct identification of the host data. |
||
Initiates a List data block comprising Protocol data blocks conveying network protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the network protocols on the host. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying transport protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the transport protocols on the host. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block containing Host MAC Address data blocks. This value is always 11. |
||
Number of bytes in the list, including the list header and all encapsulated Host MAC Address data blocks. |
||
List of MAC Address data blocks. See Host MAC Address 4.9+ for a description of this data block. |
||
UNIX timestamp that represents the last time the system detected host activity. |
||
VLAN identification number that indicates which VLAN the host is a member of. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying Client Application data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Client Application data blocks. |
||
List of Client Application data blocks. See Host Client Application Data Block for 4.9.1 - 4.10.x for a description of this data block. |
||
Initiates a String data block for the host NetBIOS name. This value is always 0. |
||
Number of bytes in the String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the NetBIOS name string. |
||
Initiates a String data block for host notes. This value is always 0. |
||
Number of bytes in the notes String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the notes string. |
||
Contains the contents of the Notes host attribute for the host. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying Sourcefire vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
List of Host Vulnerability data blocks for vulnerabilities cataloged in the Sourcefire vulnerability database (VDB). See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third party scan vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
List of Host Vulnerability data blocks for vulnerabilities identified through a third party scanner. Note that the host vulnerability IDs for these data blocks are third party scanner IDs, not Sourcefire vulnerability IDs. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a List data block comprising Attribute Value data blocks conveying attribute data. This value is always 11. |
||
Number of bytes in the List data block, including the list header and all encapsulated data blocks. |
||
List of Attribute Value data blocks. See Attribute Value Data Block for a description of this data block. |
Full Host Profile Data Block 4.9 - 4.10.x
The Full Host Profile data block contains a full set of data describing one host. The eStreamer server generates and transmits Full Host Profile data blocks in host request data messages, which it sends in response to host request messages submitted by the client. The full host profile data block for 4.9 - 4.10.x has the format shown in the following graphic. Note that the graphic shows all fields in the record, but the content details of nested data blocks are omitted. For information about the fields in the encapsulated blocks, see the subsections of this guide that described the data block in question. The Full Host Profile Data Block for version 4.9 to 4.10.x has a data block type value of 92.
An asterisk(*) next to a data block name in the following diagram indicates that multiple instances of the data block may occur.
The Full Host Profile Data Block 4.9 - 4.10.x describes the components of the Full Host Profile record.
Number of network hops from the host to the detection device. |
||
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data derived from the existing fingerprints for the host. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Derived Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host derived from the existing fingerprints for the host. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a server fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Server Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a server fingerprint. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a client fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Client Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a client fingerprint. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a VDB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (VDB Fingerprint 1) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using the fingerprints in the Sourcefire vulnerability database (VDB). See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a Sourcefire VDB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (VDB Fingerprint 2) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using the fingerprints in the Sourcefire vulnerability database (VDB). See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by a user. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (User Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by a user. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by a vulnerability scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Scan Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by a vulnerability scanner. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by an application. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Application Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by an application. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data selected through fingerprint conflict resolution. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Conflict Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host selected through fingerprint conflict resolution. See Operating System Fingerprint Data Block for 4.9.x - 5.0.2 for a description of this data block. |
|
Initiates a List data block comprising Full Server data blocks conveying TCP server data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Full Server data blocks. |
||
List of Full Server data blocks conveying data about the TCP services on the host. See Full Host Server Data Block 4.10.0+ for a description of this data block. |
||
Initiates a List data block comprising Full Server data blocks conveying UDP service data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Full Server data blocks. |
||
List of Full Server data blocks conveying data about the UDP services on the host. See Full Host Server Data Block 4.10.0+ for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying network protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the network protocols on the host. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying transport protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the transport protocols on the host. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block containing Host MAC Address data blocks. This value is always 11. |
||
Number of bytes in the list, including the list header and all encapsulated Host MAC Address data blocks. |
||
List of MAC Address data blocks. See Host MAC Address 4.9+ for a description of this data block. |
||
UNIX timestamp that represents the last time the system detected host activity. |
||
VLAN identification number that indicates which VLAN the host is a member of. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying Client Application data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Client Application data blocks. |
||
List of Client Application data blocks. See Host Client Application Data Block for 4.9.1 - 4.10.x for a description of this data block. |
||
Initiates a String data block for the host NetBIOS name. This value is always 0. |
||
Number of bytes in the String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the NetBIOS name string. |
||
Initiates a String data block for host notes. This value is always 0. |
||
Number of bytes in the notes String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the notes string. |
||
Contains the contents of the Notes host attribute for the host. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying Sourcefire vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
