Table of Contents

Introduction to Database Access

Setting Up Database Access

Schema � System-Level Tables

Schema � Intrusion Event Tables

Schema � Statistics Tracking Tables

Schema � Discovery and Network Map Tables

Schema � Connection Log Tables

Schema � User Activity Tables

Schema - Correlation Logs

Schema � File Event Tables

Appendix A: Deprecated Tables

Title Page for the Database Access Guide

Introduction

The FireSIGHT System® database access feature allows you to query intrusion, discovery, user activity, correlation, connection, vulnerability, and application and URL statistics database tables on a Cisco Defense Center, using a third-party client that supports JDBC SSL connections.

You can use an industry-standard reporting tool such as Crystal Reports, Actuate BIRT, or JasperSoft iReport to design and submit queries. Or, you can configure your own custom application to query Cisco data under program control. For example, you can build a servlet to report intrusion and discovery event data periodically or refresh an alert dashboard.

Note that you can connect to multiple Defense Centers with a single client, but you must configure access to each one individually.

When deciding which appliance or appliances to connect to, keep in mind that querying the database on a Cisco appliance reduces available appliance resources. You should carefully design your queries and submit them at times consistent with your organization’s priorities.

For more information, see the following sections:

- Major Changes for Database Access in Version 5.4

- Prerequisites

- Where Do I Begin?

Major Changes for Database Access in Version 5.4

If you are upgrading your FireSIGHT System deployment from Version 5.3.1 to Version 5.4, please note the following changes, some of which may require you to update your queries.

Modified Fields for Version 5.4

can contain UTF-8 characters.

Modified Tables for Version 5.4

The table below lists changes to database access tables in Version 5.4.

Table 1-1 Summary of Changes to Tables in Version 5.4

Table

Description of Changes

application_host_map

field

connection_log

Added the following fields:

- access_control_policy_uuid

- cert_valid_start_date

- cert_valid_end_date

- network_analysis_policy_name

- network_analysis_policy_UUID

- ssl_actual_action

- ssl_cipher_suite

- ssl_expected_action

- ssl_flow_flags

- ssl_flow_messages

- ssl_flow_status

- ssl_issuer_common_name

- ssl_issuer_country

- ssl_issuer_organization

- ssl_issuer_organization_unit

- ssl_policy_action

- ssl_policy_name

- ssl_policy_reason

- ssl_rule_action

- ssl_rule_name

- ssl_serial_number

- ssl_server_name

- ssl_subject_common_name

- ssl_subject_country

- ssl_subject_organization

- ssl_subject_organization_unit

- ssl_url_category

- ssl_version

si_connection_log

Added the following fields:

- access_control_policy_uuid

- cert_valid_start_date

- cert_valid_end_date

- network_analysis_policy_name

- network_analysis_policy_UUID

- ssl_actual_action

- ssl_cipher_suite

- ssl_expected_action

- ssl_flow_flags

- ssl_flow_messages

- ssl_flow_status

- ssl_issuer_common_name

- ssl_issuer_country

- ssl_issuer_organization

- ssl_issuer_organization_unit

- ssl_policy_action

- ssl_policy_name

- ssl_policy_reason

- ssl_rule_action

- ssl_rule_name

- ssl_serial_number

- ssl_server_name

- ssl_subject_common_name

- ssl_subject_country

- ssl_subject_organization

- ssl_subject_organization_unit

- ssl_url_category

- ssl_version

file_event

Added the following fields:

- cert_valid_start_date

- cert_valid_end_date

- ssl_issuer_common_name

- ssl_issuer_country

- ssl_issuer_organization

- ssl_issuer_organization_unit

- ssl_serial_number

- ssl_subject_common_name

- ssl_subject_country

- ssl_subject_organization

- ssl_subject_organization_unit

fireamp_event

Added the following fields:

- cert_valid_start_date

- cert_valid_end_date

- ssl_issuer_common_name

- ssl_issuer_country

- ssl_issuer_organization

- ssl_issuer_organization_unit

- ssl_serial_number

- ssl_subject_common_name

- ssl_subject_country

- ssl_subject_organization

- ssl_subject_organization_unit

intrusion_event

Added the following fields:

- access_control_policy_UUID

- network_analysis_policy_name

- network_analysis_policy_UUID

Prerequisites

You must fulfill the prerequisites listed in the following sections before you can use the database access feature:

- Licensing

- FireSIGHT System Features and Terminology

- Communication Ports

- Client System

- Query Application

- Database Queries

Licensing

.

FireSIGHT System Features and Terminology

. The user guide also contains additional information about the data in the fields documented in this guide.

Communication Ports

The FireSIGHT System requires the use of specific ports to communicate internally and externally, between appliances, and to enable certain functionality within the network deployment.

After you enable database access on the Defense Center, the system uses ports 1500 and 2000 for the connection that carries JDBC traffic between the client and the appliance.

Client System

.

You must download and unzip a package from the Defense Center that contains the JDBC driver files you will use to connect to the database. The package also contains executable files used to install an SSL certificate for encrypted communication with the Defense Center, and other source files for these utilities.

You should also understand how to change applicable system settings on your computer, such as environment variables.

Query Application

To query the Cisco database, you can use commercially available reporting tools such as Actuate BIRT, JasperSoft iReport, or Crystal Reports, or any other application (including custom applications) that supports JDBC SSL connections. This guide provides the information you need to connect to the database, including the JDBC URL, driver JAR files, driver class, and so on. However, you should refer to your reporting tool documentation for detailed instructions on how to configure a JDBC SSL connection.

Cisco also provides a sample command-line Java application named RunQuery, which you can use to test your database connection, view the schema, and run basic ad hoc queries manually. The RunQuery source code is also a reference for setting up the database connection in a custom Java application. The RunQuery source code is included in the ZIP package that you download from the Defense Center.

recommends against using it as your primary method of querying the database. For information on using RunQuery, refer to the README file included in the ZIP package.

Note that the database access feature uses only the following JDBC functionalities:

- database metadata, which includes information such as schema, version, and supported features

- SQL query execution

Database access does not use any other JDBC functionality, including stored procedures, transactions, batch commands, multiple result sets, or insert/update/delete functions.

Database Queries

statements on single tables and on multiple tables using join conditions.

To assist you, this guide contains information on supported MySQL query syntax, the Cisco database schema, allowed joins, and other important query-related requirements and limitations.

Where Do I Begin?

After you have met the prerequisites described in Prerequisites, you can begin configuring your client system to connect to a Defense Center.

Setting Up Database Access explains how to configure the appliance to allow access, how to configure your client system to connect to the appliance, and how to configure your reporting application to connect to the appliance. It also contains some basic query instructions and information on supported MySQL syntax.

The rest of the guide contains schema and join information for the database and sample queries, and is split into the following chapters:

- Schema: System-Level Tables contains schema and join information for system-level tables such as the audit log and health events.

- Schema: Intrusion Tables contains schema and join information for intrusion-related tables.

- Schema: Statistics Tracking Tables contains schema and join information for application, URL, and user statistics tables.

- Schema: Discovery Event and Network Map Tables contains schema and join information for tables that contain discovery event and network map information, that is, information on your network assets.

- Schema: Connection Log Tables contains schema and join information for tables that contain connection event and connection summary event information.

- Schema: User Activity Tables contains schema and join information for tables that contain user discovery and identity data.

- Schema: Correlation Tables contains schema and join information for correlation-related tables, including white list events and violations and remediation status data.

- Schema: File Event Tables contains schema and join information for the table that contains file events.

Setting Up Database Access

To obtain read-only access to the database, you must first configure the appliance to allow access. Then, you must configure your client system to connect to the appliance by downloading the JDBC driver and accepting the SSL certificate from the appliance you want to access. Finally, you must configure your reporting application to connect to the appliance.

Note Before you set up database access, you should make sure you have fulfilled the prerequisites described in Prerequisites.

For more information, see the following sections:

- Deciding Which Appliance to Access

- Creating a Database User Account

- Enabling Database Access on the Defense Center

- Downloading the JDBC Driver

- Installing the Client SSL Certificate

- Connecting to the Database Using a Third-Party Application

- Connecting to the Database Using a Custom Program

- Querying the Database

- Sample Queries

Deciding Which Appliance to Access

You can connect to multiple appliances with a single client, but you must configure each appliance individually to allow access.

To decide which appliance or appliances to connect to, keep in mind that the available data on the appliance depends on the licenses you have installed, and on your configuration of the FireSIGHT System.

The following list outlines some of the specific reasons why a query may not return results:

- Your query is too specific. For example, you may need to adjust the time range or IP address range of a query.

- Not all of the fields for an event may be populated, depending on the network traffic that caused an event to be generated. For example, not all connection events contain payload information.

- The appliance does not have the appropriate license. For example, network discovery and user identity-related events are not logged to the database unless you have installed the appropriate feature licenses.

- You have not configured the FireSIGHT System to log the event type you are querying. For example:

– Logging intrusion events, discovery-related events, and health events requires that you apply the appropriate policy.

– Logging network discovery events and host input events is configurable in the system policy. Note that logging is enabled by default.

– Logging user identity data requires that you configure network discovery.

– Transmitting packet data for intrusion events requires you to enable that option when adding a managed device to the Defense Center.

– Generating and logging correlation events, compliance white list events, and remediation status events requires that you add rules or responses to an active correlation policy.

– To log connection events, you must enable logging of connections in your access control rules and for the default action in your access control policy. Your managed devices are not receiving network traffic that causes events to be generated.

– Database limits are set to zero in the system policy on the appliance you are querying.

– Your managed devices are not receiving network traffic that causes events to be generated.

.

Creating a Database User Account

Any

for information on creating the user account and viewing the permissions in a given user role.

Tip Users assigned the predefined Administrator role have the External Database User permission by default.

for information on changing passwords. The following table describes some of the options for locally created users to regulate passwords and account access.

Table 2-1 User Account Password Options

Option

Description

Use External Authentication Method

Select this option if you want this user’s credentials to be externally authenticated.

Note If you select this option for the user and the external authentication server is unavailable, that user can log into the web interface but cannot access any functionality.

Maximum Number of Failed Logins

to allow an unlimited number of failed logins.

Minimum Password Length

indicates that no minimum length is required.

Days Until Password Expiration

, which indicates that the password never expires.

Days Before Expiration Warning

days.

Caution The number of warning days must be less than the number of days before the password expires.

Force Password Reset on Login

Select this option to force users to change their passwords the first time they log in.

Check Password Strength

Select this option to require strong passwords. A strong password must be at least eight alphanumeric characters of mixed case and must include at least one numeric character and one special character. It cannot be a word that appears in a dictionary or include consecutive repeating characters.

Exempt from Browser Session Timeout

Select this option if you do not want a user’s login sessions to terminate due to inactivity. Users with the Administrator role cannot be made exempt.

.

Enabling Database Access on the Defense Center

Any

After you create an External Database user, you must configure the Defense Center to allow access to the database on the appliance. You must also configure a database access list on the appliance and add all host IP addresses that will query the external database.

To enable database access:

Admin

.

.

The Database Settings menu appears.

check box.

field appears.

field, depending on your third-party application requirements. You cannot use an IPv6 address as you cannot use an IPv6 address to install a certificate.

If you type an FQDN, you must make sure that the client can resolve the FQDN of the Defense Center. If you type an IP address, you must make sure that the client can connect to the Defense Center using the IP address.

.

field.

field, you have the following options, depending on the IP addresses you want to add:

- an exact IPv4 address (for example, 192.168.1.101 )

- an exact IPv6 address (for example, 2001:DB8::4 )

- an IP address range using CIDR notation (for example, 192.168.1.1/24 )

- For information on using CIDR in the FireSIGHT System, see IP Address Conventions in the FireSIGHT System User Guide .

- any , to designate any IP address

.

The IP address is added to the database access list.

).

.

The database access settings are saved.

Step 10 Continue with the procedure in the next section, Downloading the JDBC Driver.

Downloading the JDBC Driver

Any

After you create an External Database user and configure the Defense Center to allow database access, download the JDBC driver to the client system. You must use this JDBC driver to connect to the database.

To download the JDBC driver:

Admin

.

.

The Database Settings menu appears.

package.

). The package contains the following directories:

- bin , which contains a sample client called RunQuery, as well as the executable files you use to install the certificate for encrypted communication between your client and the Defense Center

- lib , which contains JDBC driver JAR files

- src , which contains source code for the executable files in the bin directory

Step 5 Continue with the procedure in the next section, Installing the Client SSL Certificate.

Installing the Client SSL Certificate

directory of the currently running JRE:

$JAVA_HOME/jre[version]/lib/security

The following represent common locations of the keystore for computers running Microsoft Windows and UNIX, respectively:

- C:\Program Files\Java\jre[version]\lib\security\jssecacerts

- /var/jre[version]/lib/security/jssecacerts

Note If the Java query application you plan to use to access the database access function uses a different JRE, you must copy the keystore to the security directory of the other JRE.

To install the SSL certificate using InstallCert:

Step 1 On your computer, open a command line interface.

directory created when you unpacked the ZIP package.

Step 3 To install the Defense Center’s SSL certificate, type the following and press Enter:

java InstallCert defense_center

is either the FQDN or the IP address of the Defense Center. InstallCert does not support IPv6 addresses. If you are on an IPv6 network, you must use a resolvable hostname.

Output similar to the following example from a computer running Microsoft Windows appears:

You are prompted to view the certificate.

Step 4 Optionally, view the certificate.

You are prompted to accept the certificate.

Step 5 Accept the certificate.

The certificate is accepted, and output similar to the following example from a computer running Microsoft Windows appears:

). You will need this information later.

Step 6 You have the following options:

- If you have a third-party application, continue with the procedure in the next section, Connecting to the Database Using a Third-Party Application.

- If you have a custom application, continue with the procedure in Connecting to the Database Using a Custom Program.

Connecting to the Database Using a Third-Party Application

After you install the certificate, you can query the database on a Defense Center using any third-party client that supports JDBC SSL connections. The following table lists information you may need to configure a connection between your client and the Defense Center.

Table 2-2 Connection Information for Database Access Clients

Information

Description

JDBC URL

The following JDBC URL identifies the Cisco database so the JDBC driver on your client can establish a connection with it:

is either the FQDN or the IP address for the Defense Center.

JDBC driver JAR files

You must use the following JAR files when you configure a connection to the Cisco database:

- vjdbc.jar

- commons-logging-1.1.jar

file you downloaded and unpacked, as described in Downloading the JDBC Driver.

JDBC driver class

You must use the following driver class when you configure a connection to the Cisco database:

user name and password

To connect to the database on an appliance, use a user account that has the External Database User permission. For more information, see Creating a Database User Account.

The following sections contain tips for connecting to the Cisco database using three popular industry-standard reporting tools. Whether you use one of these tools or another Java-based application, you should refer to the documentation for your reporting tool for detailed instructions on how to create a JDBC SSL connection.

Crystal Reports

The following is valid for installing Crystal Reports 2011 on a 32-bit Windows environment. If you run a 64-bit Windows environment, the filepaths may be different.

To allow Crystal Reports 2011 to connect to the Cisco database, you must:

as the database name.

JasperSoft iReport

To allow iReport to connect to the Cisco database, you must:

– Add the JDBC driver JAR files that you downloaded from the Defense Center to the iReport classpath.

– Add a new JDBC driver using the JDBC driver JAR files that you downloaded from the Defense Center. After you add the driver files, iReport should find the correct driver class.

– Create a new database connection using the driver you just created.

Actuate BIRT

To allow BIRT to connect to the Cisco database, you must:

template.

profile type.

data source type.

Tip If you cannot select the Cisco driver class when creating a new JDBC data source profile, add the driver using the JDBC driver JAR files you downloaded from the Defense Center.

Connecting to the Database Using a Custom Program

directory of the ZIP package you downloaded from the Defense Center. See Downloading the JDBC Driver.

Note RunQuery is a sample client only, not a fully featured reporting tool. Cisco strongly recommends against using it as your primary method of querying the database. For information on using RunQuery, refer to the README file included in the ZIP package.

See the following for more information on connecting to the database using a custom program:

- Sample Code for Custom Java Programs describes the Java classes and methods that the RunQuery application uses to set up the database connection and submit queries.

- Running the Application discusses environment requirements necessary for your Java application to execute.

Sample Code for Custom Java Programs

The RunQuery source code uses the functions discussed below. These code samples illustrate one of several possible implementation approaches.

Dynamically setting the SSL provider connection

After you install the SSL security certificate on your client (see Installing the Client SSL Certificate), you can dynamically register your JSSE provider with the following line in your program:

Security.addProvider(new com.sun.net.ssl.internal.ssl.

Provider());

Initializing the JDBC driver for your program

method, as follows:

Class.forName("com.sourcefire.vjdbc.VirtualDriver").newInstance();

If your program launches from the command line, the user supplies the JDBC class as follows:

java -Djdbc.drivers=“com.sourcefire.vjdbc.VirtualDriver” program_name ...

is the name of your program.

Connecting the program to the database

method as follows to establish the connection and get the connection object:

Connection conn = DriverManager.getConnection(“jdbc:vjdbc:rmi://my_dc:2000/VJdbc,eqe”, “user”, “password”);

is the account password.

Querying the data in the Cisco tables

Create an SQL query object to submit the query and assign the retrieved records to a result set, as follows:

Statement stmt = conn.createStatement();

ResultSet rs = stmt.executeQuery(“sql”);

is the SQL query. See Querying the Database for supported SQL functions.

Producing the results of a table query

) generated by the above query, you can output the fields as follows:

while(rs.next())

{

for(int i=1; i<= md.getColumnCount(); i++)

{

System.out.print(rs.getString(i) + " ");

}

System.out.print("\n");

}

Getting schema information

Your program can list the tables in the database, as follows:

DatabaseMetaData metaData = conn.getMetaData();

ResultSet tables = meta.getTables(null, null, null, null);

while (tables.next())

{

System.out.println(tables.getString("TABLE_NAME"));

}

Your program can list a table’s columns, as follows:

ResultSet columns = metaData.getColumns(null, null, "table_name", null);

is the name of the database table.

