Schema: Discovery Event and Network Map Tables
This chapter contains information on the schema and supported joins for tables related to discovery events and the Cisco network map.
Your FireSIGHT System generates discovery events continuously as it monitors the traffic produced by your hosts and network devices.
The network map is a repository of information about the network assets reported in discovery events. For each detected host and network device, the network map contains information such as operating system, servers, client applications, host attributes, vulnerabilities, and so on.
Vulnerabilities are descriptions of specific compromises or exploits to which hosts may be susceptible. Cisco maintains its own vulnerability database (VDB), which cross-references the Bugtraq database and MITRE’s CVE database. You can also import third-party vulnerability data using the host input feature.
Note that the information about a given host in the network map can vary according to the type of host and the information available in the monitored traffic.
For more information, see the sections listed in the following table. The Version column indicates the FireSIGHT System versions that support each table. While support for deprecated tables continues in the current product release, Cisco strongly recommends avoiding the use of deprecated tables and fields, to ensure continued support in the future.
Table 6-1 Schema for Discovery Event and Network Map Tables
|
For the table that stores information on...
|
|
application_host_map |
Applications detected on the hosts in your monitored network. |
5.0+ |
application_ip_map |
The category, tags, productivity, and risk associated with an application detected in your monitored network. |
5.2+ |
application_ip_map |
The category, tags, productivity, and risk associated with an application detected in your monitored network. deprecated in Version 5.2. Superseded by application_ip_map. |
5.0-5.1.x |
application_tag_map |
The tags associated with an application detected in your monitored network. |
5.0+ |
network_discovery_event |
Discovery and host input events. |
5.0+ |
rna_host |
Basic information on the hosts in your monitored network. |
5.2+ |
rna_host_attribute |
The host attributes associated with each host in your monitored network. |
5.2+ |
rna_host_client_app |
The client applications detected on the hosts in your monitored network. |
5.2+ |
rna_host_client_app |
The payloads associated with HTTP (web browser) client applications detected on the hosts in your monitored network. |
5.2+ |
rna_host_ioc_state |
Stores compromise state for hosts. |
5.3+ |
rna_host_ip_map |
Correlates host IDs to MAC addresses for hosts in your monitored network. |
5.2+ |
rna_host_os |
The operating systems detected on the hosts in your monitored network. |
5.2+ |
rna_host_os_vulns |
The vulnerabilities associated with the hosts in your monitored network. |
5.2+ |
rna_host_protocol |
The protocols detected on the hosts in your monitored network. |
4.10.x+ |
rna_host_protocol |
The hosts in your monitored network with regard to the managed device that detected them. |
5.2+ |
rna_host_service |
The services detected on the hosts in your monitored network. |
5.2+ |
rna_host_service_banner |
Headers from network traffic that advertise service vendors and versions (“banners”) for the services detected on hosts in your monitored network. |
5.2+ |
rna_host_service_info |
Details of the services detected on the hosts in your monitored network. |
5.2+ |
rna_host_service_payload |
The payloads associated with services detected on the hosts in your monitored network. |
5.2+ |
rna_host_service_subtype |
The sub-services for the services detected on the hosts in your monitored network. |
5.2+ |
rna_host_service_vulns |
The vulnerabilities associated with the services detected on the hosts in your monitored network. |
5.2+ |
rna_host_third_party_vuln |
The third-party vulnerabilities associated with the hosts in your monitored network. |
5.2+ |
rna_host_third_party_vuln_bugtraq_id |
The third-party vulnerabilities associated with the hosts in your monitored network that are also associated with a vulnerability in the Bugtraq database ( http://www.securityfocus.com/bid/ ). |
5.2+ |
rna_host_third_party_vuln_cve_id |
The third-party vulnerabilities associated with the hosts in your monitored network that are also associated with a vulnerability in MITRE’s CVE database. ( http://www.cve.mitre.org/ ). |
5.2+ |
rna_host_third_party_vuln_rna_id |
The third-party vulnerabilities associated with the hosts in your monitored network that are also associated with a vulnerability in the VDB. |
5.2+ |
rna_ip_host |
Basic information on the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host . |
4.10.x-5.1.x |
rna_ip_host_client_app |
The client applications detected on the hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_client_app . |
4.10.x-5.1.x |
rna_ip_host_client_app_payload |
The payloads associated with HTTP (web browser) client applications detected on the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_client_app . |
4.10.x-5.1.x |
rna_ip_host_os |
The operating systems detected on the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_os . |
4.10.x-5.1.x |
rna_ip_host_os_vulns |
The vulnerabilities associated with the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_os_vulns . |
4.10.x--5.1.x |
rna_ip_host_sensor |
The IP hosts in your monitored network with regard to the managed device that detected them. deprecated in Version 5.2. Superseded by rna_host_protocol . |
5.0-5.1.x |
rna_ip_host_service |
The services detected on the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_service . |
4.10.x-5.1.x |
rna_ip_host_service_banner |
Headers from network traffic that advertise service vendors and versions (“banners”) for the services detected on hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_service_banner . |
4.10.x-5.1.x |
rna_ip_host_service_info |
Details of the services detected on the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_service_info . |
4.10.x-5.1.x |
rna_ip_host_service_payload |
The payloads associated with services detected on the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_service_payload . |
4.10.x-5.1.x |
rna_ip_host_service_subtype |
The sub-services for the services detected on the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_service_subtype . |
4.10.x-5.1.x |
rna_ip_host_service_vulns |
The vulnerabilities associated with the services detected on the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_service_vulns . |
4.10.x-5.1.x |
rna_ip_host_third_party_vuln |
The third-party vulnerabilities associated with the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_third_party_vuln . |
4.10.x-5.1.x |
rna_ip_host_third_party_vuln_bugtraq_id |
The third-party vulnerabilities associated with the IP hosts in your monitored network that are also associated with a vulnerability in the Bugtraq database ( http://www.securityfocus.com/bid/ ). deprecated in Version 5.2. Superseded by rna_host_third_party_vuln_bugtraq_id . |
4.10.x-5.1.x |
rna_ip_host_third_party_vuln_cve_id |
The third-party vulnerabilities associated with the IP hosts in your monitored network that are also associated with a vulnerability in MITRE’s CVE database. ( http://www.cve.mitre.org/ ). deprecated in Version 5.2. Superseded by rna_host_third_party_vuln_cve_id . |
4.10.x-5.1.x |
rna_ip_host_third_party_vuln_rna_id |
The third-party vulnerabilities associated with the IP hosts in your monitored network that are also associated with a vulnerability in the VDB. deprecated in Version 5.2. Superseded by rna_host_third_party_vuln_rna_id . |
4.10.x-5.1.x |
rna_ip_host_user_history |
User activity for a particular IP host in your monitored network. deprecated in Version 5.2. Superseded by user_ipaddr_history . |
4.10.x-5.1.x |
rna_mac_host |
The MAC hosts (hosts without an IP address) in your monitored network. |
4.10.x-5.1.x |
rna_mac_host_sensor |
The IP hosts in your monitored network with regard to the managed devices that detected them. |
5.0-5.1.x |
rna_mac_ip_map |
The MAC addresses of the IP hosts in your monitored network. deprecated in Version 5.2. Superseded by rna_host_ip_map and rna_host_mac_map. |
4.10.x-5.1.x |
rna_vuln |
The vulnerabilities in the Cisco VDB. |
4.10.x+ |
tag_info |
The tags that characterize detected applications. |
5.0+ |
url_categories |
The categories that characterize URLs accessed from hosts in your monitored network. |
5.0+ |
url_reputations |
The reputations that characterize URLs accessed from hosts in your monitored network. |
5.0+ |
user_ipaddr_history |
User activity for a particular host in your monitored network. |
5.2+ |
application_host_map
The application_host_map
table contains information on the categories and tags associated with each application detected on your network.