List of Host Vulnerability data blocks for vulnerabilities cataloged in the Sourcefire vulnerability database (VDB). See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third-party scan vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
Host Vulnerability data blocks sourced from a third party scanner and containing information about host vulnerabilities cataloged in the Sourcefire vulnerability database (VDB). See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third party scan vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
List of Host Vulnerability data blocks for vulnerabilities identified through a third party scanner. Note that the host vulnerability IDs for these data blocks are third party scanner IDs, not Sourcefire vulnerability IDs. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a List data block comprising Attribute Value data blocks conveying attribute data. This value is always 11. |
||
Number of bytes in the List data block, including the list header and all encapsulated data blocks. |
||
List of Attribute Value data blocks. See Attribute Value Data Block for a description of this data block. |
Full Host Profile Data Block 5.0 - 5.0.2
The Full Host Profile data block for version 5.0 - 5.0.2 contains a full set of data describing one host. It has the format shown in the graphic below and explained in the following table. Note that, except for List data blocks, the graphic does not show the fields of the encapsulated data blocks. These encapsulated data blocks are described separately in Understanding Discovery & Connection Data Structures. The Full Host Profile data block a block type value of 111.
An asterisk(*) next to a block name in the following diagram indicates that multiple instances of the data block may occur.
| (Third Party Scan) Host Vulnerability Data Blocks with Original Vuln IDs (85)* |
||||||||||||||||||||||||||||||||
The Full Host Profile Record 5.0 - 5.0.2 Fields describes the components of the Full Host Profile for 5.0 - 5.0.2record.
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data derived from the existing fingerprints for the host. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint data blocks containing information about the operating system on a host derived from the existing fingerprints for the host. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
||
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a server fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Server Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a server fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a client fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Client Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a client fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a Sourcefire VDB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (VDB) Native Fingerprint 1) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using the fingerprints in the Sourcefire vulnerability database (VDB). See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a Sourcefire VDB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (VDB) Native Fingerprint 2) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using the fingerprints in the Sourcefire vulnerability database (VDB). See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by a user. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (User Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by a user. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by a vulnerability scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Scan Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by a vulnerability scanner. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by an application. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Application Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by an application. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data selected through fingerprint conflict resolution. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Conflict Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host selected through fingerprint conflict resolution. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a List data block comprising Full Server data blocks conveying TCP service data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Full Server data blocks. |
||
List of Full Server data blocks conveying data about the TCP services on the host. See Full Host Server Data Block 4.10.0+ for a description of this data block. |
||
Initiates a List data block comprising Full Server data blocks conveying UDP service data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Full Server data blocks. |
||
List of Full Server data blocks conveying data about the UDP sub-servers on the host. See Full Host Server Data Block 4.10.0+ for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying network protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the network protocols on the host. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying transport protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the transport protocols on the host. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block containing Host MAC Address data blocks. This value is always 11. |
||
Number of bytes in the list, including the list header and all encapsulated Host MAC Address data blocks. |
||
List of Host MAC Address data blocks. See Host MAC Address 4.9+ for a description of this data block. |
||
UNIX timestamp that represents the last time the system detected host activity. |
||
VLAN identification number that indicates which VLAN the host is a member of. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying Client Application data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Client Application data blocks. |
||
List of Client Application data blocks. See Full Host Client Application Data Block 5.0+ for a description of this data block. |
||
Initiates a String data block for the host NetBIOS name. This value is always 0. |
||
Number of bytes in the String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the NetBIOS name string. |
||
Initiates a String data block for host notes. This value is always 0. |
||
Number of bytes in the notes String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the notes string. |
||
Contains the contents of the Notes host attribute for the host. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying VDB vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
List of Host Vulnerability data blocks for vulnerabilities identified in the Sourcefire vulnerability database (VDB). See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third-party scan vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
Host Vulnerability data blocks sourced from a third party scanner and containing information about host vulnerabilities cataloged in the Sourcefire vulnerability database (VDB). See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third party scan vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
Host Vulnerability data blocks sourced from a third party scanner. Note that the host vulnerability IDs for these data blocks are the third party scanner IDs, not Sourcefire-detected IDs. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a List data block comprising Attribute Value data blocks conveying attribute data. This value is always 11. |
||
Number of bytes in the List data block, including the list header and all encapsulated data blocks. |
||
List of Attribute Value data blocks. See Attribute Value Data Block for a description of the data blocks in this list. |
Full Host Profile Data Block 5.1.1
The Full Host Profile data block for version 5.1.1 contains a full set of data describing one host. It has the format shown in the graphic below and explained in the following table. Note that, except for List data blocks, the graphic does not show the fields of the encapsulated data blocks. These encapsulated data blocks are described separately in Understanding Discovery & Connection Data Structures. The Full Host Profile data block a block type value of 135 It deprecates data block 111.