Running the Application

on the client computer to include the current directory and the locations of your application’s JAR files.

as follows:

To run the application in a Unix environment:

Step 1 Use the following command:

export CLASSPATH=$CLASSPATH:.:path/lib/vjdbc.jar:path/lib/commons-logging-1.1.jar

is the directory path where you unpacked the ZIP package downloaded from the Defense Center.

To run the application in a Windows 7 environment:

.

window appears.

.

window appears.

tab.

.

window appears.

.

window appears.

field:

.;path\bin;.;path\lib\vjdbc.jar;.;path\lib\commons-logging-1.1.jar;.;path\lib

is the directory path where you unpacked the ZIP package downloaded from the Defense Center.

to save the value.

The Environment Variables window appears.

to save the value. You can now run the application.

Querying the Database

The following sections contain information on supported query syntax and other important query-related requirements and limitations:

- Supported SHOW Statement Syntax describes the supported MySQL SHOW statement syntax for querying the Cisco database.

- Supported DESCRIBE or DESC Statement Syntax describes the supported MySQL DESCRIBE statement syntax for querying the Cisco database.

- Supported SELECT Statement Syntax describes the supported MySQL SELECT statement syntax for querying the Cisco database.

- Join Constraints describes the joins supported for querying the Cisco database and explains how to get information on the specific allowed joins for any table.

- Querying Data Stored in Unfamiliar Formats describes how to perform queries on data stored in formats that may be unfamiliar (including UNIX timestamps and IP addresses) so your queries are successful and your results appear as expected.

- Limiting Queries for Performance Reasons contains recommendations on constraining your queries so as not to degrade the performance of the FireSIGHT System.

- Query Tips contains tips for querying intrusion events across several appliances.

For schema information and allowed joins, see the following chapters:

- Schema: System-Level Tables

- Schema: Intrusion Tables

- Schema: Statistics Tracking Tables

- Schema: Discovery Event and Network Map Tables

- Schema: Connection Log Tables

- Schema: User Activity Tables

- Schema: Correlation Tables

Supported SHOW Statement Syntax

statement syntax you can use when querying the Cisco database:

SHOW TABLES;

statement syntax not listed above is not supported.

Supported DESCRIBE or DESC Statement Syntax

statement syntax you can use when querying the Cisco database:

:

Table 2-3 Supported DESCRIBE Statement Syntax

Where...

Is...

the name of a table you are querying

statement syntax not listed above is not supported. In particular, the FireSIGHT System database access feature does not support:

- the INDEX FOR clause

- the TABLE clause

- the PROCEDURE clause

Supported SELECT Statement Syntax

statement syntax you can use when querying the Cisco database:

statement.

Table 2-4 Supported SELECT Statement Syntax

Where...

Is...

the name of a field you are querying

one of:

- table_reference INNER JOIN table_reference join_condition

- table_reference LEFT [OUTER] JOIN table_reference join_condition

the name of a table you are querying

an equality comparison between fields that are join-compatible; see Join Constraints for more information

one of:

- IS NULL or IS NOT NULL

- NOT, !

- BETWEEN ... AND ...

- LIKE

- =, !=, <>, >, >=, <, <=

If you are not familiar with how supported MySQL syntax is expressed, see the following table for tips.

Table 2-5 MySQL Syntax Format

These symbols...

That is...

Represent...

brackets

[]

an optional clause or argument

curly brackets

{}

a required clause or argument

pipe

|

a choice between clauses or arguments

statement syntax not listed above is not supported. In particular, the FireSIGHT System database access feature does not support:

- SELECT * , that is, you must explicitly specify fields

- unions

- subqueries

- the WITH ROLLUP modifier to the GROUP BY clause

- the INTO clause

- the FOR UPDATE clause

Join Constraints

The joins you can perform on Cisco database tables are limited, for performance and other practical reasons. Cisco does not allow you to perform joins where the result is not likely to be useful for event analysis.

supported.

tables on IP address fields, even though both tables contain IP address information. In addition, joins on deprecated tables and deprecated fields are not listed.

Querying Data Stored in Unfamiliar Formats

The Cisco database stores some data in formats that may not be display-friendly. The following sections detail how to perform queries on various fields so your queries are successful and your results appear as expected:

- IPv6 Addresses

- IPv4 Addresses

- MAC Addresses

- Packet Data

- UNIX Timestamps

IPv6 Addresses

function.

table, which contains information on monitored sessions, constraining the query by a specific IPv6 address:

IPv4 Addresses

.

MAC Addresses

function.

table, which contains information on hosts with MAC addresses that are not identified with an IP address, limiting the query to the first five hosts:

Packet Data

function.

table to obtain packet data for a particular event:

UNIX Timestamps

function.

table, which keeps a record of all user actions on the web interface of an appliance, and returns up to 25 results:

function is allowed, it only provides results in UTC.

table:

function.

Limiting Queries for Performance Reasons

Although the system limits the joins you can perform on Cisco database tables, it does still allow some expensive queries - queries that may negatively impact the performance of your Defense Center.

Therefore, you should try to limit the result set for large tables. Strategies include:

- constraining queries to a specific time range

- constraining queries by IP address

- using the LIMIT clause

Depending on your deployment, querying many tables may require a limited result set. In particular, the following tables can contain up to 100 million events on a DC3000:

- fireamp_event

- intrusion_event

- intrusion_event_packet

- connection_log (pre-Version 5.0 name: rna_flow )

- connection_summary (pre-Version 5.0 name: rna_flow_summary )

Queries on network map tables may also be expensive, depending on the number of hosts the system has detected on your monitored network.

Query Tips

The following sections provide tips on ensuring unique results when you build queries that include detection engines or intrusion events.

Device Names

Device names are not necessarily unique across multiple Defense Centers. To ensure uniqueness, include a specific device UUID in your query.

Intrusion Events

table:

Sample Queries

The following sections contain sample queries that illustrate how you can use the database access feature:

- Audit Records for a User

- Intrusion Events by Priority and Classification

- Intrusion Events and Their Associated Policies

- Lists of Detected Hosts

- List of Detected Servers

- Server Vulnerabilities on Your Network

- Operating System Summary

- Operating System Vulnerabilities for a Host

- Host Violation Count

Caution Performing some of these sample queries may be expensive, depending on your deployment. See Limiting Queries for Performance Reasons for more information.

Audit Records for a User

The following query returns all records in the audit log for a particular user, displaying all timestamps in UTC:

Intrusion Events by Priority and Classification

on the Defense Center web interface:

Intrusion Events and Their Associated Policies

The following query lists intrusion events from the specified week. For each event it shows the associated intrusion policy violation and rule classification.

Lists of Detected Hosts

The following query returns the basic information in the hosts network map for all MAC hosts (hosts without an IP address) detected on your network, along with the hardware vendor for each NIC:

The following query maps IP addresses to MAC addresses:

List of Detected Servers

The following query joins two related tables to give you a list of the servers detected on your network along with many of their attributes, similar to what you can see in a table view of servers on the Defense Center’s web interface:

, as required by Database Access. See rna_host_service Joins and rna_host_service_info Joins.

Server Vulnerabilities on Your Network

The following query joins two vulnerability-related tables to give you a list of valid server-related vulnerabilities detected for a particular host, along with whether each vulnerability is exploitable across a network:

, as required by rna_host_service_vulns and rna_vuln Joins.

Operating System Summary

:

Operating System Vulnerabilities for a Host

The following query joins two vulnerability-related tables to give you a list of valid operating system-related vulnerabilities detected for a particular host, along with whether each vulnerability is exploitable across a network:

, as required by Database Access. See rna_host_os_vulns and rna_vuln Joins.

Host Violation Count

on the Defense Center’s web interface.

Schema: System-Level Tables

This chapter contains information on the schema and supported joins for system-level functions, including auditing, appliance health monitoring, malware detection, and logging of security updates.

For more information, see the sections listed in the following table.

Table 3-1 Schema for System-Level Tables

See...

For the table that stores information on...

Version

audit_log

User interactions with the appliance’s web interface.

4.10.x+

fireamp_event

FireAMP malware detection and quarantine events.

5.1+

health_event

Health status events for monitored appliances.

4.10.x+

sru_import_log

Rule updates that have been imported on your appliances.

5.0+

audit_log

table contains information on FireSIGHT System users’ interactions with the web interface. Keep in mind that the audit log stores records for the local appliance only, not for managed appliances.

For more information, see the following sections:

- audit_log Fields

- audit_log Joins

- audit_log Sample Query

audit_log Fields

table.

Table 3-2 audit_log Fields

Field

Description

The UNIX timestamp of the date and time the appliance generated the audit record.

The action the user performed.

The IP address of the web interface user’s host, in dotted-decimal notation.

The menu path the user followed to generate the audit record.

The user name of the user who triggered the audit event.

audit_log Joins

table.

audit_log Sample Query

The following query returns up to the 25 most recent audit log entries, sorted by time.

fireamp_event

table contains information on malware events. These events contain information on malware detected or quarantined within a cloud, the detection method, and hosts and users affected by the malware. New fields were added to identify the application which triggered the event, how the event is handled, and to correlate the event with connection, intrusion, and file events.

For more information, see the following sections:

- fireamp_event Fields

- fireamp_event Joins

- fireamp_event Sample Query

fireamp_event Fields

table.

Table 3-3 fireamp_event Fields

Field

Description

ID number that maps to the application performing the file transfer.

Name of the application performing the transfer.

The Unix timestamp on which the SSL certificate used in the connection ceases to be valid.

The Unix timestamp when the SSL certificate used in the connection was issued.

The internal identification number for the client application, if applicable.

The name of the client application, if applicable.

value.

value.

UNIX timestamp (seconds since 00:00:00 01/01/1970) of the connection event associated with the malware event.

Specific counter for the event, used to distinguish among multiple events that happened during the same second.

The name of the detected or quarantined malware.

. The possible display values and the associated IDs are:

- ClamAV — 128

- ETHOS — 8

- SPERO — 32

- SHA — 4

- Tetra — 64

value. The possible display values and the associated types are:

- 4 — SHA

- 8 — ETHOS

- 32 — SPERO

- 64 — Tetra

- 128 — ClamAV

Value that indicates whether the file was uploaded or downloaded. Can have the following values:

- Download

- Upload

Currently the value depends on the protocol (for example, if the connection is HTTP it is a download).

The malware status of the file. Possible values include:

- CLEAN — The file is clean and does not contain malware.

- UNKNOWN — It is unknown whether the file contains malware.

- MALWARE — The file contains malware.

- UNAVAILABLE — The software was unable to send a request to the Cisco cloud for a disposition, or the Cisco cloud services did not respond to the request.

- CUSTOM SIGNATURE — The file matches a user-defined hash, and is treated in a fashion designated by the user.

The name of the continent of the destination host.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the destination host.

Name of the country of the destination host.

.

A binary representation of the IPv4 or IPv6 address for the destination of the connection.

Port number for the destination of the connection.

The user determined by the Cisco FireAMP agent if the event was detected by the Cisco cloud. This user is not associated with LDAP and does not appear in the discovered_users table.

The additional event information associated with the event type.

The internal unique ID of the FireAMP event.

value. The possible display values and the associated IDs are:

- Create — 1

- Execute — 2

- Move — 22

- Scan — 4

value. The possible display values and the associated subtypes are:

- 1 — Create

- 2 — Execute

- 4 — Scan

- 22 — Move

value. The possible display values and the associated IDs are:

- Blocked Execution — 553648168

- Cloud Recall Quarantine — 553648155

- Cloud Recall Quarantine Attempt Failed — 2164260893

- Cloud Recall Quarantine Started — 553648147

- Cloud Recall Restore from Quarantine — 553648154

- Cloud Recall Restore from Quarantine Failed — 2164260892

- Cloud Recall Restore from Quarantine Started — 553648146

- FireAMP IOC — 1107296256

- Quarantine Failure — 2164260880

- Quarantined Item Restored — 553648149

- Quarantine Restore Failed — 2164260884

- Quarantine Restore Started — 553648150

- Scan Completed, No Detections — 554696715

- Scan Completed With Detections — 1091567628

- Scan Failed — 2165309453

- Scan Started — 554696714

- Threat Detected — 1090519054

- Threat Detected in Exclusion — 553648145

- Threat Detected in Network File Transfer — 1

- Threat Detected in Network File Transfer (Retrospective) — 2

- Threat Quarantined — 553648143

value. The possible display values and the associated types are:

- 553648143 — Threat Quarantined

- 553648145 — Threat Detected in Exclusion

- 553648146 — Cloud Recall Restore from Quarantine Started

- 553648147 — Cloud Recall Quarantine Started

- 553648149 — Quarantined Item Restored

- 553648150 — Quarantine Restore Started

- 553648154 — Cloud Recall Restore from Quarantine

- 553648155 — Cloud Recall Quarantine

- 553648168 — Blocked Execution

- 554696714 — Scan Started

- 554696715 — Scan Completed, No Detections

- 1090519054 — Threat Detected

- 1091567628 — Scan Completed With Detections

- 1107296256 — FireAMP IOC

- 2164260880 — Quarantine Failure

- 2164260893 — Cloud Recall Quarantine Attempt Failed

- 2164260884 — Quarantine Restore Failed

- 2164260892 — Cloud Recall Restore from Quarantine Failed

- 2165309453 — Scan Failed

The name of the detected or quarantined file. This name can contain UTF-8 characters.

The file path, not including the file name, of the detected or quarantined file.

The SHA-256 hash value of the detected or quarantined file.

The size in bytes of the detected or quarantined file.

The creation timestamp of the detected or quarantined file.

The file type of the detected or quarantined file.

The internal ID of the file type of the detected or quarantined file.

Numerical ID of the Snort instance on the managed device that generated the event.

Number of indications of compromise found in the event.

The name of the file accessing the detected or quarantined file when detection occurred.

The SHA-256 hash value of the parent file accessing the detected or quarantined file when detection occurred.

Identification number that acts as a unique identifier for the access control policy that triggered the event.

field.

based on the potentially malicious behaviors observed during dynamic analysis.

Description of the security context (virtual firewall) that the traffic passed through. Note that the system only populates this field for ASA FirePOWER devices in multi-context mode.

IP address of the device that generated the event.

ID of the device that generated the event.

when the event refers to the reporting device itself, rather than to a connected device.

.

The name of the continent of the source host.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the source host.

Name of the country of the source host.

for all queries.

A binary representation of the IPv4 or IPv6 address for the source of the connection.

Port number for the source of the connection.

Issuer Common Name from the SSL certificate. This is typically the host and domain name of the certificate issuer, but may contain other information.

The country of the SSL certificate issuer.

The organization of the SSL certificate issuer.

The organizational unit of the SSL certificate issuer.

The serial number of the SSL certificate, assigned by the issuing CA.

Subject Common name from the SSL certificate This is typically the host and domain name of the certificate subject, but may contain other information.

The country of the SSL certificate subject.

The organization of the SSL certificate subject.

The organizational unit of the SSL certificate subject.

Name of the threat.

The FireAMP event generation timestamp.

The URL of the source of the connection.

table.

The name of the user who last logged into the host that sent or received the file.

The internal identification number for the web application, if applicable.

Name of the web application, if applicable.

fireamp_event Joins

table.

Table 3-4 fireamp_event Joins

You can join this table on...

And...

or

fireamp_event Sample Query

in ascending order.

health_event

table contains information on health events generated by the FireSIGHT System.

For more information, see the following sections:

- health_event Fields

- health_event Joins

- health_event Sample Query

health_event Fields

table.

Table 3-5 health_event Fields

Field

Description

.

The UNIX timestamp of the date and time the Defense Center generated the health event.

The internal identification number for the event.

The name of the health module that generated the event.

when the health event refers to the reporting device itself, rather than to a connected one.

.

. Values are:

- red — Critical status. Limits have been exceeded for at least one health module on the appliance and the problem has not been corrected.

- yellow — Warning status. Limits have been exceeded for at least one health module on the appliance and the problem has not been corrected.

- green — Normal status. All health modules on the appliance are running within the limits configured in the health policy applied to the appliance.

- recovered — All health modules on the appliance are running within the limits configured in the health policy applied to the appliance, including modules that were in a Critical or Warning state.

- disabled — Either the appliance is disabled or blacklisted, or is currently unreachable, or has no health policy applied to it.

- error — At least one health monitoring module has failed on the appliance and has not been successfully re-run since the failure occurred

(of Disk Usage).

.

health_event Joins

table.

health_event Sample Query

The following query returns up to the 25 most recent health events logged within the defined time frame.

sru_import_log

table starting with Version 5.0 of the FireSIGHT System.

For more information, see the following sections:

- sru_import_log Fields

- sru_import_log Joins

- sru_import_log Sample Query

sru_import_log Fields

table.

Table 3-6 sru_import_log Fields

Field

Description

Indicates the action that has occurred for the imported rule update object type:

- apply — The Reapply intrusion policies after the Rule Update import completes option was enabled for the import

- changed — For a rule update component or rule, the rule update component was modified, or the rule has a higher revision number and the same GID and SID

- collision — For a rule update component or rule, import was skipped because its revision conflicts with an existing component or rule on the appliance

- deleted — For rules, the rule has been deleted from the rule update

- disabled — For rules, the rule has been disabled in a default policy provided by Cisco

- drop — For rules, the rule has been set to Drop and Generate Events in a default policy provided by Cisco

- enabled — For a rule update, edit, a preprocessor, rule, or other feature provided by the rule update has been enabled in a default policy provided by Cisco

- error — For a rule update or local rule file, the import failed

- new — For a rule, this is the first time the object has been stored on this appliance

Either a comment string unique for the change applied by the imported rule update to the component or rule, or blank, for a rule that has not changed.

The GID for the generator for a rule.

The UNIX timestamp of the date and time the rule update import was logged.

The name of the imported object. For rules, this corresponds to the rule message. For rule update components, this is the component name, such as online help or Snort.

, indicating that a rule is included in all default policies.

Revision number for a rule.

The SID for a rule or set of rules, decoder, or preprocessor.

Descriptive name of the rule update.

A unique identifier for the rule update.

, and so forth.

sru_import_log Joins

table.

sru_import_log Sample Query

The following query returns up to 25 results in descending order, sorted by timestamp.