For more information, see the following sections:
application_host_map Fields
The following table describes the fields you can access in the application_host_map
table.
Table 6-2 application_host_map Fields
|
|
application_id |
The internal identification number for the application. |
application_name |
The application name that appears in the user interface. |
application_tag_id |
This field has been deprecated and will now return null . |
business_relevance |
The index (from 1 to 5 ) of the application’s relevance to business productivity, where 1 is very low and 5 is very high. |
business_relevance_description |
The description of the business relevance ( very low , low , medium , high , very high ). |
host_id |
ID number of the host. |
risk |
An index (from 1 to 5 ) of the application’s risk, where 1 is very low risk and 5 is critical risk. |
risk_description |
The description of the risk ( very low , low , medium , high , critical ). |
application_host_map Joins
The following table describes the joins you can perform on the application_host_map
table.
application_host_map Sample Query
The following query returns information about the applications detected on the host with a host_id
of 8
.
SELECT host_id, application_id, application_name, business_relevance, risk
FROM application_host_map
WHERE HEX(host_id) = "00000000000000000000000000000008";
application_info
The application_info
table contains information about the applications that can be detected on the hosts in your monitored network.
You can retrieve the list of tags associated with an application from the application_tag_map
table by joining on application_id
. Similarly, you can retrieve an application’s list of associated categories from the application_host_map
by joining on application_id
.
For more information, see the following sections:
application_info Fields
The following table describes the fields you can access in the application_info
table.
Table 6-4 application_info Fields
|
|
application_description |
A description of the application. |
application_id |
The internal identification number for the application. |
application_name |
The application name that appears in the user interface. |
business_relevance |
An index (from 1 to 5 ) of the application’s relevance to business productivity, where 1 is very low and 5 is very high. |
business_relevance_description |
A description of business relevance ( very low , low , medium , high , very high ). |
is_client_application |
A true-false flag that indicates if the detected application is a client. |
is_server_application |
A true-false flag that indicates if the detected application is a server application. |
is_web_application |
A true-false flag that indicates if the detected application is a web application. |
risk |
An index (from 1 to 5 ) of the application’s estimated risk where 1 is very low risk and 5 is critical risk. |
risk_description |
A description of the risk ( very low , low , medium , high , and critical ). |
application_info Joins
The following table describes the joins you can perform on the application_info
table.
application_info Sample Query
The following query returns the record for the application with a host_id
of 8
.
SELECT application_id, application_name, application_description, business_relevance, risk
FROM application_info
WHERE application_id="8";
application_tag_map
The application_tag_map
table contains information on the tags associated with each application detected on your network.
For more information, see the following sections:
application_tag_map Fields
The following table describes the fields you can access in the application_tag_map
table.
Table 6-6 application_tag_map Fields
|
|
application_id |
The internal identification number for the application. |
application_name |
The application that appears in the user interface. |
tag_id |
The internal identification number for the tag. |
tag_name |
The text of the tag that appears in the user interface. |
tag_type |
One of the following: category or type . |
application_tag_map Joins
The following table describes the joins you can perform on the application_tag_map
table.
application_tag_map Sample Query
The following query returns all tag records associated with the specified application.
SELECT application_id, application_name, tag_id, tag_name
FROM application_tag_map
WHERE application_name="Active Directory";
network_discovery_event
The network_discovery_event
table contains information on discovery and host input events. The FireSIGHT System generates discovery events when it detects a change on your monitored network, whether by discovering new network features or by detecting changes in previously identified network assets. The FireSIGHT System generates host input events when a user manually modifies the network map by adding, modifying, or deleting network assets.
The network_discovery_event
table supersedes the deprecated rna_events
table starting with Version 5.0 of the FireSIGHT System.
For more information, see the following sections:
network_discovery_event Fields
The following table describes the fields you can access in the network_discovery_event
table.
Table 6-8 network_discovery_event Fields
|
|
confidence |
The FireSIGHT System-assigned confidence rating (from 0 to 100 ) for the identification of the service. |
description |
The description of the event. |
event_id |
The internal identification number for the event. |
event_time_sec |
The UNIX timestamp of the date and time the event was generated. |
event_time_usec |
The microsecond increment of the event timestamp. |
event_type |
The event type. For example, New Host or Identity Conflict . |
ip_address |
This field has been deprecated and will now return null . |
ipaddr |
A binary representation of the IPv4 or IPv6 address for the host involved in the event. |
mac_address |
The MAC address of the host involved in the event. |
mac_vendor |
The NIC hardware vendor of the host involved in the event. |
port |
The port used by the network traffic that triggered the event. |
sensor_address |
The IP address of the managed device that generated the discovery event. Format is ipv4_address,ipv6_address. |
sensor_name |
The managed device that generated the discovery event. |
sensor_uuid |
A unique identifier for the managed device, or 0 if sensor_name is null . |
user_dept |
The department of the user who last logged into the host. |
user_email |
The email address of the user who last logged into the host. |
user_first_name |
The first name of the user who last logged into the host. |
user_id |
The internal identification number for the user who last logged into the host. |
user_last_name |
The last name of the user who last logged into the host. |
user_last_seen_sec |
The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user who last logged into the host. |
user_last_updated_sec |
The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user who last logged into the host. |
user_name |
The user name of the user who last logged into the host. |
user_phone |
The phone number of the user who last logged into the host. |
network_discovery_event Joins
The following table describes the joins you can perform using the network_discovery_event
table.
network_discovery_event Sample Query
The following query returns discovery event records that include the user, detecting device name, timestamp, host IP address, and so on within the specified times.