An asterisk(*) next to a block name in the following diagram indicates that multiple instances of the data block may occur.
| (Third Party Scan) Host Vulnerability Data Blocks with Original Vuln IDs (85)* |
||||||||||||||||||||||||||||||||
The Full Host Profile Record 5.1.1 Fields describes the components of the Full Host Profile for 5.1.1 record.
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data derived from the existing fingerprints for the host. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint data blocks containing information about the operating system on a host derived from the existing fingerprints for the host. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
||
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a server fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Server Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a server fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a client fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Client Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a client fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a Sourcefire VDB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (VDB) Native Fingerprint 1) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using the fingerprints in the Sourcefire vulnerability database (VDB). See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a Sourcefire VDB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (VDB) Native Fingerprint 2) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using the fingerprints in the Sourcefire vulnerability database (VDB). See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by a user. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (User Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by a user. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by a vulnerability scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Scan Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by a vulnerability scanner. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by an application. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Application Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by an application. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data selected through fingerprint conflict resolution. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Conflict Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host selected through fingerprint conflict resolution. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a List data block comprising Full Server data blocks conveying TCP service data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Full Server data blocks. |
||
List of Full Server data blocks conveying data about the TCP services on the host. See Full Host Server Data Block 4.10.0+ for a description of this data block. |
||
Initiates a List data block comprising Full Server data blocks conveying UDP service data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Full Server data blocks. |
||
List of Full Server data blocks conveying data about the UDP sub-servers on the host. See Full Host Server Data Block 4.10.0+ for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying network protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the network protocols on the host. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying transport protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the transport protocols on the host. See Full Host Server Data Block 4.10.0+ for a description of this data block. |
||
Initiates a List data block containing Host MAC Address data blocks. This value is always 11. |
||
Number of bytes in the list, including the list header and all encapsulated Host MAC Address data blocks. |
||
List of Host MAC Address data blocks. See Host MAC Address 4.9+ for a description of this data block. |
||
UNIX timestamp that represents the last time the system detected host activity. |
||
VLAN identification number that indicates which VLAN the host is a member of. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying Client Application data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Client Application data blocks. |
||
List of Client Application data blocks. See Full Host Client Application Data Block 5.0+ for a description of this data block. |
||
Initiates a String data block for the host NetBIOS name. This value is always 0. |
||
Number of bytes in the String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the NetBIOS name string. |
||
Initiates a String data block for host notes. This value is always 0. |
||
Number of bytes in the notes String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the notes string. |
||
Contains the contents of the Notes host attribute for the host. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying VDB vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
List of Host Vulnerability data blocks for vulnerabilities identified in the Sourcefire vulnerability database (VDB). See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third-party scan vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
Host Vulnerability data blocks sourced from a third party scanner and containing information about host vulnerabilities cataloged in the Sourcefire vulnerability database (VDB). See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third party scan vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
Host Vulnerability data blocks sourced from a third party scanner. Note that the host vulnerability IDs for these data blocks are the third party scanner IDs, not Sourcefire-detected IDs. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a List data block comprising Attribute Value data blocks conveying attribute data. This value is always 11. |
||
Number of bytes in the List data block, including the list header and all encapsulated data blocks. |
||
List of Attribute Value data blocks. See Attribute Value Data Block for a description of the data blocks in this list. |
||
A true-false flag indicating whether the operating system is running on a mobile device. |
||
A true-false flag indicating whether the mobile device operating system is jailbroken. |
||
Full Host Profile Data Block 5.2.x
The Full Host Profile data block for version 5.2.x contains a full set of data describing one host. It has the format shown in the graphic below and explained in the following table. Note that, except for List data blocks, the graphic does not show the fields of the encapsulated data blocks. These encapsulated data blocks are described separately in Understanding Discovery & Connection Data Structures. The Full Host Profile data block a block type value of 140. It supersedes the prior version, which has a block type of 135.