Schema: Intrusion Tables

This chapter contains information on the schema and supported joins for intrusion events, the packets that triggered the events, and the associated rule messages.

For more information, see the sections listed in the following table.

Table 4-1 Schema for Intrusion Tables

See...

For the table that stores information on...

Version

intrusion_event

Intrusion events, which include the date, time, type of exploit, and contextual information about the source and target of an attack.

4.10.x+

intrusion_event_packet

The content of the packet or packets that triggered an intrusion event.

4.10.x+

rule_message

Rule messages for intrusion events, including the associated generator ID (GID), signature ID (SID), and version data.

4.10.x+

rule_documentation

Information on rules, including the attack scenarios, affected systems, and information on when the rule was created and by whom.

5.2+

intrusion_event

table contains information on possible intrusions identified by the FireSIGHT System. For each possible intrusion, the system generates an event and an associated record in the database, which contains the date, time, type of exploit, access control policy and rule, intrusion policy and rule, and other contextual information about the source and target of the attack.

Tip For packet-based events, a copy of the packet or packets that triggered the event may also be available; see intrusion_event_packet Sample Query.

For more information, see the following sections:

- intrusion_event Fields

- intrusion_event Joins

- intrusion_event Sample Query

intrusion_event Fields

table.

Table 4-2 intrusion_event Fields

Field

Description

The access control policy associated with the intrusion policy that generated the intrusion event. Note that the access control policy name and access control rule name combination is unique for a Defense Center.

The UUID of the access control policy associated with the intrusion policy that generated the intrusion event.

The internal identification number of the access control rule associated with the intrusion policy that generated the intrusion event.

The name of the access control rule associated with the intrusion policy that generated the intrusion event. Note that the access control rule name is unique within a policy but not across different policies.

The internal identification number of the application protocol.

One of:

- the name of the application, if a positive identification can be made

- pending if the system requires more data

- blank if there is no application information in the connection

The value indicating what happened to the packet that triggered the intrusion event:

- 0 — Packet not dropped

- 1 — Packet dropped (inline, switched, or routed deployment)

- 2 — Packet that triggered the event would have been dropped, if the intrusion policy had been applied to a device configured in inline, switched, or routed deployment

The internal identification number of the client application that was used in the intrusion event.

The client application, if available, that was used in the intrusion event. One of:

- the name of the application, if a positive identification can be made

- a generic client name if the system detects a client application but cannot identify a specific one.

- null if there is no application information in the connection

UNIX timestamp (seconds since 00:00:00 01/01/1970) of the connection event associated with the intrusion event.

Number that is incremented for each connection event in a given second, and is used to differentiate among multiple connection events that happen during the same second.

for all queries.

for all queries.

The name of the continent of the destination host.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the destination host.

Name of the country of the destination host.

, but it is not reliable.

, but it is not reliable.

A binary representation of the IPv4 or IPv6 address for the destination host involved in the triggering event.

Either:

- the destination port number, if the event protocol type is TCP or UDP

- the ICMP code, if the event protocol type is ICMP

The department of the destination user.

The email address of the destination user.

The first name of the destination user.

The internal identification number for the destination user; that is, the user who last logged into the destination host before the intrusion event occurred.

The last name of the destination user.

The UNIX timestamp of the date and time when the system last reported a login for the destination user.

The UNIX timestamp of the date and time when the system last updated the destination user’s record.

The user name for the destination user.

The telephone number for the destination user.

The internal identification number for the event. Uniquely identifies an event on the Defense Center.

The UNIX timestamp of the date and time when the event packet was captured.

.

if the event was not generated from ICMP traffic.

if the event was not generated from ICMP traffic.

The impact flag value of the event. Integer values are:

- 1 — Red (vulnerable)

- 2 — Orange (potentially vulnerable)

- 3 — Yellow (currently not vulnerable)

- 4 — Blue (unknown target)

- 5 — Gray (unknown impact)

Numerical ID of the Snort instance on the managed device that generated the event.

The name of the interface for the outbound traffic.

The name of the interface for the inbound traffic.

A unique identifier for the intrusion policy that triggered the intrusion event.

The intrusion policy that generated the intrusion event.

Number of indications of compromise found in the event.

network_analysis_policy_name

The network analysis policy associated with the intrusion policy that generated the intrusion event.

network_analysis_policy_UUID

The UUID of the network analysis policy associated with the intrusion policy that generated the intrusion event.

The priority for the rule classification associated with the event. Rule priority is set in the user interface.

The text name of the traffic protocol associated with the intrusion event.

.

Whether the intrusion event has been marked as reviewed:

- 1 — Reviewed

- 0 — Not reviewed

.

The identification number for the rule classification associated with the intrusion event.

The component that generated the intrusion event. The generator can be either a rules engine, decoder, or preprocessor.

that generated the intrusion event.

Explanatory text for the event. For rule-based intrusion events, the message is generated from the rule. For decoder- and preprocessor-based events, the message is hard coded.

The revision number of the rule associated with the intrusion event.

The signature ID (SID) for the intrusion event. Identifies the specific rule, decoder message, or preprocessor message that caused the event to be generated.

Description of the security context (virtual firewall) that the traffic passed through. Note that the system only populates this field for ASA FirePOWER devices in multi-context mode.

The egress security zone in the intrusion event that triggered the policy violation.

The ingress security zone in the intrusion event that triggered the policy violation.

.

The name of the managed device that generated the intrusion event.

.

The name of the continent of the destination host.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the destination host.

Name of the country of the destination host.

, but it is not reliable.

, but it is not reliable.

A binary representation of the IPv4 or IPv6 address for the source host involved in the triggering event.

Either:

- the source port number, if the event protocol type is TCP or UDP

- the ICMP type, if the event protocol type is ICMP

The department of the source user.

The email address for the source user.

The first name of the source user.

The internal identification number for the source user; that is, the user who last logged into the source host before the intrusion event occurred.

The last name of the source user.

The UNIX timestamp of the date and time the system last reported a login for the source user.

The UNIX timestamp of the date and time the source user’s record was last updated.

The user name for the source user.

The source user’s phone number.

The identification number of the innermost VLAN associated with the packet that triggered the intrusion event.

The internal identification number of the web application that was used in the intrusion event, if applicable.

The web application that was used in the intrusion event, if applicable. One of:

- the name of the application, if a positive identification can be made

- web browsing if the system detects an application protocol of HTTP but cannot identify a specific web application

- blank if the connection has no HTTP traffic

intrusion_event Joins

table.

Table 4-3 intrusion_event Joins

You can join this table on...

And...

or

or

or

intrusion_event Sample Query

.

intrusion_event_packet

table contains no data.

For more information, see the following sections:

- intrusion_event_packet Fields

- intrusion_event_packet Joins

- intrusion_event_packet Sample Query

intrusion_event_packet Fields

table.

Table 4-4 intrusion_event_packet Fields

Field

Description

for all queries.

for all queries.

The identification number for the event. The ID is unique on a given managed device.

is supported.

The contents of the packet that triggered the event.

The UNIX timestamp of the date and time the event packet was captured.

.

.

The name of the managed device that generated the intrusion event.

.

intrusion_event_packet Joins

table.

intrusion_event_packet Sample Query

The following query returns the packet information for all packets matching the selected event ID.

rule_message

table is a master list of the rule messages for intrusion rules. Each rule message is accompanied by its identifying information.

For more information, see the following sections:

- rule_message Fields

- rule_message Joins

- rule_message Sample Query

rule_message Fields

table.

Table 4-5 rule_message Fields

Field

Description

The GID of the component that triggers the rule.

The message associated with the rule that is triggered.

A unique identifier for the rule revision.

The revision number for the rule.

The rule identification number as it is rendered in the appliance user interface.

A unique identifier for the rule.

rule_message Joins

table.

rule_message Sample Query

.

rule_documentation

table contains information about rules used to generate alerts.

For more information, see the following sections:

- rule_documentation Fields

- rule_documentation Joins

- rule_documentation Sample Query

rule_documentation Fields

table.

Table 4-6 rule_documentation Fields

Field

Description

Additional information and references.

Systems affected by the vulnerability.

Examples of possible attacks.

Contact information for the author of the rule and other relevant documentation.

Information regarding patches, upgrades, or other means to remove or mitigate the vulnerability.

Information regarding the underlying vulnerability, what the rule actually looks for, and what systems are affected.

Whether the attack is considered simple, medium, hard, or difficult, and whether or not it can be performed using a script.

.

.

How a compromise that uses this vulnerability may impact various systems.

Rule revision number.

Rule identification number that corresponds with the event.

Explanation of the threat or vulnerability.

The UNIX timestamp of the date and time the rule was last updated.

rule_documentation Joins

table.

rule_documentation Sample Query

.

Schema: Statistics Tracking Tables

This chapter contains information on the schema and supported joins for application and URL statistics tracking tables. These tables collect statistical information on:

- access control and intrusion events by application and by user

- bandwidth usage and connection decisions by application and by user

- bandwidth usage and connection decisions by URL reputation (risk) and by URL business relevance

For links to details on each table, see the following table.

Table 5-1 Application and URL Statistics Tables

See

For the table that stores statistics on...

Version

app_ids_stats_current_timeframe

Access control and intrusion protection activity, by application and a range of application attributes.

5.0+

app_stats_current_timeframe

Traffic volume and system access control activity (connections allowed or denied), by application and a range of application attributes.

5.0+

geolocation_stats_current_timeframe

Access control activity by location.

5.2+

ids_impact_stats_current_timeframe

Statistics for intrusion events (connections blocked and would have dropped) by impact levels.

5.1.1+

session_stats_current_timeframe

Contain statistics for all connections. Statistics can be extracted based on bytes, connection, sensor, and time.

5.2+

ssl_stats_current_timeframe

Contain statistics for SSL connections. Statistics can be extracted based on bytes, connection, sensor, and time.

5.4+

storage_stats_by_disposition_current_timeframe

Contain statistics for files based on disposition. Statistics can be extracted based on bytes, disposition, sensor, and time.

5.3+

storage_stats_by_file_type_current_timeframe

Contain statistics for files based on file type. Statistics can be extracted based on bytes, file type, sensor, and time.

5.3+

transmission_stats_by_file_type_current_timeframe

Contain statistics for connections based on file type. Statistics can be extracted based on bytes, connection, file type, sensor, and time.

5.3+

url_category_stats_current_timeframe

Traffic volume and system access control activity (connections allowed or denied), by the category of the requested website.

5.0+

url_reputation_stats_current_timeframe

Traffic volume and system access control activity (connections allowed or denied), by the reputation of the requested website.

5.0+

user_ids_stats_current_timeframe

Access control and intrusion protection activity, by user.

5.0+

user_stats_current_timeframe

Traffic volume and system access control activity (connections allowed or denied), by user.

5.0+

Understanding Statistics Tracking Tables

table stores statistics for 30 days.

table has the coarsest resolution (24 hours). See Storage Characteristics for Statistics Tracking Tables for specific information.

Storage Characteristics for Statistics Tracking Tables

See the following table for important details.

Table 5-2 Storage Characteristics of Statistics Tables

Table Type

Interval (Resolution)

Storage Lifespan

current interval plus all intervals in the preceding 24 hours

current interval plus all intervals in the preceding 24 hours

one hour

current hour plus the hours stretching back 30 days

24 hours

current day plus the preceding 360 days

. Interval start times are stored as UNIX timestamps (GMT).

Specifying Time Intervals When Querying Statistics Tables

field in the query.

, the interval varies for each table type:

- for current_day tables: either 6:00:00 to 6:00:14 (for 15 second tables) or 6:00:00 to 6:04:59 (for 5 minute tables).

- for current_month tables: 6:00:00 to 6:59:59 .

- for current_year tables: 0:00:00 to 23:59:59 on the following day.

table, specify one of the following:

If your query contains a timestamp that is other than an interval start time, the system modifies the request as follows:

- rounds up the start time to the nearest interval time

- rounds down the end time to the nearest interval time

For example, the following query rounds up the start time:

and is the same as:

When querying a range of intervals, the starting time interval is rounded up, and the ending time interval is rounded down. For example:

is changed to:

(in day chunks).

app_ids_stats_current_timeframe

tables contain statistics about application activity and intrusion events on your monitored network. Statistics can be extracted per detected application, per application type (application protocol, client application, or web application), and also per risk and business relevance of the application. The tables also track blocked connections due to intrusion policy violations and the estimated potential impact of an intrusion.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- app_ids_stats_current_timeframe Fields

- app_ids_stats_current_timeframe Joins

- app_ids_stats_current_timeframe Sample Query

app_ids_stats_current_timeframe Fields

tables. All tables of this type contain the same fields.

Table 5-3 app_ids_stats_current_timeframe Fields

Field

Description

The internal identification number for the application.

The application name that appears in the user interface.

Number of connections blocked due to violation of an intrusion policy.

is very high.

).

The number of impact level 1 (vulnerable) intrusion events recorded for the application.

The number of impact level 2 (potentially vulnerable) intrusion events.

The number of impact level 3 (host currently not vulnerable) intrusion events.

The number of impact level 4 (unknown target) intrusion events.

The number of impact level 5 (unknown vulnerability) intrusion events.

A true-false flag that indicates if the detected application is a client application.

A true-false flag that indicates if the detected application is an application protocol.

A true-false flag that indicates if the detected application is a web application.

is critical risk.

).

.

ID of the device that provided the event.

The name of the managed device that generated the intrusion event.

.

The UNIX timestamp of the date and time the measurement interval starts. For detailed information, see Specifying Time Intervals When Querying Statistics Tables.

Number of packets that would have been dropped if the intrusion policy had been configured to drop packets in an inline deployment.

app_ids_stats_current_timeframe Joins

tables.

Table 5-4 app_ids_stats_current_timeframe Joins

You can join this table on...

And...

app_ids_stats_current_timeframe Sample Query

table. Each record contains the number of blocked connections and intrusion events for the application over the time interval.

app_stats_current_timeframe

tables contain statistics on bandwidth usage and access control actions (connection allowed or denied), by application and by device that monitored the traffic. You can filter these statistics by the business relevance, estimated risk, and type of the application.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

see the following sections:

- app_stats_current_timeframe Fields

- app_stats_current_timeframe Joins

- app_stats_current_timeframe Sample Query

app_stats_current_timeframe Fields

tables.

Table 5-5 app_stats_current_timeframe Fields

Field

Description

The internal identification number for the application.

The application name that appears in the user interface.

is very high.

).

The bytes of inbound traffic for the application during the specified interval.

The bytes of outbound traffic for the application during the specified interval.

The number of connections allowed.

The number of connections denied due to violation of an access control policy.

A true-false flag that indicates if the detected application is a client application.

A true-false flag that indicates if the detected application is an application protocol.

A true-false flag that indicates if the detected application is a web application.

is critical risk.

).

.

The internal identification number of the managed device that detected the traffic.

The name of the managed device that detected the traffic.

.

The UNIX timestamp of the start of the measurement interval. For information on specifying the start time, see Specifying Time Intervals When Querying Statistics Tables.

app_stats_current_timeframe Joins

tables.

Table 5-6 app_stats_current_timeframe Joins

You can join this table on...

And...

app_stats_current_timeframe Sample Query

The following query returns the inbound and outbound traffic load associated with applications that have low business relevance and high risk in the period of a day, for all managed devices connected to the Defense Center.

geolocation_stats_current_timeframe

tables contain statistics regarding intrusion events based on location levels. Statistics can be extracted based on impact level, device, and how the packets are handled.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- geolocation_stats_current_timeframe Fields

- geolocation_stats_current_timeframe Joins

- geolocation_stats_current_timeframe Sample Query

geolocation_stats_current_timeframe Fields

tables. All tables of this type contain the same fields.

Table 5-7 geolocation_stats_current_timeframe Fields

Field

Description

The total number of bytes transmitted by the session responder.

Total number of bytes transmitted by the session initiator.

The name of the continent of the destination host.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the destination host.

The number of flows allowed.

The number of flows denied due to violation of an access control policy.

.

ID of the device that provided the event.

The name of the managed device that generated the intrusion event.

.

The name of the continent of the source host.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the source host.

The UNIX timestamp of the date and time the measurement interval starts. For detailed information, see Specifying Time Intervals When Querying Statistics Tables.

geolocation_stats_current_timeframe Joins

tables.

geolocation_stats_current_timeframe Sample Query

The following query returns source country and sensor name for the first 25 connection events from Asia during the current day.

ids_impact_stats_current_timeframe

tables contain statistics regarding intrusion events based on impact levels. Statistics can be extracted based on impact level, device, and how the packets are handled.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- ids_impact_stats_current_timeframe Fields

- ids_impact_stats_current_timeframe Joins

- ids_impact_stats_current_timeframe Sample Query

ids_impact_stats_current_timeframe Fields

tables. All tables of this type contain the same fields.

Table 5-8 ids_impact_stats_current_timeframe Fields

Field

Description

Number of connections blocked due to violation of an intrusion policy.

The number of impact level 1 (vulnerable) intrusion events recorded for the application.

The number of impact level 2 (potentially vulnerable) intrusion events.

The number of impact level 3 (host currently not vulnerable) intrusion events.

The number of impact level 4 (unknown target) intrusion events.

The number of impact level 5 (unknown vulnerability) intrusion events.

.

ID of the device that provided the event.

The name of the managed device that generated the intrusion event.

.

The UNIX timestamp of the date and time the measurement interval starts. For detailed information, see Specifying Time Intervals When Querying Statistics Tables.

Number of packets that would have been dropped if the intrusion policy had been set to drop packets in an inline deployment.

ids_impact_stats_current_timeframe Joins

tables.

ids_impact_stats_current_timeframe Sample Query

events during the current day.

session_stats_current_timeframe

tables contain statistics for all connections. Statistics can be extracted based on bytes, connection, sensor, and time.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- session_stats_current_timeframe Fields

- session_stats_current_timeframe Joins

- session_stats_current_timeframe Sample Query

session_stats_current_timeframe Fields

tables. All tables of this type contain the same fields.

Table 5-9 session_stats_current_timeframe Fields

Field

Description

The bytes of inbound traffic during the specified interval.

The bytes of outbound traffic during the specified interval.