SELECT sensor_name, event_time_sec, event_time_usec, event_type, ipaddr, user_id,
hex(mac_address), mac_vendor, port, confidence FROM network_discovery_event
WHERE event_time_sec
BETWEEN UNIX_TIMESTAMP("2013-01-01 00:00:00") AND UNIX_TIMESTAMP("2013-01-01 23:59:59")
ORDER BY event_time_sec DESC, event_time_usec DESC;
rna_host
The rna_host
table contains basic information on the hosts in your monitored network.
This table supersedes rna_ip_host
as of Version 5.2.
For more information, see the following sections:
rna_host Fields
The following table describes the fields you can access in the rna_host
table.
Table 6-10 rna_host
Fields
|
|
criticality |
The host criticality level: None , Low , Medium , or High . |
hops |
The number of network hops from the host to the managed device that detected the host. |
host_id |
ID number of the host. |
host_name |
Name of the host. |
host_type |
The host type: Host , Router , Bridge , NAT Device , or Load Balancer . |
jailbroken |
A true-false flag indicating whether a mobile device operating system is jailbroken. |
last_seen_sec |
The UNIX timestamp of the date and time the system last detected host activity. |
mobile |
A true-false flag indicating whether the detected host is a mobile device. |
netbios_name |
The host NetBIOS name string. |
notes |
The contents of the Notes host attribute for the host. |
vlan_id |
The VLAN identification number, if applicable. |
vlan_priority |
The priority value included in the VLAN tag. |
vlan_type |
The type of encapsulated packet that contains the VLAN tag:
-
0 — Ethernet
-
1 — Token Ring
|
rna_host Joins
The following table describes the joins you can perform on the rna_host
table.
rna_host Sample Query
The following query returns 25 rna_host
records that include the host ID, VLAN ID, when the host was last seen, and the type of host, ordered by the type of host.
SELECT host_id, vlan_id, last_seen_sec, host_type
FROM rna_host
ORDER BY host_type
LIMIT 0, 25;
rna_host_attribute
The rna_host_attribute
table contains information on the host attributes associated with each host in your monitored network. It supersedes the deprecated rna_ip_host_attribute
table.
For more information, see the following sections:
rna_host_attribute Fields
The following table describes the fields you can access in the rna_host_attribute
table.
Table 6-12 rna_host_attribute Fields
|
|
attribute_name |
The host attribute. For example, Host Criticality or Default White List . |
attribute_value |
The value of the host attribute. |
host_id |
ID number of the host. |
rna_host_attribute Joins
The following table describes the joins you can perform on the rna_host_attribute
table.
rna_host_attribute Sample Query
The following query returns all host attributes and values associated with the selected host ID.
SELECT attribute_name, attribute_value
FROM rna_host_attribute
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_client_app
The rna_host_client_app
table contains information on the client applications detected on the hosts in your monitored network. It supersedes the deprecated rna_ip_host_client_app
table.
For more information, see the following sections:
rna_host_client_app Fields
The following table describes the fields you can access in the rna_host_client_app
table.
Table 6-14 rna_host_client_app Fields
|
|
application |
Field deprecated in Version 5.0. Returns null for all queries. |
application_protocol_id |
An internal identifier for the detected application protocol. |
application_protocol_name |
One of:
- the name of the application, if a positive identification can be made
-
pending if the system requires more data
- blank if there is no application information in the connection
|
application_type |
Field deprecated in Version 5.0. Returns null for all queries. |
client_application_id |
The internal identification number for the application, if the application is identifiable. |
client_application_name |
One of:
- the name of the application, if a positive identification can be made.
- a generic client name if the system detects a client application but cannot identify a specific one.
- blank if there is no client application information in the connection.
|
hits |
The number of times the client application was detected. |
host_id |
ID number of the host. |
last_used_sec |
The UNIX timestamp of the date and time the system last detected application activity. |
version |
The version of the application detected on the host. |
rna_host_client_app Joins
The following table describes the joins you can perform on the rna_host_client_app
table.
rna_host_client_app Sample Query
The following query returns information about the client applications detected on the host with host_id
of 8
.
SELECT host_id, client_application_id, client_application_name, version, hits, application_protocol_id, application_protocol_name, last_used_sec
FROM rna_host_client_app
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_client_app_payload
The rna_host_client_app_payload
table contains information on the payloads in HTTP traffic associated with web applications on hosts detected in your monitored network.
For more information, see the following sections:
rna_host_client_app_payload Fields
The following table describes the fields you can access in the rna_host_client_app_payload
table.
Table 6-16 rna_host_client_app_payload Fields
|
|
application |
Field deprecated in Version 5.0. Returns null for all queries. |
application_protocol_id |
An internal identifier for the detected application protocol, if available. For traffic that has characteristics of both client applications and web applications, the client_application_id and web_application_id fields have the same value. |
application_protocol_name |
One of:
- the name of the application, if a positive identification can be made
-
pending if the system requires more data
- blank if there is no application information in the connection
|
application_type |
Field deprecated in Version 5.0. Returns null for all queries. |
client_application_id |
The internal identification number for the client application. |
client_application_name |
One of:
- the name of the application, if a positive identification can be made.
- a generic client name if the system detects a client application but cannot identify a specific one.
- blank if there is no client application information in the connection.
|
host_id |
ID number of the host. |
payload_name |
Field deprecated in Version 5.0. Returns null for all queries. |
payload_type |
Field deprecated in Version 5.0. Returns null for all queries. |
version |
The version of the web application detected on the host. |
web_application_id |
The internal identification number for the web application, if available. For traffic that has characteristics of both client applications and web applications, the client_application_id and web_application_id fields have the same value. |
web_application_name |
One of:
- the name of the application, if a positive identification can be made.