An asterisk (*) next to a block name in the following diagram indicates that multiple instances of the data block may occur.
| (Third Party Scan) Host Vulnerability Data Blocks with Original Vuln IDs (85)* |
||||||||||||||||||||||||||||||||
The Full Host Profile Record 5.2.x Fields describes the components of the Full Host Profile for 5.2.x record.
Initiates a List data block comprising IP address data blocks conveying TCP service data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated IP address data blocks. |
||
IP addresses of the host and when each IP address was last seen. See Host IP Address Data Block for a description of this data block. |
||
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data derived from the existing fingerprints for the host. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint data blocks containing information about the operating system on a host derived from the existing fingerprints for the host. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
||
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a server fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Server Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a server fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a client fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Client Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a client fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a Sourcefire VDB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (VDB) Native Fingerprint 1) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using the fingerprints in the Sourcefire vulnerability database (VDB). See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a Sourcefire VDB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (VDB) Native Fingerprint 2) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using the fingerprints in the Sourcefire vulnerability database (VDB). See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by a user. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (User Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by a user. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by a vulnerability scanner. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Scan Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by a vulnerability scanner. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data added by an application. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Application Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host added by an application. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data selected through fingerprint conflict resolution. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Conflict Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host selected through fingerprint conflict resolution. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying mobile device fingerprint data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint data blocks containing information about the operating system on a mobile device host. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
||
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using an IPv6 server fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (IPv6 Server Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using an IPv6 server fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using an IPv6 client fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (IPv6 Client Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using an IPv6 client fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using an IPv6 DHCP fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint data blocks containing information about the operating system on a host identified using an IPv6 DHCP fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
||
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a user agent fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a user agent fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
||
Initiates a List data block comprising Full Server data blocks conveying TCP service data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Full Server data blocks. |
||
List of Full Server data blocks conveying data about the TCP services on the host. See Full Host Server Data Block 4.10.0+ for a description of this data block. |
||
Initiates a List data block comprising Full Server data blocks conveying UDP service data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Full Server data blocks. |
||
List of Full Server data blocks conveying data about the UDP sub-servers on the host. See Full Host Server Data Block 4.10.0+ for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying network protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the network protocols on the host. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying transport protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus the length of all encapsulated Protocol data blocks. |
||
List of Protocol data blocks conveying data about the transport protocols on the host. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block containing Host MAC Address data blocks. This value is always 11. |
||
Number of bytes in the list, including the list header and all encapsulated Host MAC Address data blocks. |
||
List of Host MAC Address data blocks. See Host MAC Address 4.9+ for a description of this data block. |
||
UNIX timestamp that represents the last time the system detected host activity. |
||
VLAN identification number that indicates which VLAN the host is a member of. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying Client Application data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Client Application data blocks. |
||
List of Client Application data blocks. See Full Host Client Application Data Block 5.0+ for a description of this data block. |
||
Initiates a String data block for the host NetBIOS name. This value is always 0. |
||
Number of bytes in the String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the NetBIOS name string. |
||
Initiates a String data block for host notes. This value is always 0. |
||
Number of bytes in the notes String data block, including eight bytes for the string block type and length fields, plus the number of bytes in the notes string. |
||
Contains the contents of the Notes host attribute for the host. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying VDB vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
List of Host Vulnerability data blocks for vulnerabilities identified in the Sourcefire vulnerability database (VDB). See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third-party scan vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
Host Vulnerability data blocks sourced from a third party scanner and containing information about host vulnerabilities cataloged in the Sourcefire vulnerability database (VDB). See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a Generic List data block comprising Host Vulnerability data blocks conveying third party scan vulnerability data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated data blocks. |
||
Host Vulnerability data blocks sourced from a third party scanner. Note that the host vulnerability IDs for these data blocks are the third party scanner IDs, not Sourcefire-detected IDs. See Host Vulnerability Data Block 4.9.0+ for a description of this data block. |
||
Initiates a List data block comprising Attribute Value data blocks conveying attribute data. This value is always 11. |
||
Number of bytes in the List data block, including the list header and all encapsulated data blocks. |
||
List of Attribute Value data blocks. See Attribute Value Data Block for a description of the data blocks in this list. |
||
A true-false flag indicating whether the operating system is running on a mobile device. |
||
A true-false flag indicating whether the mobile device operating system is jailbroken. |
Host Profile Data Block for 5.1.x
The following diagram shows the format of a Host Profile data block. The data block also does not include a host criticality value, but does include a VLAN presence indicator. In addition, a data block can convey a NetBIOS name for the host. The Host Profile data block has a block type of 132.