The number of connections allowed for the specified URL category.

The number of connections denied for the specified URL category due to violation of an access control policy.

.

.

ID of the device that provided the event.

The name of the managed device that generated the intrusion event.

.

The UNIX timestamp of the date and time the measurement interval starts. For detailed information, see Specifying Time Intervals When Querying Statistics Tables.

session_stats_current_timeframe Joins

tables.

session_stats_current_timeframe Sample Query

during the current day.

ssl_stats_current_timeframe

tables contain statistics for SSL connections. Statistics can be extracted based on bytes, connection, sensor, and time.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- ssl_stats_current_timeframe Fields

- ssl_stats_current_timeframe Joins

- ssl_stats_current_timeframe Sample Query

ssl_stats_current_timeframe Fields

tables. All tables of this type contain the same fields.

Table 5-10 ssl_stats_current_timeframe Fields

Field

Description

Number of SSL sessions dropped with no reset.

Number of SSL sessions dropped with reset.

Number of SSL sessions found in the session cache.

Number of handshake errors that occurred while evaluating SSL rules.

Number of SSL sessions in which the certificate was expired.

Number of SSL sessions in which the certificate issuer was either not valid or not found in the Trusted CA list.

Number of SSL sessions in which the certificate had an invalid signature.

Number of SSL sessions in which the certificate was not checked.

Number of SSL sessions in which the certificate was not yet valid.

Number of SSL sessions in which the certificate had been revoked.

Number of SSL sessions in which the certificate was self-signed.

Number of SSL sessions in which the certificate status was unknown.

Number of SSL sessions in which the certificate was valid.

Number of times a certificate was found in the validation cache.

Number of times a certificate was not found in the validation cache.

Number of times an SSL session using a self-signed certificate was decrypted using the decrypt-resign method.

Number of times an SSL session using a self-signed certificate was decrypted using the decrypt-resign with replace key only method.

Number of times an SSL session using a signed certificate was decrypted using the decrypt-resign method.

Number of times an SSL session was decrypted using the known-key method.

Number of SSL sessions which suffered an error during decryption.

Number of times an SSL session was found but not decrypted.

Number of handshake errors that occurred prior to evaluating SSL rules.

Number of times an original certificate was found in the cache.

Number of times an original certificate was not found in the cache.

Number of times a resigned certificate was found in the cache.

Number of times a resigned certificate was not found in the cache.

.

ID of the device that provided the event.

The name of the managed device that generated the event.

.

Number of times an SSL session ID or ticket was found in the cache.

Number of times an SSL session ID or ticket was not found in the cache.

Number of sessions that were incorrectly identified as using SSL.

Number of sessions that used SSL compression.

Number of SSL sessions that were successfully decrypted.

Number of SSL sessions that were not successfully decrypted.

Number of times an SSL session reused an ID.

Number of times an SSL session reused a ticket.

Number of SSL sessions which have errors.

Number of SSL sessions using SSL version 2.0

Number of SSL sessions using SSL version 3.0

Number of SSL sessions using an unknown SSL version.

The UNIX timestamp of the date and time the measurement interval starts. For detailed information, see Specifying Time Intervals When Querying Statistics Tables.

Number of SSL sessions using TLS version 1.0

Number of SSL sessions using TLS version 1.1

Number of SSL sessions using TLS version 1.2

Total number of SSL sessions detected.

Number of times that a cache miss on an ID or ticket prevented decryption.

Number of SSL sessions that could not be decrypted because the device is in passive mode.

Number of SSL sessions using an unknown cipher suite.

Number of SSL sessions using a cipher suite which is known but not supported.

ssl_stats_current_timeframe Joins

tables.

ssl_stats_current_timeframe Sample Query

during the current day.

storage_stats_by_disposition_current_timeframe

tables contain statistics for stores files. Statistics can be extracted based on bytes, connection, sensor, and time.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- storage_stats_by_disposition_current_timeframe Fields

- storage_stats_by_disposition_current_timeframe Joins

- storage_stats_by_disposition_current_timeframe Sample Query

storage_stats_by_disposition_current_timeframe Fields

tables. All tables of this type contain the same fields.

Table 5-11 storage_stats_by_disposition_current_timeframe Fields

Field

Description

The size of the file, in bytes.

The malware status of the file. Possible values include:

- CLEAN — The file is clean and does not contain malware.

- UNKNOWN — It is unknown whether the file contains malware.

- MALWARE — The file contains malware.

- UNAVAILABLE — The software was unable to send a request to the Cisco cloud for a disposition, or the Cisco cloud services did not respond to the request.

- CUSTOM SIGNATURE — The file matches a user-defined hash, and is treated in a fashion designated by the user.

Number of files of this disposition dropped.

Number of files of this disposition stored.

ID of the device that detected the file.

.

The name of the managed device that generated the intrusion event.

.

The UNIX timestamp of the date and time the measurement interval starts. For detailed information, see Specifying Time Intervals When Querying Statistics Tables.

storage_stats_by_disposition_current_timeframe Joins

tables.

storage_stats_by_disposition_current_timeframe Sample Query

during the current day.

storage_stats_by_file_type_current_timeframe

tables contain statistics for stored files by file type. Statistics can be extracted based on bytes, connection, sensor, and time.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- storage_stats_by_file_type_current_timeframe Fields

- storage_stats_by_file_type_current_timeframe Joins

- storage_stats_by_file_type_current_timeframe Sample Query

storage_stats_by_file_type_current_timeframe Fields

tables. All tables of this type contain the same fields.

Table 5-12 storage_stats_by_file_type_current_timeframe Fields

Field

Description

The size of the file, in bytes.

The file type of the detected or quarantined file.

ID number that maps to the file type.

Number of files of this type dropped.

Number of files of this type stored.

sensor

ID of the device that detected the file.

.

The name of the managed device that generated the intrusion event.

.

The UNIX timestamp of the date and time the measurement interval starts. For detailed information, see Specifying Time Intervals When Querying Statistics Tables.

storage_stats_by_file_type_current_timeframe Joins

tables.

storage_stats_by_file_type_current_timeframe Sample Query

during the current day.

transmission_stats_by_file_type_current_timeframe

tables contain statistics for stored files by file type. Statistics can be extracted based on bytes, connection, sensor, and time.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- transmission_stats_by_file_type_current_timeframe Fields

- transmission_stats_by_file_type_current_timeframe Joins

- transmission_stats_by_file_type_current_timeframe Sample Query

transmission_stats_by_file_type_current_timeframe Fields

tables. All tables of this type contain the same fields.

Table 5-13 transmission_stats_by_file_type_current_timeframe Fields

Field

Description

The number of transmitted bytes.

The file type of the detected or quarantined file.

ID number that maps to the file type.

Number of files of this type dropped.

Number of files of this type sent.

ID of the device that detected the file.

.

The name of the managed device that generated the intrusion event.

.

The UNIX timestamp of the date and time the measurement interval starts. For detailed information, see Specifying Time Intervals When Querying Statistics Tables.

transmission_stats_by_file_type_current_timeframe Joins

tables.

transmission_stats_by_file_type_current_timeframe Sample Query

during the current day.

url_category_stats_current_timeframe

tables contain statistics on the bandwidth usage and connections associated with requests to URLs in specified URL categories. You can also constrain queries on the managed device that monitored the traffic.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- url_category_stats_current_timeframe Fields

- url_category_stats_current_timeframe Joins

- url_category_stats_current_timeframe Sample Query

url_category_stats_current_timeframe Fields

tables.

Table 5-14 url_category_stats_current_timeframe Fields

Field

Description

The bytes of inbound traffic during the specified interval.

The bytes of outbound traffic during the specified interval.

The category of the URL.

The number of connections allowed for the specified URL category.

The number of connections denied for the specified URL category due to violation of an access control policy.

.

The internal identification number of the managed device that detected the traffic.

The managed device that monitored the traffic.

.

The UNIX timestamp of the start of the measurement interval. For information on specifying the start time, see Specifying Time Intervals When Querying Statistics Tables.

url_category_stats_current_timeframe Joins

tables.

url_category_stats_current_timeframe Sample Query

The following query returns up to 25 URL category records. Each record contains the bytes of associated inbound and outbound traffic, as well as allowed and denied connections, over the specified time interval.

url_reputation_stats_current_timeframe

tables contain statistics on the bandwidth usage and connections associated with requests to URLs with specified reputations. Query results can also be constrained on the managed device that monitored the traffic.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

tables, see the following sections:

- url_reputation_stats_current_timeframe Fields

- url_reputation_stats_current_timeframe Joins

- url_reputation_stats_current_timeframe Sample Query

url_reputation_stats_current_timeframe Fields

tables.

Table 5-15 url_reputation_stats_current_timeframe Fields

Field

Description

The bytes of inbound traffic during the specified interval.

The bytes of outbound traffic during the specified interval.

The number of connections allowed.

The number of connections denied due to violation of an access control policy.

The risk associated with the requested URL. One of the following:

- High risk

- Suspicious site

- Benign site with security risks

- Benign site

- Well known

- Risk unknown

.

Internal identification number of the managed device that monitored the traffic.

The name of the managed device that monitored the traffic.

.

The UNIX timestamp of the start of the measurement interval. For information on specifying the start time, see Specifying Time Intervals When Querying Statistics Tables.

url_reputation_stats_current_timeframe Joins

tables.

url_reputation_stats_current_timeframe Sample Query

table. Each record contains the bytes of inbound and outbound traffic, as well as allowed and denied connections over the measurement time interval.

user_ids_stats_current_timeframe

tables are round-robin tables that contain statistics on access filtering and impact statistics by user.

tables in this type, see Storage Characteristics for Statistics Tracking Tables.

For general information on using the round robin statistics tables, see Understanding Statistics Tracking Tables.

tables, see the following sections:

- user_ids_stats_current_timeframe Fields

- user_ids_stats_current_timeframe Joins

- user_ids_stats_current_timeframe Sample Query

user_ids_stats_current_timeframe Fields

tables.

Table 5-16 user_ids_stats_current_timeframe Fields

Field

Description

The number of connections blocked due to violation of an intrusion policy.

The number of impact level 1 (vulnerable) intrusion events recorded for the user.

The number of impact level 2 (potentially vulnerable) intrusion events recorded for the user.

The number of impact level 3 (host currently not vulnerable) intrusion events recorded for the user.

The number of impact level 4 (unknown target) intrusion events recorded for the user.

The number of impact level 5 (unknown vulnerability) intrusion events recorded for the user.

.

The internal identification number of the managed device that detected the traffic.

The name of the managed device that detected the traffic.

.

The UNIX timestamp of the start of the measurement interval. For information on specifying the start time, see Specifying Time Intervals When Querying Statistics Tables.

An internal identification number for the user who last logged into the host.

The user name of the user who last logged into the host.

Number of packets that would have been dropped if the intrusion policy had been configured to drop packets in an inline deployment.

user_ids_stats_current_timeframe Joins

tables.

user_ids_stats_current_timeframe Sample Query

.

user_stats_current_timeframe

tables contain statistics on bandwidth usage and access control actions (connection allowed or denied) by user. You can also constrain queries on the managed device that monitored the traffic.

statistics tables, see Storage Characteristics for Statistics Tracking Tables.

For more information, see the following sections:

- user_stats_current_timeframe Fields

- user_stats_current_timeframe Joins

- user_stats_current_timeframe Sample Query

user_stats_current_timeframe Fields

tables.

Table 5-17 user_stats_current_timeframe Fields

Field

Description

The number of bytes of inbound traffic for the user in the measured interval.

The number of bytes of outbound traffic for the user in the measured interval.

The number of connections allowed for this user in the measured time frame.

The number of connections denied for this user due to violation of an access control policy.

.

The internal identification number of the managed device that detected the traffic.

The name of the managed device that detected the traffic.

.

The UNIX timestamp of the start of the measurement interval. For information on specifying the start time, see Specifying Time Intervals When Querying Statistics Tables.

The internal identification number for the user who last logged into the host that generated the traffic.

User name for the user who last logged into the host that generated the traffic.

user_stats_current_timeframe Joins

tables.

user_stats_current_timeframe Sample Query

The following query returns up to 25 user records. Each record contains the bytes of inbound and outbound traffic, as well as allowed and denied connections over the measurement time interval.

Schema: Discovery Event and Network Map Tables

This chapter contains information on the schema and supported joins for tables related to discovery events and the Cisco network map.

Your FireSIGHT System generates discovery events continuously as it monitors the traffic produced by your hosts and network devices.

The network map is a repository of information about the network assets reported in discovery events. For each detected host and network device, the network map contains information such as operating system, servers, client applications, host attributes, vulnerabilities, and so on.

Vulnerabilities are descriptions of specific compromises or exploits to which hosts may be susceptible. Cisco maintains its own vulnerability database (VDB), which cross-references the Bugtraq database and MITRE’s CVE database. You can also import third-party vulnerability data using the host input feature.

Note that the information about a given host in the network map can vary according to the type of host and the information available in the monitored traffic.

recommends avoiding the use of deprecated tables and fields, to ensure continued support in the future.

Table 6-1 Schema for Discovery Event and Network Map Tables

See...

For the table that stores information on...

Version

application_host_map

Applications detected on the hosts in your monitored network.

5.0+

application_ip_map

The category, tags, productivity, and risk associated with an application detected in your monitored network.

5.2+

application_ip_map

The category, tags, productivity, and risk associated with an application detected in your monitored network.

5.0-5.1.x

application_tag_map

The tags associated with an application detected in your monitored network.

5.0+

network_discovery_event

Discovery and host input events.

5.0+

rna_host

Basic information on the hosts in your monitored network.

5.2+

rna_host_attribute

The host attributes associated with each host in your monitored network.

5.2+

rna_host_client_app

The client applications detected on the hosts in your monitored network.

5.2+

rna_host_client_app

The payloads associated with HTTP (web browser) client applications detected on the hosts in your monitored network.

5.2+

rna_host_ioc_state

Stores compromise state for hosts.

5.3+

rna_host_ip_map

Correlates host IDs to MAC addresses for hosts in your monitored network.

5.2+

rna_host_os

The operating systems detected on the hosts in your monitored network.

5.2+

rna_host_os_vulns

The vulnerabilities associated with the hosts in your monitored network.

5.2+

rna_host_protocol

The protocols detected on the hosts in your monitored network.

4.10.x+

rna_host_protocol

The hosts in your monitored network with regard to the managed device that detected them.

5.2+

rna_host_service

The services detected on the hosts in your monitored network.

5.2+

rna_host_service_banner

Headers from network traffic that advertise service vendors and versions (“banners”) for the services detected on hosts in your monitored network.

5.2+

rna_host_service_info

Details of the services detected on the hosts in your monitored network.

5.2+

rna_host_service_payload

The payloads associated with services detected on the hosts in your monitored network.

5.2+

rna_host_service_subtype

The sub-services for the services detected on the hosts in your monitored network.

5.2+

rna_host_service_vulns

The vulnerabilities associated with the services detected on the hosts in your monitored network.

5.2+

rna_host_third_party_vuln

The third-party vulnerabilities associated with the hosts in your monitored network.

5.2+

rna_host_third_party_vuln_bugtraq_id

).

5.2+

rna_host_third_party_vuln_cve_id

).

5.2+

rna_host_third_party_vuln_rna_id

The third-party vulnerabilities associated with the hosts in your monitored network that are also associated with a vulnerability in the VDB.

5.2+

rna_ip_host

Basic information on the IP hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_client_app

The client applications detected on the hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_client_app_payload

The payloads associated with HTTP (web browser) client applications detected on the IP hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_os

The operating systems detected on the IP hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_os_vulns

The vulnerabilities associated with the IP hosts in your monitored network.

.

4.10.x--5.1.x

rna_ip_host_sensor

The IP hosts in your monitored network with regard to the managed device that detected them.

.

5.0-5.1.x

rna_ip_host_service

The services detected on the IP hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_service_banner

Headers from network traffic that advertise service vendors and versions (“banners”) for the services detected on hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_service_info

Details of the services detected on the IP hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_service_payload

The payloads associated with services detected on the IP hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_service_subtype

The sub-services for the services detected on the IP hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_service_vulns

The vulnerabilities associated with the services detected on the IP hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_third_party_vuln

The third-party vulnerabilities associated with the IP hosts in your monitored network.

.

4.10.x-5.1.x

rna_ip_host_third_party_vuln_bugtraq_id

).

.

4.10.x-5.1.x

rna_ip_host_third_party_vuln_cve_id

).

.

4.10.x-5.1.x

rna_ip_host_third_party_vuln_rna_id

The third-party vulnerabilities associated with the IP hosts in your monitored network that are also associated with a vulnerability in the VDB.

.

4.10.x-5.1.x

rna_ip_host_user_history

User activity for a particular IP host in your monitored network.

.

4.10.x-5.1.x

rna_mac_host

The MAC hosts (hosts without an IP address) in your monitored network.

4.10.x-5.1.x

rna_mac_host_sensor

The IP hosts in your monitored network with regard to the managed devices that detected them.

5.0-5.1.x

rna_mac_ip_map

The MAC addresses of the IP hosts in your monitored network.

4.10.x-5.1.x

rna_vuln

The vulnerabilities in the Cisco VDB.

4.10.x+

tag_info

The tags that characterize detected applications.

5.0+

url_categories

The categories that characterize URLs accessed from hosts in your monitored network.

5.0+

url_reputations

The reputations that characterize URLs accessed from hosts in your monitored network.

5.0+

user_ipaddr_history

User activity for a particular host in your monitored network.

5.2+

application_host_map

table contains information on the categories and tags associated with each application detected on your network.

For more information, see the following sections:

- application_host_map Fields

- application_host_map Joins

- application_host_map Sample Query

application_host_map Fields

table.

Table 6-2 application_host_map Fields

Field

Description

The internal identification number for the application.

The application name that appears in the user interface.

.

is very high.

).

ID number of the host.

is critical risk.

).

application_host_map Joins

table.

Table 6-3 application_host_map Joins

You can join this table on...

And...

host_id

application_host_map Sample Query

.

application_info

table contains information about the applications that can be detected on the hosts in your monitored network.

.