-
web browsing if the system detects an application protocol of HTTP but cannot identify a specific web application.
- blank if the connection has no HTTP traffic.
|
rna_host_client_app_payload Joins
The following table describes the joins you can perform on the rna_host_client_app_payload
table.
rna_host_client_app_payload Sample Query
The following query returns information about the web applications detected on the host with host_id
of 8
.
SELECT host_id, web_application_id, web_application_name, version, client_application_id, client_application_name
FROM rna_host_client_app_payload
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_ioc_state
The rna_host_ioc_state
table stores the IOC state for hosts in your monitored network.
For more information, see the following sections:
rna_host_ioc_state Fields
The following table describes the fields you can access in the rna_host_ioc_state
table.
Table 6-18 rna_host_ioc_state Fields
|
|
first_seen |
Unix timestamp when the compromise was first detected. |
first_seen_sensor_address |
The IP address of the managed device that first detected the compromise. Format is ipv4_address,ipv6_address. |
first_seen_sensor_name |
The managed device that first detected the compromise. |
host_id |
ID number of the host. |
ioc_category |
The category for the compromise. Possible values include:
-
CnC Connected
-
Exploit Kit
-
High Impact Attack
-
Low Impact Attack
-
Malware Detected
-
Malware Executed
-
Dropper Infection
-
Java Compromise
-
Word Compromise
-
Adobe Reader Compromise
-
Excel Compromise
-
PowerPoint Compromise
-
QuickTime Compromise
|
ioc_description |
Description of the compromise. |
ioc_event_type |
The event type for the compromise. Possible values include:
-
Adobe Reader launched shell
-
Dropper Infection Detected by FireAMP
-
Excel Compromise Detected by FireAMP
-
Excel launched shell |
-
Impact 1 Intrusion Event — attempted-admin
-
Impact 1 Intrusion Event — attempted-user
-
Impact 1 Intrusion Event — successful-admin
-
Impact 1 Intrusion Event — successful-user
-
Impact 1 Intrusion Event — web-application-attack
-
Impact 2 Intrusion Event — attempted-admin
-
Impact 2 Intrusion Event — attempted-user
-
Impact 2 Intrusion Event — successful-admin
-
Impact 2 Intrusion Event — successful-user
-
Impact 2 Intrusion Event — web-application-attack
-
Intrusion Event — exploit-kit
-
Intrusion Event — malware-backdoor
-
Intrusion Event — malware-CnC
-
Java Compromise Detected by FireAMP
-
Java launched shell
-
PDF Compromise Detected by FireAMP
-
PowerPoint Compromise Detected by FireAMP
-
PowerPoint launched shell
-
QuickTime Compromise Detected by FireAMP
-
QuickTime launched shell
-
Security Intelligence Event — CnC
-
Suspected Botnet Detected by FireAMP
-
Threat Detected by FireAMP — Subtype is 'executed'
-
Threat Detected by FireAMP — Subtype is not 'executed'
-
Threat Detected in File Transfer — Action is not 'block'
-
Word Compromise Detected by FireAMP
-
Word launched shell
|
ioc_id |
Unique ID number for the compromise. |
is_disabled |
Whether this compromise has been disabled. |
last_seen |
Unix timestamp when this compromise was last detected. |
last_seen_sensor_address |
The IP address of the managed device that last detected the compromise. Format is ipv4_address,ipv6_address. |
last_seen_sensor_name |
The managed device that last detected the compromise. |
rna_host_ioc_state Joins
The following table describes the joins you can perform on the rna_host_ioc_state
table.
rna_host_ioc_state Sample Query
The following query returns up to 25 hosts with their ioc within a specified timespan.
SELECT host_id, ioc_id
FROM rna_host_ioc_state
WHERE first_seen
BETWEEN UNIX_TIMESTAMP("2011-10-01 00:00:00")
AND UNIX_TIMESTAMP("2011-10-07 23:59:59")
ORDER BY ioc_id DESC
LIMIT 0, 25;
rna_host_ip_map
The rna_host_ip_map
table correlates host IDs to IP addresses for hosts in your monitored network.
For more information, see the following sections:
rna_host_ip_map Fields
The following table describes the fields you can access in the rna_host_ip_map
table.
Table 6-20 rna_host_ip_map Fields
|
|
host_id |
ID number of the host. |
ipaddr |
A binary representation of the IP address of the host. |
rna_host_ip_map Joins
The following table describes the joins you can perform on the rna_host_ip_map
table.
rna_host_ip_map Sample Query
The following query returns MAC information for the selected host.
SELECT host_id
FROM rna_host_ip_map
WHERE HEX(ipaddr) = "00000000000000000000FFFF0A0A0A04";
rna_host_mac_map
The rna_host_mac_map
table correlates host IDs to MAC addresses for hosts in your monitored network.
For more information, see the following sections:
rna_host_mac_map Fields
The following table describes the fields you can access in the rna_host_mac_map
table.
Table 6-22 rna_host_mac_map Fields
|
|
host_id |
ID number of the host. |
mac_address |
The host’s MAC address. |
mac_vendor |
Vendor of the network interface of the detected host. |
rna_host_mac_map Joins
The following table describes the joins you can perform on the rna_host_mac_map
table.
rna_host_mac_map Sample Query
The following query returns MAC information for the host with host_id
of 8
.
SELECT HEX(mac_address)
FROM rna_host_mac_map
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_os
The rna_host_os
table contains information on the operating systems detected on the hosts in your monitored network.
For more information, see the following sections:
rna_host_os Fields
The following table describes the fields you can access in the rna_host_os
table.
