Fields in the Schema

time

Type: timestamp

Defaults: 0

The time of the event.

action

Type: string

Defaults: -

What action was associated with that packet. Either denied or permitted.

protocol

Type: string

Defaults: -

The procotol of the packet. Common protocols are TCP, UDP or ICMP. This should be the IP protocol not higer-level application protocol.

from_ip

Type: ip

Defaults: -

The source ip address on the packet.

from_port

Type: port

Defaults: -

The source port (in the case of the TCP or UDP) protocol. This should be the ICMP type when the protocol is ICMP.

from_host

Type: hostname

Defaults: -

The hostname associated with the source IP.

rcv_intf

Type: string

Defaults: -

The receiving interface. That should be the network interface on which the packet was received. That field should contains the logical name or type of the interface.

rcv_hwaddr

Type: string

Defaults: -

The hardware address of the receiving interface. That's the MAC address in the case of an ethernet device.

to_ip

Type: ip

Defaults: -

The destination ip address on the packet.

to_port

Type: port

Defaults: -

The destination port (in the case of the TCP or UDP) protocol. This should be the ICMP code when the protocol is ICMP.

to_host

Type: hostname

Defaults: -

The hostname associated with the destination IP.

snt_intf

Type: string

Defaults: -

The sending interface. That should be the network interface on which the packet was sent (i.e. the outgoing interface).

length

Type: bytes

Defaults: 0

The packet length (that is the header and payload length). This should be the total length of the stream when the event represent multiple packets, for example, in the case of packet accounting done on streams.

rule

Type: string

Defaults: -

The rule that triggered that packet to be logged, denied, permitted, etc.

msg

Type: string

Defaults: -

A message associated with that packet. This could be an attack signature detected by a Network Intrusion Detection System or anything of similar nature.

count

Type: int

Defaults: 1

The number of packets described by this event. This will be 1 in the case of a single packet. It can be higher in the case where multiple packets are compressed into one event. Remember that the length values should reflect the length of all those packets.