For more information, see the following sections:

- application_info Fields

- application_info Joins

- application_info Sample Query

application_info Fields

table.

Table 6-4 application_info Fields

Field

Description

A description of the application.

The internal identification number for the application.

The application name that appears in the user interface.

is very high.

).

A true-false flag that indicates if the detected application is a client.

A true-false flag that indicates if the detected application is a server application.

A true-false flag that indicates if the detected application is a web application.

is critical risk.

).

application_info Joins

table.

Table 6-5 application_info Joins

You can join this table on...

And...

application_info Sample Query

.

application_tag_map

table contains information on the tags associated with each application detected on your network.

For more information, see the following sections:

- application_tag_map Fields

- application_tag_map Joins

- application_tag_map Sample Query

application_tag_map Fields

table.

Table 6-6 application_tag_map Fields

Field

Description

The internal identification number for the application.

The application that appears in the user interface.

The internal identification number for the tag.

The text of the tag that appears in the user interface.

.

application_tag_map Joins

table.

Table 6-7 application_tag_map Joins

You can join this table on...

And...

application_tag_map Sample Query

The following query returns all tag records associated with the specified application.

network_discovery_event

table contains information on discovery and host input events. The FireSIGHT System generates discovery events when it detects a change on your monitored network, whether by discovering new network features or by detecting changes in previously identified network assets. The FireSIGHT System generates host input events when a user manually modifies the network map by adding, modifying, or deleting network assets.

table starting with Version 5.0 of the FireSIGHT System.

For more information, see the following sections:

- network_discovery_event Fields

- network_discovery_event Joins

- network_discovery_event Sample Query

network_discovery_event Fields

table.

Table 6-8 network_discovery_event Fields

Field

Description

) for the identification of the service.

The description of the event.

The internal identification number for the event.

The UNIX timestamp of the date and time the event was generated.

The microsecond increment of the event timestamp.

.

.

A binary representation of the IPv4 or IPv6 address for the host involved in the event.

The MAC address of the host involved in the event.

The NIC hardware vendor of the host involved in the event.

The port used by the network traffic that triggered the event.

.

The managed device that generated the discovery event.

.

The department of the user who last logged into the host.

The email address of the user who last logged into the host.

The first name of the user who last logged into the host.

The internal identification number for the user who last logged into the host.

The last name of the user who last logged into the host.

The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user who last logged into the host.

The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user who last logged into the host.

The user name of the user who last logged into the host.

The phone number of the user who last logged into the host.

network_discovery_event Joins

table.

Table 6-9 network_discovery_event Joins

You can join this table on...

And...

network_discovery_event Sample Query

The following query returns discovery event records that include the user, detecting device name, timestamp, host IP address, and so on within the specified times.

rna_host

table contains basic information on the hosts in your monitored network.

as of Version 5.2.

For more information, see the following sections:

- rna_host Fields

- rna_host Joins

- rna_host Sample Query

rna_host Fields

table.

Fields

Field

Description

.

The number of network hops from the host to the managed device that detected the host.

ID number of the host.

Name of the host.

.

A true-false flag indicating whether a mobile device operating system is jailbroken.

The UNIX timestamp of the date and time the system last detected host activity.

A true-false flag indicating whether the detected host is a mobile device.

The host NetBIOS name string.

The contents of the Notes host attribute for the host.

The VLAN identification number, if applicable.

The priority value included in the VLAN tag.

The type of encapsulated packet that contains the VLAN tag:

- 0 — Ethernet

- 1 — Token Ring

rna_host Joins

table.

Table 6-11 rna_host Joins

You can join this table on...

And...

rna_host Sample Query

records that include the host ID, VLAN ID, when the host was last seen, and the type of host, ordered by the type of host.

rna_host_attribute

table.

For more information, see the following sections:

- rna_host_attribute Fields

- rna_host_attribute Joins

- rna_host_attribute Sample Query

rna_host_attribute Fields

table.

Table 6-12 rna_host_attribute Fields

Field

Description

.

The value of the host attribute.

ID number of the host.

rna_host_attribute Joins

table.

Table 6-13 rna_host_attribute Joins

You can join this table on...

And...

rna_host_attribute Sample Query

The following query returns all host attributes and values associated with the selected host ID.

rna_host_client_app

table.

For more information, see the following sections:

- rna_host_client_app Fields

- rna_host_client_app Joins

- rna_host_client_app Sample Query

rna_host_client_app Fields

table.

Table 6-14 rna_host_client_app Fields

Field

Description

for all queries.

An internal identifier for the detected application protocol.

One of:

- the name of the application, if a positive identification can be made

- pending if the system requires more data

- blank if there is no application information in the connection

for all queries.

The internal identification number for the application, if the application is identifiable.

One of:

- the name of the application, if a positive identification can be made.

- a generic client name if the system detects a client application but cannot identify a specific one.

- blank if there is no client application information in the connection.

The number of times the client application was detected.

ID number of the host.

The UNIX timestamp of the date and time the system last detected application activity.

The version of the application detected on the host.

rna_host_client_app Joins

table.

Table 6-15 rna_host_client_app Joins

You can join this table on...

And...

and

and

and

or

rna_host_client_app Sample Query

.

rna_host_client_app_payload

table contains information on the payloads in HTTP traffic associated with web applications on hosts detected in your monitored network.

For more information, see the following sections:

- rna_host_client_app_payload Fields

- rna_host_client_app_payload Joins

- rna_host_client_app_payload Sample Query

rna_host_client_app_payload Fields

table.

Table 6-16 rna_host_client_app_payload Fields

Field

Description

for all queries.

fields have the same value.

One of:

- the name of the application, if a positive identification can be made

- pending if the system requires more data

- blank if there is no application information in the connection

for all queries.

The internal identification number for the client application.

One of:

- the name of the application, if a positive identification can be made.

- a generic client name if the system detects a client application but cannot identify a specific one.

- blank if there is no client application information in the connection.

ID number of the host.

for all queries.

for all queries.

The version of the web application detected on the host.

fields have the same value.

One of:

- the name of the application, if a positive identification can be made.

- web browsing if the system detects an application protocol of HTTP but cannot identify a specific web application.

- blank if the connection has no HTTP traffic.

rna_host_client_app_payload Joins

table.

Table 6-17 rna_host_client_app_payload Joins

You can join this table on...

And...

or

rna_host_client_app_payload Sample Query

.

rna_host_ioc_state

table stores the IOC state for hosts in your monitored network.

For more information, see the following sections:

- rna_host_ioc_state Fields

- rna_host_ioc_state Joins

- rna_host_ioc_state Sample Query

rna_host_ioc_state Fields

table.

Table 6-18 rna_host_ioc_state Fields

Field

Description

Unix timestamp when the compromise was first detected.

.

The managed device that first detected the compromise.

ID number of the host.

The category for the compromise. Possible values include:

- CnC Connected

- Exploit Kit

- High Impact Attack

- Low Impact Attack

- Malware Detected

- Malware Executed

- Dropper Infection

- Java Compromise

- Word Compromise

- Adobe Reader Compromise

- Excel Compromise

- PowerPoint Compromise

- QuickTime Compromise

Description of the compromise.

The event type for the compromise. Possible values include:

- Adobe Reader launched shell

- Dropper Infection Detected by FireAMP

- Excel Compromise Detected by FireAMP

- Excel launched shell |

- Impact 1 Intrusion Event — attempted-admin

- Impact 1 Intrusion Event — attempted-user

- Impact 1 Intrusion Event — successful-admin

- Impact 1 Intrusion Event — successful-user

- Impact 1 Intrusion Event — web-application-attack

- Impact 2 Intrusion Event — attempted-admin

- Impact 2 Intrusion Event — attempted-user

- Impact 2 Intrusion Event — successful-admin

- Impact 2 Intrusion Event — successful-user

- Impact 2 Intrusion Event — web-application-attack

- Intrusion Event — exploit-kit

- Intrusion Event — malware-backdoor

- Intrusion Event — malware-CnC

- Java Compromise Detected by FireAMP

- Java launched shell

- PDF Compromise Detected by FireAMP

- PowerPoint Compromise Detected by FireAMP

- PowerPoint launched shell

- QuickTime Compromise Detected by FireAMP

- QuickTime launched shell

- Security Intelligence Event — CnC

- Suspected Botnet Detected by FireAMP

- Threat Detected by FireAMP — Subtype is 'executed'

- Threat Detected by FireAMP — Subtype is not 'executed'

- Threat Detected in File Transfer — Action is not 'block'

- Word Compromise Detected by FireAMP

- Word launched shell

Unique ID number for the compromise.

Whether this compromise has been disabled.

Unix timestamp when this compromise was last detected.

.

The managed device that last detected the compromise.

rna_host_ioc_state Joins

table.

Table 6-19 rna_host_ioc_state Joins

You can join this table on...

And...

rna_host_ioc_state Sample Query

The following query returns up to 25 hosts with their ioc within a specified timespan.

rna_host_ip_map

table correlates host IDs to IP addresses for hosts in your monitored network.

For more information, see the following sections:

- rna_host_ip_map Fields

- rna_host_ip_map Joins

- rna_host_ip_map Sample Query

rna_host_ip_map Fields

table.

Table 6-20 rna_host_ip_map Fields

Field

Description

ID number of the host.

A binary representation of the IP address of the host.

rna_host_ip_map Joins

table.

Table 6-21 rna_host_ip_map Joins

You can join this table on...

And...

rna_host_ip_map Sample Query

The following query returns MAC information for the selected host.

rna_host_mac_map

table correlates host IDs to MAC addresses for hosts in your monitored network.

For more information, see the following sections:

- rna_host_mac_map Fields

- rna_host_mac_map Joins

- rna_host_mac_map Sample Query

rna_host_mac_map Fields

table.

Table 6-22 rna_host_mac_map Fields

Field

Description

ID number of the host.

The host’s MAC address.

Vendor of the network interface of the detected host.

rna_host_mac_map Joins

table.

Table 6-23 rna_host_mac_map Joins

You can join this table on...

And...

rna_host_mac_map Sample Query

.

rna_host_os

table contains information on the operating systems detected on the hosts in your monitored network.

For more information, see the following sections:

- rna_host_os Fields

- rna_host_os Joins

- rna_host_os Sample Query

rna_host_os Fields

table.

Table 6-24 rna_host_os Fields

Field

Description

) for the identification of the operating system.

The UNIX timestamp of the date and time the system first detected host activity.

ID number of the host.

The UNIX timestamp of the date and time the system last detected host activity.

A unique identifier for the operating system detected on the host. The UUID maps to the operating system name, vendor, and version in the Cisco database.

The operating system detected on the host.

The source of the host’s operating system identity:

- User — Name of the user who entered the data via the web user interface

- Application — Imported from another application via the host input feature

- Scanner — Either Nmap or another scanner added through system policy

- rna — Detected by the FireSIGHT System, either by a discovery event, port match, or pattern match

- NetFlow — The data was exported by a NetFlow-enabled device

The vendor of the operating system detected on the host.

The version of the operating system detected on the host.

rna_host_os Joins

table.

Table 6-25 rna_host_os Joins

You can join this table on...

And...

rna_host_os Sample Query

.

rna_host_os_vulns

table contains information on the vulnerabilities associated with the hosts in your monitored network.

For more information, see the following sections:

- rna_host_os_vulns Fields

- rna_host_os_vulns Joins

- rna_host_os_vulns Sample Query

rna_host_os_vulns Fields

table.

Table 6-26 rna_host_os_vulns Fields

Field

Description

ID number of the host.

A value indicating whether the vulnerability is valid for the host:

- 0 — Vulnerability is valid

- 1 — Vulnerability is invalid

An internal identification number for the vulnerability.

rna_host_os_vulns Joins

table.

Table 6-27 rna_host_os_vulns Joins

You can join this table on...

And...

rna_host_os_vulns Sample Query

.

rna_host_protocol

table contains information on the protocols detected on the hosts in your monitored network.

For more information, see the following sections:

- rna_host_protocol Fields

- rna_host_protocol Joins

- rna_host_protocol Sample Query

rna_host_protocol Fields

table.

Table 6-28 rna_host_protocol Fields

Field

Description

ID number of the host.

for all queries.

.

for all queries.

for all queries.

The traffic protocol used by the host.

The IANA-specified protocol number for the protocol.

rna_host_protocol Joins

table.

Table 6-29 rna_host_protocol Joins

You can join this table on...

And...

rna_host_protocol Sample Query

.

rna_host_sensor

table lists the host IP addresses in your monitored network and indicates the managed device that detected each one.

table starting with Version 5.2 of the FireSIGHT System.

For more information, see the following sections:

- rna_host_sensor Fields

- rna_host_sensor Joins

- rna_host_sensor Sample Query

rna_host_sensor Fields

table.

Table 6-30 rna_host_sensor Fields

Field

Description

ID number of the host.

.

The name of the managed device.

.

rna_host_sensor Joins

table.

Table 6-31 rna_host_sensor Joins

You can join this table on...

And...

rna_host_sensor Sample Query

table.

rna_host_service

table contains general information about the servers detected on the hosts in your managed network through network port and traffic protocol combinations.

For more information, see the following sections:

- rna_host_service Fields

- rna_host_service Joins

- rna_host_service Sample Query

rna_host_service Fields

table.

Table 6-32 rna_host_service Fields

Field

Description

) for the identification of the server.

The number of times the server was detected.

ID number of the host.

UNIX timestamp of the date and time the system last detected server activity.

The port used by the server.

.

rna_host_service Joins

table.

Table 6-33 rna_host_service Joins

You can join this table on...

And...

rna_host_service Sample Query

:

rna_host_service_banner

option in the your network discovery policy.

For more information, see the following sections:

- rna_ip_host_service_banner Fields

- rna_host_service_banner Joins

- rna_host_service_banner Sample Query

rna_ip_host_service_banner Fields

table.

Table 6-34 rna_host_service_banner Fields

Field

Description

The server banner, that is, the first 256 bytes of the first packet detected for the server.

ID number of the host.

The port used by the server.

.

rna_host_service_banner Joins

table.

Table 6-35 rna_host_service_banner Joins

You can join this table on...

And...

rna_host_service_banner Sample Query

.

rna_host_service_info

table contains detailed information about the servers detected on the hosts in your monitored network.

For more information, see the following sections:

- rna_host_service_info Fields

- rna_host_service_info Joins

- rna_host_service_info Sample Query

rna_host_service_info Fields

table.

.

Table 6-36 rna_host_service_info Fields

Field

Description

Field deprecated in Version 5.0. Returns blank for all queries.

An internal identifier for the detected application protocol, if available.

One of:

- the name of the application protocol, if a positive identification can be made

- pending if the system requires more data

- blank if there is no application information in the connection

is very high.

).

The UNIX timestamp of the date and time the system first detected the application protocol.

ID number of the host.

for all queries.

The UNIX timestamp of the date and time the system last detected server activity.

The port used by the server.

.

is very high risk.

).

An internal identification number for the server.

for all queries.

The source of the identity of the server:

- User — Name of the user who entered the data via the web user interface

- Application — Imported from another application via the host input feature

- Scanner — Added through NMAP or imported via the host input feature with a source type of Scanner

- rna — Detected by the FireSIGHT System, either by a discovery event, port match, or pattern match

- NetFlow — The data was exported by a NetFlow-enabled device

The vendor of the server on the host.

The version of the server detected on the host.

rna_host_service_info Joins

table.

Table 6-37 rna_host_service_info Joins

You can join this table on...

And...

and

and

rna_host_service_info Sample Query

.

rna_host_service_payload

table contains information on the web applications associated by the hosts in your monitored network.

For more information, see the following sections:

- rna_host_service_payload Fields

- rna_host_service_payload Joins

- rna_host_service_payload Sample Query

rna_host_service_payload Fields

table.

Table 6-38 rna_host_service_payload Fields

Field

Description

for all queries.

for all queries.

ID number of the host.

for all queries.

for all queries.

for all queries.

The port used by the server.

.

The internal identification number for the web application.

One of:

- the name of the web application, if a positive identification can be made

- web browsing if the system detects an application protocol of HTTP but cannot identify a specific web application

- blank if the connection has no HTTP traffic

rna_host_service_payload Joins

table.

Table 6-39 rna_host_service_payload Joins

You can join this table on...

And...

rna_host_service_payload Sample Query

.

rna_host_service_subtype

table contains information on the sub-servers for a server detected on the hosts in your monitored network.

For more information, see the following sections:

- rna_host_service_subtype Fields

- rna_host_service_subtype Joins

- rna_host_service_subtype Sample Query

rna_host_service_subtype Fields

table.

Table 6-40 rna_host_service_subtype Fields

Field

Description

ID number of the host.

The port used by the server.

.

One of:

- the server on the host that is associated with the triggering event

- none or blank if data for an identification is unavailable

- pending if additional data is required

- unknown if the system cannot identify the server based on known server fingerprints

The source of the identity of the server:

- User - name of the user who entered the data via the web user interface

- Application - imported from another application via the host input feature

- Scanner - added through NMAP or imported via the host input feature with a source type of Scanner

- rna - detected by the FireSIGHT System, either by a discovery event, port match, or pattern match

- NetFlow - the data was exported by a NetFlow-enabled device

The sub-server detected on the host.

The vendor of the sub-server detected on the host.

The version of the sub-server detected on the host.

The vendor of the server detected on the host.

The version of the server detected on the host.

rna_host_service_subtype Joins

table.

rna_host_service_subtype Sample Query

.

rna_host_service_vulns

table contains information on the vulnerabilities mapped to the servers detected on the hosts in your monitored network.

For more information, see the following sections:

- rna_host_service_vulns Fields

- rna_host_service_vulns Joins

- rna_host_service_vulns Sample Query

rna_host_service_vulns Fields

table.

Table 6-41 rna_host_service_vulns Fields

Field

Description

An internal identification number for the application protocol running on the host.

The application protocol name that appears in the user interface.

ID number of the host.

A value indicating whether the vulnerability is valid for the host running the application protocol:

- 0 — Vulnerability is valid

- 1 — Vulnerability is invalid

for all queries.

The port used by the server.

.

An internal identification number for the vulnerability.

for all queries.

The vendor of the server detected on the host.