Table 6-24 rna_host_os Fields
|
|
confidence |
The FireSIGHT System-assigned confidence rating (from 0 to 100 ) for the identification of the operating system. |
created_sec |
The UNIX timestamp of the date and time the system first detected host activity. |
host_id |
ID number of the host. |
last_seen_sec |
The UNIX timestamp of the date and time the system last detected host activity. |
os_uuid |
A unique identifier for the operating system detected on the host. The UUID maps to the operating system name, vendor, and version in the Cisco database. |
product |
The operating system detected on the host. |
source_type |
The source of the host’s operating system identity:
-
User — Name of the user who entered the data via the web user interface
-
Application — Imported from another application via the host input feature
-
Scanner — Either Nmap or another scanner added through system policy
-
rna — Detected by the FireSIGHT System, either by a discovery event, port match, or pattern match
-
NetFlow — The data was exported by a NetFlow-enabled device
|
vendor |
The vendor of the operating system detected on the host. |
version |
The version of the operating system detected on the host. |
rna_host_os Joins
The following table describes the joins you can perform on the rna_host_os
table.
rna_host_os Sample Query
The following query returns operating system information for the host with host_id
of 8
.
SELECT vendor, product, version, source_type, confidence
FROM rna_host_os
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_os_vulns
The rna_host_os_vulns
table contains information on the vulnerabilities associated with the hosts in your monitored network.
For more information, see the following sections:
rna_host_os_vulns Fields
The following table describes the fields you can access in the rna_host_os_vulns
table.
Table 6-26 rna_host_os_vulns Fields
|
|
host_id |
ID number of the host. |
invalid |
A value indicating whether the vulnerability is valid for the host:
-
0 — Vulnerability is valid
-
1 — Vulnerability is invalid
|
rna_vuln_id |
An internal identification number for the vulnerability. |
rna_host_os_vulns Joins
The following table describes the joins you can perform on the rna_host_os_vulns
table.
rna_host_os_vulns Sample Query
The following query returns the operating system vulnerabilities for the host with host_id
of 8
.
SELECT rna_vuln_id, invalid
FROM rna_host_os_vulns
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_protocol
The rna_host_protocol
table contains information on the protocols detected on the hosts in your monitored network.
For more information, see the following sections:
rna_host_protocol Fields
The following table describes the fields you can access in the rna_host_protocol
table.
Table 6-28 rna_host_protocol Fields
|
|
host_id |
ID number of the host. |
ip_address |
Field deprecated in Version 5.2. Returns null for all queries. |
layer |
The network layer where the protocol is running: Network or Transport . |
mac_address |
Field deprecated in Version 5.2. Returns null for all queries. |
mac_vendor |
Field deprecated in Version 5.2. Returns null for all queries. |
protocol_name |
The traffic protocol used by the host. |
protocol_num |
The IANA-specified protocol number for the protocol. |
rna_host_protocol Joins
The following table describes the joins you can perform on the rna_host_protocol
table.
rna_host_protocol Sample Query
The following query returns all protocol records for the host with host_id
of 8
.
SELECT protocol_num, protocol_name
FROM rna_host_protocol
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_sensor
The rna_host_sensor
table lists the host IP addresses in your monitored network and indicates the managed device that detected each one.
The rna_host_sensor
table supersedes the deprecated rna_ip_host_sensor
table starting with Version 5.2 of the FireSIGHT System.
For more information, see the following sections:
rna_host_sensor Fields
The following table describes the fields you can access in the rna_host_sensor
table.
Table 6-30 rna_host_sensor Fields
|
|
host_id |
ID number of the host. |
sensor_address |
The IP address of the managed device that generated the discovery event. Format is ipv4_address,ipv6_address. |
sensor_name |
The name of the managed device. |
sensor_uuid |
A unique identifier for the managed device, or 0 if sensor_name is null . |
rna_host_sensor Joins
The following table describes the joins you can perform on the rna_host_sensor
table.
rna_host_sensor Sample Query
The following query returns up to 25 hosts, and the sensor that detected them, from the rna_host_sensor
table.
SELECT host_id, sensor_address, sensor_name
FROM rna_host_sensor
LIMIT 0, 25;
rna_host_service
The rna_host_service
table contains general information about the servers detected on the hosts in your managed network through network port and traffic protocol combinations.
For more information, see the following sections:
rna_host_service Fields
The following table describes the fields you can access in the rna_host_service
table.
Table 6-32 rna_host_service Fields
|
|
confidence |
The FireSIGHT System-assigned confidence rating (from 0 to 100 ) for the identification of the server. |
hits |
The number of times the server was detected. |
host_id |
ID number of the host. |
last_used_sec |
UNIX timestamp of the date and time the system last detected server activity. |
port |
The port used by the server. |
protocol |
The traffic protocol: TCP or UDP . |
rna_host_service Joins
The following table describes the joins you can perform on the rna_host_service
table.
rna_host_service Sample Query
The following query returns the first 25 detected server records for the host with host_id
of 8
:
SELECT hits, protocol, port, confidence
FROM rna_host_service
WHERE HEX(host_id) = "00000000000000000000000000000008"
LIMIT 0, 25;
rna_host_service_banner
The rna_ip_host_service_banner
table contains header information from network traffic that advertises vendors and versions (“banners”) for the servers on hosts in your monitored network. Keep in mind that the FireSIGHT System does not store server banners unless you enable the Capture Banners option in the your network discovery policy.
For more information, see the following sections:
rna_ip_host_service_banner Fields
The following table describes the fields you can access in the rna_host_service_banner
table.
Table 6-34 rna_host_service_banner Fields
|
|
banner |
The server banner, that is, the first 256 bytes of the first packet detected for the server. |
host_id |
ID number of the host. |
port |
The port used by the server. |
protocol |
The traffic protocol: TCP or UDP . |
rna_host_service_banner Joins
The following table describes the joins you can perform on the rna_host_service_banner
table.
rna_host_service_banner Sample Query
The following query returns the server banner for the host with host_id
of 8
.
SELECT port, protocol, banner
FROM rna_host_service_banner
WHERE HEX(host_id) = “00000000000000000000000000000008”;
rna_host_service_info
The rna_host_service_info
table contains detailed information about the servers detected on the hosts in your monitored network.
For more information, see the following sections:
rna_host_service_info Fields
The following table describes the fields you can access in the rna_host_service_info
table.
.