An asterisk(*) next to a block type field in the following diagram indicates the message may contain zero or more instances of the series 1 data block.
The Host Profile Data Block 5.1.x Fields describes the fields of the host profile data block returned by version 5.1.x
Initiates the Host Profile data block for 5.1.x. This value is always 132. |
||
Number of bytes in the Host Profile data block, including eight bytes for the host profile block type and length fields, plus the number of bytes included in the host profile data that follows. |
||
IP address of the host described in the profile, in IP address octets. |
||
Indicates whether the host is in the primary or secondary network of the device that detected it: |
||
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a server fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Server Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a server fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a client fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Client Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a client fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using an SMB fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (SMB Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using an SMB fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a DHCP fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (DHCP Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a DHCP fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a Generic List data block comprising Operating System Fingerprint data blocks conveying fingerprint data identified using a DHCP fingerprint. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated Operating System Fingerprint data blocks. |
||
Operating System Fingerprint (Mobile Device Fingerprint) Data Blocks * |
Operating System Fingerprint data blocks containing information about the operating system on a host identified using a mobile device fingerprint. See Operating System Fingerprint Data Block 5.1+ for a description of this data block. |
|
Initiates a List data block comprising Server data blocks conveying TCP server data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Server data blocks. |
||
Host server data blocks describing a TCP server. See Host Server Data Block for Version 4.9.0.x for a description of this data block. |
||
Initiates a List data block comprising Server data blocks conveying UDP server data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Server data blocks. |
||
Host server data blocks describing a UDP server. See Host Server Data Block for Version 4.9.0.x for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying network protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Protocol data blocks. This field is followed by zero or more Protocol data blocks. |
||
Protocol data blocks describing a network protocol. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block comprising Protocol data blocks conveying transport protocol data. This value is always 11. |
||
Number of bytes in the list. This number includes the eight bytes of the list block type and length fields, plus all encapsulated Protocol data blocks. This field is followed by zero or more transport protocol data blocks. |
||
Protocol data blocks describing a transport protocol. See Protocol Data Block for a description of this data block. |
||
Initiates a List data block comprising MAC Address data blocks. This value is always 11. |
||
Number of bytes in the list, including the list header and all encapsulated MAC Address data blocks. |
||
Host MAC Address data blocks describing a host MAC address. See Host MAC Address 4.9+ for a description of this data block. |
||
UNIX timestamp that represents the last time the system detected host activity. |
||
True-false flag indicating whether the host is a mobile device. |
||
True-false flag indicating whether the host is a mobile device that is also jailbroken. |
||
VLAN identification number that indicates which VLAN the host is a member of. |
||
Initiates a Generic List data block comprising Client Application data blocks conveying client application data. This value is always 31. |
||
Number of bytes in the Generic List data block, including the list header and all encapsulated client application data blocks. |
||
Client application data blocks describing a client application. See Full Host Client Application Data Block 5.0+ for a description of this data block. |
||
Initiates a string data block for the NetBIOS name. This value is set to 0 to indicate string data. |
||
Indicates the number of bytes in the NetBIOS name data block, including eight bytes for the string block type and length, plus the number of bytes in the NetBIOS name. |
||
Contains the NetBIOS name of the host described in the host profile. |
IP Range Specification Data Block for 4.7.x - 5.1.1.x
The IP Range Specification data block conveys a range of IP addresses. IP Range Specification data blocks are used in User Protocol, User Client Application, Address Specification, User Product, User Server, User Hosts, User Vulnerability, User Criticality, and User Attribute Value data blocks. The IP Range Specification data block has a block type of 61.
The following diagram shows the format of the IP Range Specification data block:
The IP Range Specification Data Block Fields describes the components of the IP Range Specification data block.
Legacy Metadata Structures
The following legacy data structures apply to versions of the system before 5.1:
Detection Engine Record for 4.6.1 - 4.10.x
Detection Engine Record for 4.6.1 - 4.10.x
The eStreamer service transmits metadata containing device information for an event within a Detection Engine record, the format of which is shown below.
The Detection Engine for 4.6.1+ contains the same fields as the Detection Engine record for 4.6 but has a new UUID field. Detection Engine information is sent when the Version 3 or Version 4 metadata flag—bit 15 or bit 20 in the Request Flags field of a request message—is set. See Request Flags. The Record Type field has a value of 68.
The Detection Engine Record Fields describes the fields in the Detection Engine Record.
Feedback