The version of the server detected on the host.

rna_host_service_vulns Joins

table.

Table 6-42 rna_host_service_vulns Joins

You can join this table on...

And...

rna_host_service_vulns Sample Query

.

rna_host_third_party_vuln

table contains information on the third-party vulnerabilities associated with the hosts in your monitored network. Note that the information in this table is determined by the third-party vulnerability data imported via the host input feature.

For more information, see the following sections:

- rna_host_third_party_vuln Fields

- rna_host_third_party_vuln Joins

- rna_host_third_party_vuln Sample Query

rna_host_third_party_vuln Fields

table.

Table 6-43 rna_host_third_party_vuln Fields

Field

Description

A description of the vulnerability.

ID number of the host.

A value indicating whether the vulnerability is valid for the host:

- 0 — Vulnerability is valid

- 1 — Vulnerability is invalid

The title of the vulnerability.

A port number, if the vulnerability is associated with a server or related application detected on a specific port.

), if the vulnerability is associated with an application using that protocol.

The source of the vulnerability.

An identification number associated with the vulnerability.

rna_host_third_party_vuln Joins

table.

Table 6-44 rna_host_third_party_vuln Joins

You can join this table on...

And...

rna_host_third_party_vuln Sample Query

.

rna_host_third_party_vuln_bugtraq_id

table contains information on the third-party vulnerabilities that are mapped to vulnerabilities in the Bugtraq database and also associated with hosts in your monitored network. Note that the third-party vulnerability data in this table is imported via the host input feature.

For more information, see the following sections:

- rna_host_third_party_vuln_bugtraq_id Fields

- rna_host_third_party_vuln_bugtraq_id Joins

- rna_host_third_party_vuln_bugtraq_id Sample Query

rna_host_third_party_vuln_bugtraq_id Fields

table.

Table 6-45 rna_host_third_party_vuln_bugtraq_id Fields

Field

Description

The Bugtraq database identification number associated with the vulnerability.

A description of the vulnerability.

ID number of the host.

A value indicating whether the vulnerability is valid for the host:

- 0 — Vulnerability is valid

- 1 — Vulnerability is invalid

for all queries.

The name, or title, of the vulnerability.

A port number, if the vulnerability is associated with a server or related application detected on a specific port.

), if the vulnerability is associated with an application using that protocol.

The source of the vulnerability.

The third-party identification number associated with the vulnerability.

rna_host_third_party_vuln_bugtraq_id Joins

table.

Table 6-46 rna_host_third_party_vuln_bugtraq_id Joins

You can join this table on...

And...

rna_host_third_party_vuln_bugtraq_id Sample Query

.

rna_host_third_party_vuln_cve_id

table contains information on the third-party vulnerabilities that are mapped to vulnerabilities in MITRE’s CVE database and also associated with the hosts in your monitored network. Note that this table contains third-party vulnerability data imported via the host input feature.

For more information, see the following sections:

- rna_host_third_party_vuln_cve_id Fields

- rna_host_third_party_vuln_cve_id Joins

- rna_host_third_party_vuln_cve_id Sample Query

rna_host_third_party_vuln_cve_id Fields

table.

Table 6-47 rna_host_third_party_vuln_cve_id Fields

Field

Description

The identification number associated with the vulnerability in MITRE’s CVE database.

A description of the vulnerability.

ID number of the host.

A value indicating whether the vulnerability is valid for the host:

- 0 — Vulnerability is valid

- 1 — Vulnerability is invalid

for all queries.

The name, or title, of the vulnerability.

A port number, if the vulnerability is associated with a server or related application detected on a specific port.

), if the vulnerability is associated with an application using that protocol.

The source of the vulnerability.

The identification number associated with the vulnerability.

rna_host_third_party_vuln_cve_id Joins

table.

Table 6-48 rna_host_third_party_vuln_cve_id Joins

You can join this table on...

And...

rna_host_third_party_vuln_cve_id Sample Query

.

rna_host_third_party_vuln_rna_id

table contains information on third-party vulnerabilities that are mapped to vulnerabilities in the Cisco vulnerability database (VDB) and also associated with hosts in your monitored network. Note that the third-party vulnerability data in this table is imported via the host input feature.

For more information, see the following sections:

- rna_host_third_party_vuln_rna_id Fields

- rna_host_third_party_vuln_rna_id Joins

- rna_host_third_party_vuln_rna_id Sample Query

rna_host_third_party_vuln_rna_id Fields

table.

Table 6-49 rna_host_third_party_vuln_rna_id Fields

Field

Description

A description of the vulnerability.

ID number of the host.

A value indicating whether the vulnerability is valid for the host:

- 0 — Vulnerability is valid

- 1 — Vulnerability is invalid

for all queries.

The name, or title, of the vulnerability.

A port number, if the vulnerability is associated with a server or related application detected on a specific port.

), if the vulnerability is associated with an application using that protocol.

The vulnerability identification number that Cisco uses to track the vulnerability.

The source of the vulnerability.

The identification number associated with the vulnerability.

rna_host_third_party_vuln_rna_id Joins

table.

Table 6-50 rna_host_third_party_vuln_rna_id Joins

You can join this table on...

And...

rna_host_third_party_vuln_rna_id Sample Query

.

rna_vuln

table contains information on the vulnerabilities in the Cisco VDB.

For more information, see the following sections:

- rna_vuln Fields

- rna_vuln Joins

- rna_vuln Sample Query

rna_vuln Fields

table.

Table 6-51 rna_vuln Fields

Field

Description

Whether authentication is required to exploit the vulnerability:

- Required

- Not Required

- Unknown

When the vulnerability can be exploited:

- Always

- User Initiated

- Time Dependent

- Unknown

Whether there are available exploits for the vulnerability:

- TRUE

- FALSE

The identification number associated with the vulnerability in the Bugtraq database.

The class of vulnerability:

- Configuration Error

- Boundary Condition Error

- Design Error

How credible the vulnerability is:

- Conflicting Reports

- Conflicting Details

- Single Source

- Reliable Source

- Multiple Sources

- Vendor Confirmed

The person or organization credited with reporting the vulnerability.

The ease of exploiting the vulnerability:

- No Exploit Required

- Exploit Available

- No Exploit Available

Details on what could happen when the vulnerability is exploited.

The date the vulnerability was entered in the database.

Information on where you can find exploits for the vulnerability.

being the most severe. The impact value of a vulnerability is determined by the writer of the Bugtraq entry.

Indicates whether the vulnerability must be exploited locally:

- TRUE

- FALSE

A general description of the vulnerability.

A description of how you can mitigate the vulnerability.

The date of the most recent modification to the vulnerability, if applicable.

The date the vulnerability was published.

Indicates whether the vulnerability can be exploited across a network:

- TRUE

- FALSE

The Cisco vulnerability ID number that the system uses to track vulnerabilities.

A description of a scenario where an attacker is exploiting the vulnerability.

A summary description of the vulnerability.

The identification number associated with the vulnerability in the Snort ID (SID) database. That is, if an intrusion rule can detect network traffic that exploits a particular vulnerability, that vulnerability is associated with the intrusion rule’s SID.

The solution to the vulnerability.

The technical description of the vulnerability.

The title of the vulnerability.

rna_vuln Joins

table.

Table 6-52 rna_vuln Joins

You can join this table on...

And...

or

rna_vuln Sample Query

The following query returns information about up to 25 vulnerabilities. The records are sorted in order of most events generated based on the vulnerability.

tag_info

table contains information on the tags that are associated with the applications detected on your network. Note that an application can have multiple associated tags.

For more information, see the following sections:

- tag_info Fields

- tag_info Joins

- tag_info Sample Query

tag_info Fields

table.

Table 6-53 tag_info Fields

Field

Description

Tag description.

Internal identifier for the tag.

Text of the tag that appears in the user interface.

One of the following:

- category

- tag

tag_info Joins

table.

Table 6-54 tag_info Joins

You can join this table on...

And...

tag_info Sample Query

The following query returns the application tag record for a selected tag ID.

url_categories

table lists the categories that characterize URLs requested by hosts in your monitored network.

For more information, see the following sections:

- url_categories Fields

- url_categories Joins

- url_categories Sample Query

url_categories Fields

table.

Table 6-55 url_categories Fields

Field

Description

The description of the URL category.

The internal identification number of the URL category.

url_categories Joins

table.

url_categories Sample Query

The following query returns a category record for the selected category ID.

url_reputations

table lists the reputations that characterize URLs requested by hosts in your monitored request.

For more information, see the following sections:

- url_reputations Fields

- url_reputations Joins

- url_reputations Sample Query

url_reputations Fields

table.

Table 6-56 url_reputations Fields

Field

Description

The description of the reputation.

An internal identification number for the URL reputation.

url_reputations Joins

table.

url_reputations Sample Query

The following query returns URL reputation information for a reputation ID.

user_ipaddr_history

table contains information on user activity for a particular host in your monitored network.

For more information, see the following sections:

- user_ipaddr_history Fields

- user_ipaddr_history Joins

- user_ipaddr_history Sample Query

user_ipaddr_history Fields

table.

Table 6-57 user_ipaddr_history Fields

Field

Description

The UNIX timestamp of the date and time the FireSIGHT System detected a different user logging into the host, marking the assumed end of the previous user’s session. Note that the FireSIGHT System does not detect logoffs.

An internal identification number for the user history record.

A binary representation of the IP address of the host.

The UNIX timestamp of the date and time the FireSIGHT System detected the user logging into host.

The department of the user.

The email address of the user.

The first name of the user.

An internal identification number for the user.

The last name of the user.

The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user.

The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user.

The user name of the user.

The phone number of the user.

Name of the application protocol being used when the user was detected, if available.

user_ipaddr_history Joins

table.

Table 6-58 user_ipaddr_history Joins

You can join this table on...

And...

user_ipaddr_history Sample Query

The following query returns all user activity records for the selected IP address after the specified start timestamp.

Schema: Connection Log Tables

This chapter contains information on the schema and supported joins for connection data.

For more information, see the sections listed in the following table. The Version column indicates the Database Access versions supported by each listed table.

Table 7-1 Schema for Connection Log Tables

See...

For the table that stores information on...

Version

connection_log

.

5.0+

connection_summary

.

5.0+

si_connection_log

Individual connections. Used for security intelligence.

5.3+

connection_log

table contains information on connection events. The FireSIGHT System generates a connection event when a connection between a monitored host and any other host is established; the event contains detailed information about the monitored traffic.

table starting with Version 5.0 of the FireSIGHT System.

For more information, see the following sections:

- connection_log Fields

- connection_log Joins

- connection_log Sample Query

connection_log Fields

table.

Table 7-2 connection_log Fields

Field

Description

The access control policy that contains the access control rule (or default action) that logged the connection.

The UUID of the access control policy that contains the access control rule (or default action) that logged the connection.

access_control_reason

The reason that the access control rule logged the connection. One or more of the following:

- IP Block

- IP Monitor

- User Bypass

- File Monitor

- File Block

- Intrusion Monitor

- Intrusion Block

- File Resume Block

- File Resume Allow

- File Custom Detection

- SSL Block

- DNS Block

- DNS Monitor

- URL Block

- URL Monitor

- HTTP Injection

- Intelligent App Bypass

- blank if there is no connection logged

, and so on.

An internal identification number for the rule.

The access control rule (or default action) that logged the connection.

An internal identification number of the application protocol.

One of:

- the name of the application, if a positive identification can be made

- unknown if the system cannot identify the server based on known server fingerprints

- pending if the system requires more data

- blank if there is no application information in the connection

The total number of bytes transmitted by the session responder.

Total number of bytes transmitted by the session initiator.

The Unix timestamp on which the SSL certificate used in the connection ceases to be valid.

The Unix timestamp when the SSL certificate used in the connection was issued.

An internal identification number for the client application that was used in the intrusion event.

The client application, if available, that was used in the intrusion event. One of:

- the name of the application, if a positive identification can be made.

- a generic client name if the system detects a client application but cannot identify a specific one.

- blank if there is no client application information in the connection.

The version of the client application.

The detection source for the connection information. Either:

- rna , if detected by a Cisco device

- netflow , if exported by a NetFlow-enabled device

Counter for the intrusion event associated with the connection event.

The number of files identified by Snort in a session. A record is generated for each file identified in the session.

The UNIX timestamp of the date and time the first packet of the session was seen.

An internal identification number for the connection.

if the event was not generated from ICMP traffic.

if the event was not generated from ICMP traffic.

The name of the continent of the host that initiated the session:

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the host that initiated the session.

Name of the country of the host that initiated the session.

, but it is not reliable.

for all queries.

A binary representation of the IP address of the host that initiated the session.

for all queries.

The port used by the session initiator.

The department of the user who last logged into the initiator host.

The email address of the user who last logged into the initiator host.

The first name of the user who last logged into the initiator host.

An internal identification number for the user who last logged into the initiator host.

The last name of the user who last logged into the initiator host.

The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user who last logged into the initiator host.

The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user who last logged into the initiator host.

The user name of the user who last logged into the initiator host.

The phone number of the user who last logged into the initiator host.

Numerical ID of the Snort instance on the managed device that generated the event.

The ingress interface associated with the connection.

The egress interface associated with the connection.

Number of indications of compromise found in the connection.

The number of intrusion events generated in the connection prior to intrusion event thresholding.

The UNIX timestamp of the date and time the last packet of the session was seen.

monitor_rule_id_1

.

monitor_rule_id_2

.

monitor_rule_id_3

.

monitor_rule_id_4

.

monitor_rule_id_5

.

monitor_rule_id_6

.

monitor_rule_id_7

.

monitor_rule_id_8

.

monitor_rule_name_1

.

monitor_rule_name_2

.

monitor_rule_name_3

.

monitor_rule_name_4

.

monitor_rule_name_5

.

monitor_rule_name_6

.

monitor_rule_name_7

.

.

The NetBIOS domain used in the connection.

Netflow autonomous system number of the destination, either origin or peer.

Netflow destination address prefix mask.

Type of service from the IP header when packets are flowing from the destination to the source.

ID of the interface used by packets flowing from the source to the destination.

ID of the interface used by packets flowing from the destination to the source.

Netflow autonomous system number of the source, either origin or peer.

Netflow source address prefix mask.

Type of service from the IP header when packets are flowing from the source to the destination.

network_analysis_policy_name

The network analysis policy associated with the intrusion policy that generated the intrusion event.

network_analysis_policy_UUID

The UUID of the network analysis policy associated with the intrusion policy that generated the intrusion event.

The total number of packets received by the host that initiated the session.

The total number of packets transmitted by the host that initiated the session.

The name of the protocol used in the connection.

.

The name of the continent of the host that responded to the session initiator:

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the host that responded to the session initiator.

Name of the country of the host that responded to the session initiator.

, but it is not reliable.

for all queries.

A binary representation of the IPv4 or IPv6 address for the host that responded to the session initiator.

for all queries.

The port used by the session responder.

The department of the user who last logged into the host that responded to the session initiator.

The email address of the user who last logged into the host that responded to the session initiator.

The first name of the user who last logged into the host that responded to the session initiator.

An internal identification number for the user who last logged into the host that responded to the session initiator.

The last name of the user who last logged into the host that responded to the session initiator.

The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user who last logged into the host that responded to the session initiator.

The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user who last logged into the host that responded to the session initiator.

The user name of the user who last logged into the host that responded to the session initiator.

The phone number of the user who last logged into the host that responded to the session initiator.

security_context

Description of the security context (virtual firewall) that the traffic passed through. Note that the system only populates this field for ASA FirePOWER devices in multi-context mode.

security_intelligence_category

The Security Intelligence category associated with the connection.

security_intelligence_ip

).

The egress security zone in the connection event.

The ingress security zone in the connection event.

.

The name of the managed device that monitored the session.

.

for all queries.

, but it is not reliable.

Either:

- A binary representation of the IP address of the NetFlow-enabled device that exported the connection data

- 0 , for connections detected by Cisco managed devices.

- Field deprecated in Version 5.2. Returns null for all queries.

The action performed on the connection based on the SSL Rule. This may differ from the expected action, as the action as specified in the rule may be impossible. Possible values include:

- Unknown

- Do Not Decrypt

- Block

- Block With Reset

- Decrypt (Known Key)

- Decrypt (Replace Key)

- Decrypt (Resign)

Encryption suite used by the SSL connection. The value is stored

in decimal format. See

for the cipher suite designated by the value.

The action which should be performed on the connection based on the SSL Rule. Possible values include:

- Unknown

- Do Not Decrypt

- Block

- Block With Reset

- Decrypt (Known Key)

- Decrypt (Replace Key)

- Decrypt (Resign)

The debugging level flags for an encrypted connection. Possible values include:

- 0x00000001 — NSE_FLOW__VALID — must be set for other fields to be valid

- 0x00000002 — NSE_FLOW__INITIALIZED — internal structures ready for processing

- 0x00000004 — NSE_FLOW__INTERCEPT — SSL session has been intercepted

The messages exchanged between client and server during the SSL

for more

information.