Table 6-36 rna_host_service_info Fields
|
|
application_id |
Field deprecated in Version 5.0. Returns blank for all queries. |
application_protocol_id |
An internal identifier for the detected application protocol, if available. |
application_protocol_name |
One of:
- the name of the application protocol, if a positive identification can be made
-
pending if the system requires more data
- blank if there is no application information in the connection
|
business_relevance |
An index (from 1 to 5 ) of the application’s relevance to business productivity where 1 is very low and 5 is very high. |
business_relevance_ description |
A description of business relevance ( very low , low , medium , high , very high ). |
created_sec |
The UNIX timestamp of the date and time the system first detected the application protocol. |
host_id |
ID number of the host. |
ip_address |
Field deprecated in Version 5.2. Returns null for all queries. |
last_used_sec |
The UNIX timestamp of the date and time the system last detected server activity. |
port |
The port used by the server. |
protocol |
The traffic protocol: TCP or UDP . |
risk |
An index (from 1 to 5 ) of the application’s risk where 1 is very low risk and 5 is very high risk. |
risk_description |
A description of the risk ( very low , low , medium , high , very high ). |
service_info_id |
An internal identification number for the server. |
service_name |
Field deprecated in Version 5.0. Returns null for all queries. |
source_type |
The source of the identity of the server:
-
User — Name of the user who entered the data via the web user interface
-
Application — Imported from another application via the host input feature
-
Scanner — Added through NMAP or imported via the host input feature with a source type of Scanner
-
rna — Detected by the FireSIGHT System, either by a discovery event, port match, or pattern match
-
NetFlow — The data was exported by a NetFlow-enabled device
|
vendor |
The vendor of the server on the host. |
version |
The version of the server detected on the host. |
rna_host_service_info Joins
The following table describes the joins you can perform on the rna_host_service_info
table.
rna_host_service_info Sample Query
The following query returns information about the application protocols detected on the host with host_id
of 8
.
SELECT host_id, application_protocol_name, version, vendor, created_sec, last_used_sec, business_relevance, risk
FROM rna_host_service_info
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_service_payload
The rna_host_service_payload
table contains information on the web applications associated by the hosts in your monitored network.
For more information, see the following sections:
rna_host_service_payload Fields
The following table describes the fields you can access in the rna_host_service_payload
table.
Table 6-38 rna_host_service_payload Fields
|
|
application_id |
Field deprecated in Version 5.0. Returns null for all queries. |
application_name |
Field deprecated in Version 5.0. Returns null for all queries. |
host_id |
ID number of the host. |
ip_address |
Field deprecated in Version 5.2. Returns null for all queries. |
payload_name |
Field deprecated in Version 5.0. Returns null for all queries. |
payload_type |
Field deprecated in Version 5.0. Returns null for all queries. |
port |
The port used by the server. |
protocol |
The traffic protocol: TCP or UDP . |
web_application_id |
The internal identification number for the web application. |
web_application_name |
One of:
- the name of the web application, if a positive identification can be made
-
web browsing if the system detects an application protocol of HTTP but cannot identify a specific web application
- blank if the connection has no HTTP traffic
|
rna_host_service_payload Joins
The following table describes the joins you can perform on the rna_host_service_payload
table.
rna_host_service_payload Sample Query
The following query returns information about the web applications detected on the host with host_id
of 8
.
SELECT host_id, web_application_id, web_application_name, port, protocol
FROM rna_host_service_payload
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_service_subtype
The rna_host_service_subtype
table contains information on the sub-servers for a server detected on the hosts in your monitored network.
For more information, see the following sections:
rna_host_service_subtype Fields
The following table describes the fields you can access in the rna_host_service_subtype
table.
Table 6-40 rna_host_service_subtype Fields
|
|
host_id |
ID number of the host. |
port |
The port used by the server. |
protocol |
The traffic protocol: TCP or UDP . |
service_name |
One of:
- the server on the host that is associated with the triggering event
-
none or blank if data for an identification is unavailable
-
pending if additional data is required
-
unknown if the system cannot identify the server based on known server fingerprints
|
source_type |
The source of the identity of the server:
-
User - name of the user who entered the data via the web user interface
-
Application - imported from another application via the host input feature
-
Scanner - added through NMAP or imported via the host input feature with a source type of Scanner
-
rna - detected by the FireSIGHT System, either by a discovery event, port match, or pattern match
-
NetFlow - the data was exported by a NetFlow-enabled device
|
sub_service_name |
The sub-server detected on the host. |
sub_service_vendor |
The vendor of the sub-server detected on the host. |
sub_service_version |
The version of the sub-server detected on the host. |
vendor |
The vendor of the server detected on the host. |
version |
The version of the server detected on the host. |
rna_host_service_subtype Joins
You cannot perform joins on the rna_host_service_subtype
table.
rna_host_service_subtype Sample Query
The following query returns all detected sub-server records for the host with host_id
of 8
.
SELECT host_id, service_name, version, sub_service_name, sub_service_version, sub_service_vendor
FROM rna_host_service_subtype
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_service_vulns
The rna_host_service_vulns
table contains information on the vulnerabilities mapped to the servers detected on the hosts in your monitored network.
For more information, see the following sections:
rna_host_service_vulns Fields
The following table describes the fields you can access in the rna_host_service_vulns
table.
Table 6-41 rna_host_service_vulns Fields
|
|
application_id |
An internal identification number for the application protocol running on the host. |
application_name |
The application protocol name that appears in the user interface. |
host_id |
ID number of the host. |
invalid |
A value indicating whether the vulnerability is valid for the host running the application protocol:
-
0 — Vulnerability is valid
-
1 — Vulnerability is invalid
|
ip_address |
Field deprecated in Version 5.2. Returns null for all queries. |
port |
The port used by the server. |
protocol |
The traffic protocol: TCP or UDP . |
rna_vuln_id |
An internal identification number for the vulnerability. |
service_name |
Field deprecated in Version 5.0. Returns null for all queries. |
vendor |
The vendor of the server detected on the host. |
version |
The version of the server detected on the host. |
rna_host_service_vulns Joins
The following table describes the joins you can perform on the rna_host_service_vulns
table.
rna_host_service_vulns Sample Query
The following query returns information about all server vulnerabilities for the host with host_id
of 8
.
SELECT host_id, rna_vuln_id, vendor, service_name, version, invalid FROM rna_host_service_vulns
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_third_party_vuln
The rna_host_third_party_vuln
table contains information on the third-party vulnerabilities associated with the hosts in your monitored network. Note that the information in this table is determined by the third-party vulnerability data imported via the host input feature.
For more information, see the following sections:
rna_host_third_party_vuln Fields
The following table describes the fields you can access in the rna_host_third_party_vuln
table.
