FireSIGHT System eStreamer Integration Guide v5.4

Introduction

---

The Cisco Event Streamer (also known as eStreamer) allows you to stream FireSIGHT System intrusion, discovery, and connection data from the Cisco Defense Center or managed device (also referred to as the eStreamer server) to external client applications.

Note that eStreamer is not supported on virtual devices. To stream events from a virtual device, you can configure eStreamer on the Defense Center that the device reports to.

eStreamer uses a custom application layer protocol to communicate with connected client applications. As the purpose of eStreamer is simply to return data that the client requests, the majority of this guide describes the eStreamer formats for the requested data.

There are three major steps to creating and integrating an eStreamer client with a FireSIGHT System:

1. Write a client application that exchanges messages with the Defense Center or managed device using the eStreamer application protocol. The eStreamer SDK includes a reference client application.

2. Configure a Defense Center or device to send the required type of events to your client application.

3. Connect your client application to the Defense Center or device and begin exchanging data.

This guide provides the information you need to successfully create and run an eStreamer Version 5.4 client application.

Major Changes in eStreamer Version 5.4

If you are upgrading your FireSIGHT System deployment to Version 5.4, please note the following changes, some of which may require you to update your eStreamer client:

• Added the following block:

– Added SSL Certificate Details Data Block for 5.4+, which contains metadata for data blocks with SSL information.

• Removed the following blocks and messages:

– Removed Vulnerability Change Message.

– Removed Vulnerability Reference Data Block.

– Removed instructions for using manage_estreamer.pl to change the interface used by eStreamer.

• Replaced the following blocks:

– Replaced Correlation Event for 5.1-5.3.x with Correlation Event for 5.4+, which has Geolocation, Security Context, and SSL fields.

– Replaced Malware Event Data Block 5.3.1 with Malware Event Data Block 5.4+, which has SSL and file archive fields.

– Replaced File Event for 5.3.1 with File Event for 5.4+, which has SSL and file archive fields.

– Replaced Intrusion Event Record 5.3.1 with Intrusion Event Record 5.4+, which has SSL fields and a Network Analysis Policy field.

– Replaced Connection Statistics Data Block 5.3.1 with Connection Statistics Data Block 5.4.0.1+, which has VLAN, SSL, and Network Analysis Policy fields.

Using this Guide

At the highest level, the eStreamer service is a mechanism for streaming data from the FireSIGHT System to a requesting client. The service can stream the following categories of data:

• Intrusion event data and event extra data
• Correlation (compliance) event data
• Discovery event data
• User event data
• Metadata for events
• Host information
• Malware event data

Descriptions of the data structures returned by eStreamer make up the majority of this book. The chapters in the book are:

• Understanding the eStreamer Application Protocol, which provides an overview of eStreamer communications, details some of the requirements for writing eStreamer client applications, and describes the four types of messages used to send commands to and receive data from the eStreamer service.
• Understanding Intrusion and Correlation Data Structures, which documents the data formats used to return event data generated by the intrusion detection and correlation components and the data formats used to represent the intrusion and correlation events.
• Understanding Discovery & Connection Data Structures, which documents the data formats used to return discovery, user, and connection event data.
• Understanding Host Data Structures, which documents the data formats that eStreamer uses to return full host information data when it receives a host information request message.
• Configuring eStreamer, which documents how to configure the eStreamer on a Defense Center or managed device. The chapter also documents the eStreamer command-line switches and provides instructions for manually starting and stopping the eStreamer service and for configuring the Defense Center or managed device to start eStreamer automatically.
• Data Structure Examples, which provides examples of eStreamer message packets in binary format.
• Understanding Legacy Data Structures, which documents the structure of legacy data structures that are no longer in use by the currently shipping product but may be used by older clients.

Prerequisites

To understand the information in this guide, you should be familiar with the features and nomenclature of the FireSIGHT System and the function of its components in general, and with the different types of event data these components generate in particular. Definitions of unfamiliar or product-specific terms can frequently be obtained from the FireSIGHT eStreamer Integration Guide.

Product Versions for FireSIGHT System Releases

Version numbers are used throughout this guide to describe the data format for events generated by the Defense Center and managed devices. The FireSIGHT System Product Versions table lists versions for each product by major release.

Document Conventions

The eStreamer Message Data Type Conventions table lists the names used in this book to describe the various data field formats employed in eStreamer messages. Numeric constants used by the eStreamer service are typically unsigned integer values. Bit fields use low-order bits unless otherwise noted. For example, in a one-byte field containing five bits of flag data, the low-order five bits will contain the data.