- 0x00000001 — NSE_MT__HELLO_REQUEST

- 0x00000002 — NSE_MT__CLIENT_ALERT

- 0x00000004 — NSE_MT__SERVER_ALERT

- 0x00000008 — NSE_MT__CLIENT_HELLO

- 0x00000010 — NSE_MT__SERVER_HELLO

- 0x00000020 — NSE_MT__SERVER_CERTIFICATE

- 0x00000040 — NSE_MT__SERVER_KEY_EXCHANGE

- 0x00000080 — NSE_MT__CERTIFICATE_REQUEST

- 0x00000100 — NSE_MT__SERVER_HELLO_DONE

- 0x00000200 — NSE_MT__CLIENT_CERTIFICATE

- 0x00000400 — NSE_MT__CLIENT_KEY_EXCHANGE

- 0x00000800 — NSE_MT__CERTIFICATE_VERIFY

- 0x00001000 — NSE_MT__CLIENT_CHANGE_CIPHER_SPEC

- 0x00002000 — NSE_MT__CLIENT_FINISHED

- 0x00004000 — NSE_MT__SERVER_CHANGE_CIPHER_SPEC

- 0x00008000 — NSE_MT__SERVER_FINISHED

- 0x00010000 — NSE_MT__NEW_SESSION_TICKET

- 0x00020000 — NSE_MT__HANDSHAKE_OTHER

- 0x00040000 — NSE_MT__APP_DATA_FROM_CLIENT

- 0x00080000 — NSE_MT__APP_DATA_FROM_SERVER

Status of the SSL Flow. These values describe the reason behind the action taken or the error message seen. Possible values include:

- 'Unknown'

- 'No Match'

- 'Success'

- 'Uncached Session'

- 'Unknown Cipher Suite'

- 'Unsupported Cipher Suite'

- 'Unsupported SSL Version'

- 'SSL Compression Used'

- 'Session Undecryptable in Passive Mode'

- 'Handshake Error'

- 'Decryption Error'

- 'Pending Server Name Category Lookup'

- 'Pending Common Name Category Lookup'

- 'Internal Error'

- 'Network Parameters Unavailable'

- 'Invalid Server Certificate Handle'

- 'Server Certificate Fingerprint Unavailable'

- 'Cannot Cache Subject DN'

- 'Cannot Cache Issuer DN'

- 'Unknown SSL Version'

- 'External Certificate List Unavailable'

- 'External Certificate Fingerprint Unavailable'

- 'Internal Certificate List Invalid'

- 'Internal Certificate List Unavailable'

- 'Internal Certificate Unavailable'

- 'Internal Certificate Fingerprint Unavailable'

- 'Server Certificate Validation Unavailable'

- 'Server Certificate Validation Failure'

- 'Invalid Action'

Issuer Common name from the SSL certificate. This is typically the host and domain name of the certificate issuer, but may contain other information.

The country of the SSL certificate issuer.

The organization of the SSL certificate issuer.

The organizational unit of the SSL certificate issuer.

The default action configured for the policy when no rules match.

ID number of the SSL policy that handled the connection.

The reason the SSL policy logged the SSL session.

, and so forth).

ID number of the SSL rule or default action that handled the connection.

The serial number of the SSL certificate, assigned by the issuing CA.

Name provided in the server name indication in the SSL Client Hello.

Subject Common name from the SSL certificate. This is typically the host and domain name of the certificate subject, but may contain other information.

The country of the SSL certificate subject.

The organization of the SSL certificate subject.

The organizational unit of the SSL certificate subject.

Category of the flow as identified from the server name and certificate common name.

The SSL or TLS protocol version used to encrypt the connection.

The TCP flags detected in the session.

The URL requested by the monitored host during the session, if available.

The category of the URL requested by the monitored host.

The reputation of the URL requested by the monitored host. One of the following:

- 1 — High risk

- 2 — Suspicious sites

- 3 — Benign sites with security risks

- 4 — Benign sites

- 5 — Well known

An internal identification number for the web application.

One of:

- the name of the application, if a positive identification can be made.

- web browsing if the system detects an application protocol of HTTP but cannot identify a specific web application.

- blank if the connection has no HTTP traffic.

connection_log Joins

table.

Table 7-3 connection_log Joins

You can join this table on...

And...

or

or

or

connection_log Sample Query

table, sorted in descending order based on packet timestamps.

connection_summary

table contains information on connection summaries or aggregated connections. The FireSIGHT System aggregates connections over five-minute intervals. To be aggregated, connections must:

- have the same source and destination IP addresses

- use the same protocol

- use the same application

- either be detected by the same managed device (for sessions detected by managed devices with FireSIGHT) or be exported by the same NetFlow-enabled device and processed by the same managed device

The aggregated data in a connection summary includes the total number of packets and bytes sent by the initiator and responder hosts, as well as the number of connections in the summary.

table starting with Version 5.0 of the FireSIGHT System.

For more information, see the following sections:

- connection_summary Fields

- connection_summary Joins

- connection_summary Sample Query

connection_summary Fields

table.

Table 7-4 connection_summary Fields

Field

Description

An internal identification number for the application protocol.

One of:

- the name of the application, if a positive identification can be made

- unknown if the system cannot identify the server based on known server fingerprints

- pending if the system requires more data

- blank if there is no application information in the connection

The total number of bytes transmitted by the session responder.

The total number of bytes transmitted by the session initiator.

The detection source for the connection information. Either:

- rna , if detected by a Cisco device

- netflow , if exported by a NetFlow-enabled device

for all queries.

An internal identification number for the connection summary.

for all queries.

A binary representation of the IP address of the host that initiated the session.

The department of the user who last logged into the initiator host.

The email address of the user who last logged into the initiator host.

The first name of the user who last logged into the initiator host.

An internal identification number for the user who last logged into the initiator host.

The last name of the user who last logged into the initiator host.

The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user who last logged into the initiator host.

The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user who last logged into the initiator host.

The user name of the user who last logged into the initiator host.

The phone number of the user who last logged into the initiator host.

The ingress interface associated with the connection.

The egress interface associated with the connection.

The number of connections in the summary. For long-running connections, that is, connections that span multiple connection summary intervals, only the first connection summary is incremented.

The total number of packets transmitted by the session responder.

The total number of packets transmitted by the session initiator.

The name of the protocol used in the aggregated sessions.

.

for all queries.

A binary representation of the IP address of the host that responded to the initiator of the aggregated sessions.

The port used by the responder in the aggregated sessions.

The department of the user who last logged into the host that responded to the initiator of the aggregated sessions.

The email address of the user who last logged into the host that responded to the initiator of the aggregated sessions.

The first name of the user who last logged into the host that responded to the initiator of the aggregated sessions.

An internal identification number for the user who last logged into the host that responded to the initiator of the aggregated sessions.

The last name of the user who last logged into the host that responded to the initiator of the aggregated sessions.

The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user who last logged into the host that responded to the initiator of the aggregated sessions.

The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user who last logged into the host that responded to the session initiator.

The user name of the user who last logged into the host that responded to the initiator of the aggregated sessions.

The phone number of the user who last logged into the host that responded to the initiator of the aggregated sessions.

The egress security zone in the connection event.

The ingress security zone in the connection event.

.

The name of the managed device that monitored the aggregated sessions.

.

The identification of the source device, which is either:

- the IP address of the NetFlow-enabled device that exported the data for the connection

- FireSIGHT if the connection was detected by a Cisco managed device

The UNIX timestamp of the date and time the five-minute interval used to aggregate the sessions in the summary started.

connection_summary Joins

table.

Table 7-5 connection_summary Joins

You can join this table on...

And...

or

connection_summary Sample Query

The following query returns up to five connection event summary records detected by the selected device.

si_connection_log

table contains information on security intelligence events. The FireSIGHT System generates a Security Intelligence event when a connection is blacklisted or monitored by Security Intelligence; the event contains detailed information about the monitored traffic.

For more information, see the following sections:

- si_connection_log Fields

- si_connection_log Joins

- si_connection_log Sample Query

si_connection_log Fields

table.

Table 7-6 si_connection_log Fields

Field

Description

The access control policy that contains the access control rule (or default action) that logged the connection.

The UUID of the access control policy that contains the access control rule (or default action) that logged the connection.

access_control_reason

The reason that the access control rule logged the connection. One or more of the following:

- IP Block

- IP Monitor

- User Bypass

- File Monitor

- File Block

- Intrusion Monitor

- Intrusion Block

- File Resume Block

- File Resume Allow

- File Custom Detection

- SSL Block

- DNS Block

- DNS Monitor

- URL Block

- URL Monitor

- HTTP Injection

- Intelligent App Bypass

- blank if there is no connection logged

, and so on.

An internal identification number for the rule.

The access control rule (or default action) that logged the connection.

An internal identification number of the application protocol.

One of:

- the name of the application, if a positive identification can be made

- unknown if the system cannot identify the server based on known server fingerprints

- pending if the system requires more data

- blank if there is no application information in the connection

The total number of bytes transmitted by the session responder.

Total number of bytes transmitted by the session initiator.

The Unix timestamp on which the SSL certificate used in the connection ceases to be valid.

The Unix timestamp when the SSL certificate used in the connection was issued.

An internal identification number for the client application that was used in the intrusion event.

The client application, if available, that was used in the intrusion event. One of:

- the name of the application, if a positive identification can be made

- a generic client name if the system detects a client application but cannot identify a specific one

- blank if there is no client application information in the connection

The version of the client application.

The detection source for the connection information. Either:

- rna , if detected by a Cisco device

- netflow , if exported by a NetFlow-enabled device

Counter for the intrusion event associated with the connection event.

The number of files identified by snort in a session. A record is generated for each file identified in the session.

The UNIX timestamp of the date and time the first packet of the session was seen.

if the event was not generated from ICMP traffic.

if the event was not generated from ICMP traffic.

The name of the continent of the host that initiated the session.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the host that initiated the session.

Name of the country of the host that initiated the session.

A binary representation of the IP address of the host that initiated the session.

The port used by the session initiator.

The department of the user who last logged into the initiator host.

The email address of the user who last logged into the initiator host.

The first name of the user who last logged into the initiator host.

An internal identification number for the user who last logged into the initiator host.

The last name of the user who last logged into the initiator host.

The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user who last logged into the initiator host.

The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user who last logged into the initiator host.

The user name of the user who last logged into the initiator host.

The phone number of the user who last logged into the initiator host.

Numerical ID of the Snort instance on the managed device that generated the event.

The ingress interface associated with the connection.

The egress interface associated with the connection.

Number of indications of compromise found in the connection.

The number of intrusion events generated in the connection prior to intrusion event thresholding.

The UNIX timestamp of the date and time the last packet of the session was seen.

monitor_rule_id_1

.

monitor_rule_id_2

.

monitor_rule_id_3

.

monitor_rule_id_4

.

monitor_rule_id_5

.

monitor_rule_id_6

.

monitor_rule_id_7

.

monitor_rule_id_8

.

monitor_rule_name_1

.

monitor_rule_name_2

.

monitor_rule_name_3

.

monitor_rule_name_4

.

monitor_rule_name_5

.

monitor_rule_name_6

.

monitor_rule_name_7

.

monitor_rule_name_8

.

The NetBIOS domain used in the connection.

Netflow autonomous system number of the destination, either origin or peer.

Netflow destination address prefix mask.

Type of service from the IP header when packets are flowing from the destination to the source.

ID of the interface used by packets flowing from the source to the destination.

ID of the interface used by packets flowing from the destination to the source.

Netflow autonomous system number of the source, either origin or peer.

Netflow source address prefix mask.

Type of service from the IP header when packets are flowing from the source to the destination.

network_analysis_policy_name

The network analysis policy associated with the intrusion policy that generated the intrusion event.

network_analysis_policy_UUID

The UUID of the network analysis policy associated with the intrusion policy that generated the intrusion event.

The total number of packets received by the host that initiated the session.

The total number of packets transmitted by the host that initiated the session.

The name of the protocol used in the connection.

.

The name of the continent of the host that responded to the session initiator.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the host that responded to the session initiator.

Name of the country of the host that responded to the session initiator.

A binary representation of the IPv4 or IPv6 address for the host that responded to the session initiator.

The port used by the session responder.

The department of the user who last logged into the host that responded to the session initiator.

The email address of the user who last logged into the host that responded to the session initiator.

The first name of the user who last logged into the host that responded to the session initiator.

An internal identification number for the user who last logged into the host that responded to the session initiator.

The last name of the user who last logged into the host that responded to the session initiator.

The UNIX timestamp of the date and time the FireSIGHT System last detected user activity for the user who last logged into the host that responded to the session initiator.

The UNIX timestamp of the date and time the FireSIGHT System last updated the user record for the user who last logged into the host that responded to the session initiator.

The user name of the user who last logged into the host that responded to the session initiator.

The phone number of the user who last logged into the host that responded to the session initiator.

security_context

Description of the security context (virtual firewall) that the traffic passed through. Note that the system only populates this field for ASA FirePOWER devices in multi-context mode.

security_intelligence_category

The Security Intelligence category associated with the connection.

security_intelligence_ip

).

The egress security zone in the connection event.

The ingress security zone in the connection event.

.

The name of the managed device that monitored the session.

.

Either:

- A binary representation of the IP address of the NetFlow-enabled device that exported the connection data

- 0 , for connections detected by Cisco managed devices.

The action performed on the connection based on the SSL Rule.

This may differ from the expected action, as the action as specified

in the rule may be impossible. Possible values include:

- 'Unknown'

- 'Do Not Decrypt'

- 'Block'

- 'Block With Reset'

- 'Decrypt (Known Key)'

- 'Decrypt (Replace Key)'

- 'Decrypt (Resign)'

Encryption suite used by the SSL connection. The value is stored

in decimal format. See

for the cipher suite designated by the value.

The action which should be performed on the connection based on

the SSL Rule. Possible values include:

- 'Unknown'

- 'Do Not Decrypt'

- 'Block'

- 'Block With Reset'

- 'Decrypt (Known Key)'

- 'Decrypt (Replace Key)'

- 'Decrypt (Resign)'

The debugging level flags for an encrypted connection. Possible

values include:

- 0x00000001 — NSE_FLOW__VALID — must be set for other fields to be valid

- 0x00000002 — NSE_FLOW__INITIALIZED — internal structures ready for processing

- 0x00000004 — NSE_FLOW__INTERCEPT — SSL session has been intercepted

The messages exchanged between client and server during the SSL

for more

information.

- 0x00000001 — NSE_MT__HELLO_REQUEST

- 0x00000002 — NSE_MT__CLIENT_ALERT

- 0x00000004 — NSE_MT__SERVER_ALERT

- 0x00000008 — NSE_MT__CLIENT_HELLO

- 0x00000010 — NSE_MT__SERVER_HELLO

- 0x00000020 — NSE_MT__SERVER_CERTIFICATE

- 0x00000040 — NSE_MT__SERVER_KEY_EXCHANGE

- 0x00000080 — NSE_MT__CERTIFICATE_REQUEST

- 0x00000100 — NSE_MT__SERVER_HELLO_DONE

- 0x00000200 — NSE_MT__CLIENT_CERTIFICATE

- 0x00000400 — NSE_MT__CLIENT_KEY_EXCHANGE

- 0x00000800 — NSE_MT__CERTIFICATE_VERIFY

- 0x00001000 — NSE_MT__CLIENT_CHANGE_CIPHER_SPEC

- 0x00002000 — NSE_MT__CLIENT_FINISHED

- 0x00004000 — NSE_MT__SERVER_CHANGE_CIPHER_SPEC

- 0x00008000 — NSE_MT__SERVER_FINISHED

- 0x00010000 — NSE_MT__NEW_SESSION_TICKET

- 0x00020000 — NSE_MT__HANDSHAKE_OTHER

- 0x00040000 — NSE_MT__APP_DATA_FROM_CLIENT

- 0x00080000 — NSE_MT__APP_DATA_FROM_SERVER

Status of the SSL Flow. These values describe the reason behind the action taken or the error message seen. Possible values include:

- 'Unknown'

- 'No Match'

- 'Success'

- 'Uncached Session'

- 'Unknown Cipher Suite'

- 'Unsupported Cipher Suite'

- 'Unsupported SSL Version'

- 'SSL Compression Used'

- 'Session Undecryptable in Passive Mode'

- 'Handshake Error'

- 'Decryption Error'

- 'Pending Server Name Category Lookup'

- 'Pending Common Name Category Lookup'

- 'Internal Error'

- 'Network Parameters Unavailable'

- 'Invalid Server Certificate Handle'

- 'Server Certificate Fingerprint Unavailable'

- 'Cannot Cache Subject DN'

- 'Cannot Cache Issuer DN'

- 'Unknown SSL Version'

- 'External Certificate List Unavailable'

- 'External Certificate Fingerprint Unavailable'

- 'Internal Certificate List Invalid'

- 'Internal Certificate List Unavailable'

- 'Internal Certificate Unavailable'

- 'Internal Certificate Fingerprint Unavailable'

- 'Server Certificate Validation Unavailable'

- 'Server Certificate Validation Failure'

- 'Invalid Action'

Issuer Common name from the SSL certificate. This is typically the host and domain name of the certificate issuer, but may contain other information.

The country of the SSL certificate issuer.

The organization of the SSL certificate issuer.

The organizational unit of the SSL certificate issuer.

The default action configured for the policy when no rules match.

ID number of the SSL policy that handled the connection.

The reason the SSL policy logged the SSL session.

, and so forth).

ID number of the SSL rule or default action that handled the connection.

The serial number of the SSL certificate, assigned by the issuing CA.

Name provided in the server name indication in the SSL Client Hello.

Subject Common name from the SSL certificate. This is typically the host and domain name of the certificate subject, but may contain other information.

The country of the SSL certificate subject.

The organization of the SSL certificate subject.

The organizational unit of the SSL certificate subject.

Category of the flow as identified from the server name and certificate common name.

The SSL or TLS protocol version used to encrypt the connection.

The TCP flags detected in the session.

The URL requested by the monitored host during the session, if available.

The category of the URL requested by the monitored host.

The reputation of the URL requested by the monitored host. One of the following:

- 1 — High risk

- 2 — Suspicious sites

- 3 — Benign sites with security risks

- 4 — Benign sites

- 5 — Well known

An internal identification number for the web application.

One of:

- the name of the application, if a positive identification can be made.

- web browsing if the system detects an application protocol of HTTP but cannot identify a specific web application.

- blank if the connection has no HTTP traffic.

si_connection_log Joins

table.

Table 7-7 si_connection_log Joins

You can join this table on...

And...

or

or

or

or

si_connection_log Sample Query

table, sorted in descending order based on packet timestamps.

Schema: User Activity Tables

This chapter contains information on the schema and supported joins for user activity and identity events. The FireSIGHT System can detect user activity on your network by tracking various types of user logins, including LDAP, POP3, IMAP, SMTP, AIM, and SIP.

For more information, see the sections listed in the following table.

Table 8-1 Schema for User Identity Tables

See...

For the table that stores information on...

Version

discovered_users

Information about the users detected by the system.

5.0+

user_discovery_event

User discovery events, which communicate the details of user activity on your network.

5.0+

discovered_users

table contains detailed information about each user detected by the system.

table starting with Version 5.0 of the FireSIGHT System.