Table 6-43 rna_host_third_party_vuln Fields
|
|
description |
A description of the vulnerability. |
host_id |
ID number of the host. |
invalid |
A value indicating whether the vulnerability is valid for the host:
-
0 — Vulnerability is valid
-
1 — Vulnerability is invalid
|
name |
The title of the vulnerability. |
port |
A port number, if the vulnerability is associated with a server or related application detected on a specific port. |
protocol |
The traffic protocol ( TCP or UDP ), if the vulnerability is associated with an application using that protocol. |
source |
The source of the vulnerability. |
third_party_vuln_id |
An identification number associated with the vulnerability. |
rna_host_third_party_vuln Joins
The following table describes the joins you can perform on the rna_host_third_party_vuln
table.
rna_host_third_party_vuln Sample Query
The following query returns information about the third party vulnerabilities for host with host_id
of 8
.
SELECT host_id, third_party_vuln_id, name, description, source, invalid
FROM rna_host_third_party_vuln
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_third_party_vuln_bugtraq_id
The rna_host_third_party_vuln_bugtraq_id
table contains information on the third-party vulnerabilities that are mapped to vulnerabilities in the Bugtraq database and also associated with hosts in your monitored network. Note that the third-party vulnerability data in this table is imported via the host input feature.
For more information, see the following sections:
rna_host_third_party_vuln_bugtraq_id Fields
The following table describes the fields you can access in the rna_host_third_party_vuln_bugtraq_id
table.
Table 6-45 rna_host_third_party_vuln_bugtraq_id Fields
|
|
bugtraq_id |
The Bugtraq database identification number associated with the vulnerability. |
description |
A description of the vulnerability. |
host_id |
ID number of the host. |
invalid |
A value indicating whether the vulnerability is valid for the host:
-
0 — Vulnerability is valid
-
1 — Vulnerability is invalid
|
ip_address |
Field deprecated in Version 5.2. Returns null for all queries. |
name |
The name, or title, of the vulnerability. |
port |
A port number, if the vulnerability is associated with a server or related application detected on a specific port. |
protocol |
The traffic protocol ( TCP or UDP ), if the vulnerability is associated with an application using that protocol. |
source |
The source of the vulnerability. |
third_party_vuln_id |
The third-party identification number associated with the vulnerability. |
rna_host_third_party_vuln_bugtraq_id Joins
The following table describes the joins you can perform on the rna_host_third_party_vuln_bugtraq_id
table.
rna_host_third_party_vuln_bugtraq_id Sample Query
The following query returns the BugTraq vulnerabilities for the host with host_id
of 8
.
SELECT host_id, third_party_vuln_id, bugtraq_id, name, description, source, invalid
FROM rna_host_third_party_vuln_bugtraq_id
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_third_party_vuln_cve_id
The rna_host_third_party_vuln_cve_id
table contains information on the third-party vulnerabilities that are mapped to vulnerabilities in MITRE’s CVE database and also associated with the hosts in your monitored network. Note that this table contains third-party vulnerability data imported via the host input feature.
For more information, see the following sections:
rna_host_third_party_vuln_cve_id Fields
The following table describes the fields you can access in the rna_host_third_party_vuln_cve_id
table.
Table 6-47 rna_host_third_party_vuln_cve_id Fields
|
|
cve_id |
The identification number associated with the vulnerability in MITRE’s CVE database. |
description |
A description of the vulnerability. |
host_id |
ID number of the host. |
invalid |
A value indicating whether the vulnerability is valid for the host:
-
0 — Vulnerability is valid
-
1 — Vulnerability is invalid
|
ip_address |
Field deprecated in Version 5.2. Returns null for all queries. |
name |
The name, or title, of the vulnerability. |
port |
A port number, if the vulnerability is associated with a server or related application detected on a specific port. |
protocol |
The traffic protocol ( TCP or UDP ), if the vulnerability is associated with an application using that protocol. |
source |
The source of the vulnerability. |
third_party_vuln_id |
The identification number associated with the vulnerability. |
rna_host_third_party_vuln_cve_id Joins
The following table describes the joins you can perform on the rna_host_third_party_vuln_cve_id
table.
rna_host_third_party_vuln_cve_id Sample Query
The following query returns the CVE vulnerabilities for the host with host_id
of 8
.
SELECT host_id, third_party_vuln_id, cve_id, name, description, source, invalid
FROM rna_host_third_party_vuln_cve_id
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_host_third_party_vuln_rna_id
The rna_host_third_party_vuln_rna_id
table contains information on third-party vulnerabilities that are mapped to vulnerabilities in the Cisco vulnerability database (VDB) and also associated with hosts in your monitored network. Note that the third-party vulnerability data in this table is imported via the host input feature.
For more information, see the following sections:
rna_host_third_party_vuln_rna_id Fields
The following table describes the fields you can access in the rna_host_third_party_vuln_rna_id
table.
Table 6-49 rna_host_third_party_vuln_rna_id Fields
|
|
description |
A description of the vulnerability. |
host_id |
ID number of the host. |
invalid |
A value indicating whether the vulnerability is valid for the host:
-
0 — Vulnerability is valid
-
1 — Vulnerability is invalid
|
ip_address |
Field deprecated in Version 5.2. Returns null for all queries. |
name |
The name, or title, of the vulnerability. |
port |
A port number, if the vulnerability is associated with a server or related application detected on a specific port. |
protocol |
The traffic protocol ( TCP or UDP ), if the vulnerability is associated with an application using that protocol. |
rna_vuln_id |
The vulnerability identification number that Cisco uses to track the vulnerability. |
source |
The source of the vulnerability. |
third_party_vuln_id |
The identification number associated with the vulnerability. |
rna_host_third_party_vuln_rna_id Joins
The following table describes the joins you can perform on the rna_host_third_party_vuln_rna_id
table.
rna_host_third_party_vuln_rna_id Sample Query
The following query returns all third party vulnerabilities with VDB IDs for the host with host_id
of 8
.
SELECT host_id, third_party_vuln_id, rna_vuln_id, name, description, source, invalid
FROM rna_host_third_party_vuln_rna_id
WHERE HEX(host_id) = "00000000000000000000000000000008";
rna_vuln
The rna_vuln
table contains information on the vulnerabilities in the Cisco VDB.
For more information, see the following sections:
rna_vuln Fields
The following table describes the fields you can access in the rna_vuln
table.