For more information, see the following sections:

- discovered_users Fields

- discovered_users Joins

- discovered_users Sample Query

discovered_users Fields

table.

Table 8-2 discovered_users Fields

Field

Description

The department of the user.

The email address for the user.

The first name for the user.

for all queries.

A binary representation of the IPv4 or IPv6 address for the host where the user login was detected.

The last name for the user.

The UNIX timestamp of the date and time the system last reported a login for the user.

The UNIX timestamp of the date and time the user’s information was last updated.

The name for the user.

The phone number for the user.

for all queries.

The internal identification number of the user who last logged onto the host.

discovered_users Joins

table.

Table 8-3 discovered_users Joins

You can left join on this field...

With other tables that have join type of...

discovered_users Sample Query

The following query returns up to 25 discovered user records that were generated since a specified date and time.

user_discovery_event

table contains a record for each user discovery event.

fields respectively. Queries on these fields will return information about the managed device that generated the user discovery event.

For more information, see the following sections:

- user_discovery_event Fields

- user_discovery_event Joins

- user_discovery_event Sample Query

user_discovery_event Fields

table.

Table 8-4 user_discovery_event Fields

Field

Description

An internal identifier for the detected application protocol.

One of:

- the name of the application used in the connection: LDAP, POP3, and so on

- pending if the system cannot identify the application for one of several reasons

- blank if there is no application information in the connection

The user name when the discovery event type is either Delete User Identity, or User Identity Dropped. Otherwise, blank.

An internal identification number for the discovery event.

The UNIX timestamp of the date and time of the discovery event.

.

for all queries.

A binary representation of the IP address of the host where the user activity was detected.

reported_by

The IPv4 address, IPv6 address, or NetBIOS name of the Active Directory server reporting a user login.

.

The text name of the managed device that detected the user discovery event.

.

The department of the user who last logged onto the host.

The email address of the user who last logged onto the host.

The first name of the user.

The internal identification number of the user who last logged onto the host.

The last name of the user.

The UNIX timestamp of the date and time the system last reported a login for the user.

The UNIX timestamp of the date and time the user’s information was last updated.

The user name for the user who last logged onto the host.

The phone number for the user who last logged onto the host.

user_discovery_event Joins

table.

Table 8-5 user_discovery_event Joins

You can join this table on...

And...

user_discovery_event Sample Query

The following query returns up to 25 user event records generated by a selected managed device since a particular date and time.

Schema: Correlation Tables

This chapter contains information on the schema and supported joins for correlation-related events, including remediation status and white list events. For more information, see the sections listed in the following table.

Table 9-1 Schema for Correlation Tables

See...

For the table that stores information on...

Version

compliance_event

Correlation events, which are generated when a correlation rule within an active correlation policy triggers.

4.10.x+

remediation_status

Remediation status events, which are generated when an active correlation policy triggers a remediation as a response.

4.10.x+

white_list_event

White list events, which are generated when the system detects a host out of compliance with a white list in an active white list compliance policy.

4.10.x+

white_list_violation

White list violations, which track the ways that the hosts on your network violate the compliance white lists in active compliance policies.

4.10.x+

compliance_event

table contains information about the correlation events that your Defense Center generates.

For more information, see the following sections:

- compliance_event Fields

- compliance_event Joins

- compliance_event Sample Query

compliance_event Fields

Keep in mind that many of the fields in the table can be blank, depending on what type of event triggered the correlation rule. For example, if the Defense Center generates a correlation event because the system detects a specific application protocol or web application running on a specific port, that correlation event does not include intrusion-related information. Fields in this table can also be blank depending on your FireSIGHT System configuration. For example, if you do not have a Control license, correlation events do not include user identity information.

for information about the location of an event’s detection.

table.

Table 9-2 compliance_event Fields

Field

Description

Value indicating what happened to the packet that triggered the intrusion event:

- 0 — Packet not dropped

- 1 — Packet dropped (inline, switched, or routed deployments)

- 2 — Packet that triggered the event would have been dropped, if the intrusion policy had been applied to a device in an inline, switched, or routed deployment

Information about the correlation event and how it was triggered.

for all queries.

for all queries.

.

.

, but it is not reliable.

dst_ip_address_v6

, but it is not reliable.

dst_ipaddr

A binary representation of the IPv4 or IPv6 address for the destination host involved in the triggering event.

The operating system name on the destination host.

The operating system’s vendor on the destination host.

The operating system’s version number on the destination host.

The port number for the host receiving the traffic if the event protocol type is TCP or UDP. The ICMP code if the protocol type is ICMP.

If identified, the application protocol on the source host that is associated with the triggering event. If not identified, one of the following:

- none or blank - no application protocol traffic

- unknown - the server cannot be identified based on known server fingerprints

- pending - the system needs more information

The department of the destination user.

The email address of the destination user.

The first name of the destination user.

The internal identification number for the destination user; that is, the user who last logged into the destination host before the event occurred.

The last name of the destination user.

The UNIX timestamp of the date and time the system last reported a login for the destination user.

The UNIX timestamp of the date and time the destination user’s information was last updated.

The user name for the destination user.

The destination user’s phone number.

The destination host’s VLAN identification number, if applicable.

The identification number of the triggering intrusion event generated by the device.

The UNIX timestamp of the date and time of the triggering event.

The microsecond increment of the triggering event timestamp.

The type of underlying event that triggered the correlation rule or caused the Defense Center to generate the correlation event. Values are:

- ids , for intrusion event triggers

- rna , for discovery event, host input event, connection event, or traffic profile change triggers

- rua , for user discovery event triggers

- whitelist , for compliance white list violation triggers

.

An internal identification number for the correlation event.

The impact flag value of the event. Values are:

- 1 — Red (vulnerable)

- 2 — Orange (potentially vulnerable)

- 3 — Yellow (currently not vulnerable)

- 4 — Blue (unknown target)

- 5 — Gray (unknown impact)

Set only when the correlation rule was triggered by an intrusion event.

The ingress interface associated with the connection.

The egress interface associated with the connection.

The correlation policy that was violated.

The correlation rule that triggered the policy violation.

A unique identifier for the correlation rule.

The UNIX timestamp of the date and time the correlation event was generated.

A unique identifier for the correlation policy.

The priority for the correlation event, which is set in the user interface. The event priority is determined by the priority of either the triggered rule or the violated correlation policy.

The protocol associated with the event, if available.

The IANA-specified protocol number, if available.

for all queries.

for all queries.

The generator ID number (GID) of the component that generated the triggering intrusion event.

Explanatory text about the intrusion event that triggered the correlation rule. For rule-based events, the message is generated from the rule. For decoder- and preprocessor-based events, the message is hard coded.

The signature ID (SID) for the event. Identifies the specific rule or rules, decoder message, or preprocessor message that caused the triggering intrusion event to be generated.

The egress security zone in the correlation event.

The ingress security zone in the correlation event.

.

The managed device that generated the underlying event that triggered the compliance event.

.

.

.

, but it is not reliable.

src_ip_address_v6

, but it is not reliable.

src_ipaddr

A binary representation of the IPv4 or IPv6 address for the source host involved in the triggering event.

The operating system’s name on the source host.

The operating system’s vendor on the source host.

The operating system’s version number on the source host.

The port number on the source host. For ICMP traffic, the ICMP type appears instead.

If identified, the application protocol on the source host that is associated with the triggering event. If not identified, one of the following:

- none or blank - no application protocol traffic

- unknown - the server and application protocol cannot be identified based on known server fingerprints

- pending - the system needs more information

The department of the source user.

The email address of the source user.

The first name of the source user.

The internal identification number for the source user; that is, the user who last logged into the source host before the event occurred.

The last name of the source user.

The UNIX timestamp of the date and time the system last reported a login for the source user.

The UNIX timestamp of the date and time the source user’s information was last updated.

The login user name for the source user.

The source user’s phone number.

The source host’s VLAN identification number, if applicable.

.

compliance_event Joins

table.

Table 9-3 compliance_event Joins

You can join this table on...

And...

or

compliance_event Sample Query

The following query returns up to 25 correlation event records from a week, with event information such as the event time, source and destination IP addresses, source and destination ports, policy information, and so on.

remediation_status

table contains information about remediation events, which are generated when the Defense Center launches a remediation in response to a correlation policy violation.

For more information, see the following sections:

- remediation_status Fields

- remediation_status Joins

- remediation_status Sample Query

remediation_status Fields

table.

Table 9-4 remediation_status Fields

Field

Description

The identification number of the policy that was violated and triggered the remediation.

The correlation policy that was violated and triggered the remediation.

The specific correlation rule that triggered the remediation.

A unique identifier for the correlation rule.

The UNIX timestamp of the date and time that the correlation event that triggered the remediation was generated.

A unique identifier for the correlation policy that triggered the correlation event.

The remediation that was launched.

The UNIX timestamp of the date and time the Defense Center launched the remediation.

.”

remediation_status Joins

table.

remediation_status Sample Query

The following query returns up to 25 records generated before a given date. These records include remediation status information such as the remediation timestamp, the status message, and so on.

white_list_event

table contains white list events that are generated when the system detects a host not compliant with a white list in an active white list compliance policy.

provides the equivalent information.

For more information, see the following sections:

- white_list_event Fields

- white_list_event Joins

- white_list_event Sample Query

white_list_event Fields

table.

Table 9-5 white_list_event Fields

Field

Description

A description of how the white list was violated.

for all queries.

for all queries.

The user-assigned criticality of the host that is out of compliance with the white list: None, Low, Medium, or High.

.

An internal unique identifier for the white list event.

for all queries.

ip_address_v6

for all queries.

ipaddr

A binary representation of the IP address of the non-compliant host.

The operating system’s product name.

The operating system’s vendor.

The operating system’s version number.

The violated compliance policy that includes the white list.

The UNIX timestamp of the date and time the event was generated.

A unique identifier for the compliance policy that includes the white list event.

The port, if any, associated with the event that triggered a service white list violation (that is, when a violation occurs as a result of a non-compliant service). For other types of white list violations, the field is blank.

The priority for the white list event, which is set in the user interface.

The protocol associated with the event, if available.

The IANA-specified protocol number, if available.

The service that triggered the white list violation, if available.

.

The device that generated the white list event.

.

The department of the user.

The email address for the user.

The first name for the user.

Internal identification number of the user who last logged into the host before the event occurred.

The last name for the user.

The UNIX timestamp of the date and time the system last reported a login for the user.

The UNIX timestamp of the date and time the user’s information was last updated.

The login user name for the user.

The phone number for the user.

The VLAN identification number, if applicable.

The white list that was violated.

A unique identifier for the white list.

white_list_event Joins

table.

Table 9-6 white_list_event Joins

You can join this table on...

And...

white_list_event Sample Query

The following query returns up to 25 records generated before a specified time. The records include white list event information such as the compliance policy name, timestamp the event was generated, white list name, and so on.

white_list_violation

table track compliance white list violations, which track the ways that the hosts on your network violate the compliance white lists in active compliance policies.

For more information, see the following sections:

- white_list_violation Fields

- white_list_violation Joins

- white_list_violation Sample Query

white_list_violation Fields

table.

Table 9-7 white_list_violation Fields

Field

Description

ID number of the host in violation of the white list.

Any available vendor, product, or version information associated with the white list violation.

For protocols that violate a white list, the field also indicates whether the violation is due to a network or transport protocol.

for all queries.

The port, if any, associated with the event that triggered a service white list violation (that is, when a violation occurs as a result of a non-compliant service). For other types of white list violations, the field is blank.

The protocol associated with the event.

The type of white list violation, indicating whether the violation occurred due to a non-compliant:

- operating system ( os )

- service ( service )

- client application ( client app )

- protocol ( protocol )

The UNIX timestamp of the date and time the violation was logged.

The white list that was violated.

A unique identifier for the white list.

white_list_violation Joins

table.

white_list_violation Sample Query

The following query returns up to 25 records with white list violation information such as the host IP address violating the white list, the violated white list name, and the count of violations.

Schema: File Event Tables

This chapter contains information on the schema and supported joins for file events. For more information, see the section listed in the following table.

Table 10-1 Schema for File Event Tables

See...

For the table that stores information on...

Version

file_event

File events generated when file transfers are detected in the monitored network.

5.1.1+

While the following tables are available, Cisco does not currently support lookups on them:

- file_categories

- file_rules

- file_types

- file_type_rule_map

- file_type_category_map

file_event

table contains information about the file events that your Defense Center generates. A new file event is generated each time a file transfer is detected on the monitored network.

For more information, see the following sections:

- file_event Fields

- file_event Joins

- file_event Sample Query

file_event Fields

table contains information on files that are detected passing through the monitored network. Each file event can be correlated with a connection event. Details of the file and file transfer are recorded, including the name, size, source, destination, and direction of the file, a SHA256 hash of the file, the device that detected the file, and whether it is considered to be malware.

Table 10-2 file_event Fields

Field

Description

The action taken on the file based on the file type. Can have the following values:

- 1 — Detect

- 2 — Block

- 3 — Malware Cloud Lookup

- 4 — Malware Block

- 5 — Malware Whitelist

- 6 — Cloud Lookup Timeout

ID number that maps to the application using the file transfer.

One of the following:

- the name of the application used in the connection

- pending or unknown if the system cannot identify the application

- blank if there is no application information in the connection

Indicates whether the file has been archived.

The Unix timestamp on which the SSL certificate used in the connection ceases to be valid.

The Unix timestamp when the SSL certificate used in the connection was issued.

The internal identification number for the client application, if applicable.

The name of the client application, if applicable.

UNIX timestamp (seconds since 00:00:00 01/01/1970) of the connection event associated with the file event.

Specific counter for the event, used to distinguish among multiple events that happened during the same second.

Whether the file was uploaded or downloaded. Currently the value depends entirely on the protocol (for example, if the connection is HTTP it is a download).

The malware status of the file. Possible values include:

- CLEAN — The file is clean and does not contain malware.

- UNKNOWN — It is unknown whether the file contains malware.

- MALWARE — The file contains malware.

- UNAVAILABLE — The software was unable to send a request to the Cisco cloud for a disposition, or the Cisco cloud services did not respond to the request.

- CUSTOM SIGNATURE — The file matches a user-defined hash, and is treated in a fashion designated by the user.

The name of the continent of the destination host.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the destination host.

Name of the country of the destination host.

for all queries.

A binary representation of the IP address of the destination host involved in the triggering event.

Port number for the destination of the connection.

The additional event information associated with the event type.

Event identification number.

Name of the detected file. This name can contain UTF-8 characters.

SHA256 hash of the file.

Size of the detected file in bytes.

The file type of the detected or quarantined file.

Description of the file category.

Numeric identifier for the file category.

ID number that maps to the file type.

Numerical ID of the Snort instance on the managed device that generated the event.

Identification number that acts as a unique identifier for the access control policy that triggered the event.

Indicates whether the file was sent for dynamic analysis. Possible values are:

- Sent for Analysis

- Failed to Send

- File Size is Too Small

- File Size is Too Large

- Sent for Analysis

- Analysis Complete

- Failure (Network Issue)

- Failure (Rate Limit)

- Failure (File Too Large)

- Failure (File Read Error)

- Failure (Internal Library Error)

- File Not Sent, Disposition Unavailable

- Failure (Cannot Run File)

- Failure (Analysis Timeout)

- File Not Supported

based on the potentially malicious behaviors observed during dynamic analysis.

Description of the security context (virtual firewall) that the traffic passed through. Note that the system only populates this field for ASA FirePOWER devices in multi-context mode.

A binary representation of the IP address of the device that provided the event.

ID for the device that provided the event.

when the event refers to the reporting device itself, rather than to a connected device.

.

Indicated whether the file’s signature was processed.

The name of the continent of the source host.

— Unknown

— North America

— Asia

— Africa

— Europe

— South America

— Australia

— Antarctica

Code for the country of the source host.

Name of the country of the source host.

for all queries.

A binary representation of the IPv4 or IPv6 address of the source host involved in the triggering event.

Port number for the source of the connection.

Issuer Common Name from the SSL certificate. This is typically the host and domain name of the certificate issuer, but may contain other information.

The country of the SSL certificate issuer.

The organization of the SSL certificate issuer.

The organizational unit of the SSL certificate issuer.

The serial number of the SSL certificate, assigned by the issuing CA.

Subject Common name from the SSL certificate. This is typically the host and domain name of the certificate subject, but may contain other information.

The country of the SSL certificate subject.

The organization of the SSL certificate subject.

The organizational unit of the SSL certificate subject.

The storage status of the file. Possible values are:

- File Stored

- Unable to Store File

- File Size is Too Large

- File Size is Too Small

- Unable to Store File

- File Not Stored, Disposition Unavailable

Name of the threat.

UNIX timestamp when enough of the file has been transmitted to identify the file type.

URL of the file source.

The internal identification number for the destination user; that is, the user who last logged into the destination host before the event occurred.

.

The internal identification number for the web application, if applicable.

Name of the web application, if applicable.

file_event Joins

table.

Table 10-3 file_event Joins

You can join this table on...

And...

file_event Sample Query

.

Deprecated Tables

. There are no supported joins for these tables.

Table A-1 Deprecated Tables

Table

Superseded by

Last Used Version

application_host_map

5.1.1

rna_host

5.1.1

rna_host_attribute

5.1.1

rna_host_client_app

5.1.1

rna_host_client_app_payload

5.1.1

rna_host_os

5.1.1

rna_host_os_vulns

5.1.1

rna_host_sensor

5.1.1

rna_host_service

5.1.1

rna_host_service_banner

5.1.1

rna_host_service_info

5.1.1

rna_host_service_payload

5.1.1

rna_host_service_subtype

5.1.1

rna_host_service_vulns

5.1.1

rna_host_third_party_vuln

5.1.1

rna_host_third_party_vuln_bugtraq_id

5.1.1

rna_host_third_party_vuln_cve_id

5.1.1

rna_host_third_party_vuln_rna_id

5.1.1

user_ipaddr_history

5.1.1

rna_host_mac_map

5.1.1

rna_host_mac_map

5.1.1

rna_host_mac_map

5.1.1

FireSIGHT System Database Access Guide

Version 5.4

November 11, 2016

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2014 Cisco Systems, Inc. All rights reserved.