Table 6-51 rna_vuln Fields
|
|
authentication |
Whether authentication is required to exploit the vulnerability:
-
Required
-
Not Required
-
Unknown
|
availability |
When the vulnerability can be exploited:
-
Always
-
User Initiated
-
Time Dependent
-
Unknown
|
available_exploits |
Whether there are available exploits for the vulnerability:
|
bugtraq_id |
The identification number associated with the vulnerability in the Bugtraq database. |
class |
The class of vulnerability:
-
Configuration Error
-
Boundary Condition Error
-
Design Error
|
credibility |
How credible the vulnerability is:
-
Conflicting Reports
-
Conflicting Details
-
Single Source
-
Reliable Source
-
Multiple Sources
-
Vendor Confirmed
|
credit |
The person or organization credited with reporting the vulnerability. |
ease |
The ease of exploiting the vulnerability:
-
No Exploit Required
-
Exploit Available
-
No Exploit Available
|
effect |
Details on what could happen when the vulnerability is exploited. |
entry_date |
The date the vulnerability was entered in the database. |
exploit |
Information on where you can find exploits for the vulnerability. |
impact |
The vulnerability impact, corresponding to the impact level determined through correlation of intrusion data, discovery events, and vulnerability assessments. The value can be from 1 to 10 , with 10 being the most severe. The impact value of a vulnerability is determined by the writer of the Bugtraq entry. |
local |
Indicates whether the vulnerability must be exploited locally:
|
long_description |
A general description of the vulnerability. |
mitigation |
A description of how you can mitigate the vulnerability. |
modified_date |
The date of the most recent modification to the vulnerability, if applicable. |
publish_date |
The date the vulnerability was published. |
remote |
Indicates whether the vulnerability can be exploited across a network:
|
rna_vuln_id |
The Cisco vulnerability ID number that the system uses to track vulnerabilities. |
scenario |
A description of a scenario where an attacker is exploiting the vulnerability. |
short_description |
A summary description of the vulnerability. |
snort_id |
The identification number associated with the vulnerability in the Snort ID (SID) database. That is, if an intrusion rule can detect network traffic that exploits a particular vulnerability, that vulnerability is associated with the intrusion rule’s SID. |
solution |
The solution to the vulnerability. |
technical_description |
The technical description of the vulnerability. |
title |
The title of the vulnerability. |
rna_vuln Joins
The following table describes the joins you can perform on the rna_vuln
table.
rna_vuln Sample Query
The following query returns information about up to 25 vulnerabilities. The records are sorted in order of most events generated based on the vulnerability.
SELECT rna_vuln_id, bugtraq_id, snort_id, title, publish_date, impact, remote, exploit, long_description, technical_description, solution, count(*) as count
FROM rna_vuln
GROUP BY rna_vuln_id
ORDER BY rna_vuln_id DESC LIMIT 0, 25;
tag_info
The tag_info
table contains information on the tags that are associated with the applications detected on your network. Note that an application can have multiple associated tags.
For more information, see the following sections:
tag_info Fields
The following table describes the fields you can access in the tag_info
table.
Table 6-53 tag_info Fields
|
|
tag_description |
Tag description. |
tag_id |
Internal identifier for the tag. |
tag_name |
Text of the tag that appears in the user interface. |
tag_type |
One of the following:
|
tag_info Joins
The following table describes the joins you can perform on the tag_info
table.
tag_info Sample Query
The following query returns the application tag record for a selected tag ID.
SELECT tag_id, tag_name, tag_type, tag_description
FROM tag_info
WHERE tag_id="100";
url_categories
The url_categories
table lists the categories that characterize URLs requested by hosts in your monitored network.
For more information, see the following sections:
url_categories Fields
The following table describes the fields in the url_categories
table.
Table 6-55 url_categories Fields
|
|
category_description |
The description of the URL category. |
category_id |
The internal identification number of the URL category. |
url_categories Joins
You cannot perform joins on the url_categories
table.
url_categories Sample Query
The following query returns a category record for the selected category ID.
SELECT category_id, category_description
FROM url_categories
WHERE category_id="1";
url_reputations
The url_reputations
table lists the reputations that characterize URLs requested by hosts in your monitored request.
For more information, see the following sections:
url_reputations Fields
The following table describes the fields in the url_reputations
table.
Table 6-56 url_reputations Fields
|
|
reputation_description |
The description of the reputation. |
reputation_id |
An internal identification number for the URL reputation. |
url_reputations Joins
You cannot perform joins on the url_reputations
table.
url_reputations Sample Query
The following query returns URL reputation information for a reputation ID.
SELECT reputation_id, reputation_description
FROM url_reputations
WHERE reputation_id="1";
user_ipaddr_history
The user_ipaddr_history
table contains information on user activity for a particular host in your monitored network.
For more information, see the following sections:
user_ipaddr_history Fields
The following table describes the fields you can access in the user_ipaddr_history
table.
Table 6-57 user_ipaddr_history Fields
|
|
end_time_sec |
The UNIX timestamp of the date and time the FireSIGHT System detected a different user logging into the host, marking the assumed end of the previous user’s session. Note that the FireSIGHT System does not detect logoffs. |
id |
An internal identification number for the user history record. |
ipaddr |
A binary representation of the IP address of the host. |
start_time_sec |
The UNIX timestamp of the date and time the FireSIGHT System detected the user logging into host. |
user_dept |
The department of the user. |
user_email |
The email address of the user. |
user_first_name |
The first name of the user. |
user_id |
An internal identification number for the user. |
user_last_name |
The last name of the user. |
user_last_seen_sec |
The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user. |
user_last_updated_sec |
The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user. |
user_name |
The user name of the user. |
user_phone |
The phone number of the user. |
user_rna_service |
Name of the application protocol being used when the user was detected, if available. |
user_ipaddr_history Joins
The following table describes the joins you can perform on the user_ipaddr_history
table.
user_ipaddr_history Sample Query
The following query returns all user activity records for the selected IP address after the specified start timestamp.
SELECT ipaddr, start_time_sec, end_time_sec, user_name, user_rna_service, user_last_seen_sec, user_last_updated_sec
FROM user_ipaddr_history
WHERE HEX(ipaddr) = "00000000000000000000FFFF0A0A0A04" AND start_time_sec >= UNIX_TIMESTAMP("2011-10-01 00:00:00");