diff --git a/docs/open-data-model/open-data-model.md b/docs/open-data-model/open-data-model.md index 768fd528..5000a342 100644 --- a/docs/open-data-model/open-data-model.md +++ b/docs/open-data-model/open-data-model.md @@ -271,15 +271,15 @@ etc.). | | out_bytes | int | Bytes out | 9344 | | | additional_attrs | String (JSON Map) | Custom event attributes | "building":"729","cube":"401" | | | dvc_time | long | UTC timestamp from device where event/alert originates or is received | 1472653952 | -| | dvc_ip4/dvc_ip6 | long | IP address of device | Integer representaion of 10.1.1.1 | +| | dvc_ip4/dvc_ip6 | int128 | IP address of device | Integer representaion of 10.1.1.1 | | | dvc_host | string | Hostname of device | Integer representaion of 10.1.1.1 | | | dvc_type | string | Device type that generated the log | Unix, Windows, Sonicwall | | | dvc_vendor | string | Vendor | Microsoft, Fireeye, Intel Security | | | dvc_version | string | Version | 5.4 | -| | fwd_ip4/fwd_ip6 | long | Forwarded from device | Integer representation of 10.1.1.1 | +| | fwd_ip4/fwd_ip6 | int128 | Forwarded from device | Integer representation of 10.1.1.1 | | | version | string | Version | “3.2.2” | | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | -| **Network** | src_ip4/src_ip6 | bigint | Source ip address of event | Integer representation of 10.1.1.1 | +| **Network** | src_ip4/src_ip6 | int128 | Source ip address of event | Integer representation of 10.1.1.1 | | | src_host | string | Source FQDN of event | test.companyA.com | | | src_domain | string | Domain name of source address | companyA.com | | | src_port | int | Source port of event | 1025 | @@ -289,7 +289,7 @@ etc.). | | src_city | string | Source city | Shenghai | | | src_lat | int | Source latitude | | | | src_long | int | Source longitude | | -| | dst_ip4/dst_ip6 | bigint | Destination ip address of event | Integer representaion of 10.1.1.1 | +| | dst_ip4/dst_ip6 | int128 | Destination ip address of event | Integer representaion of 10.1.1.1 | | | dst_host | string | Destination FQDN of event | test.companyA.com | | | dst_domain | string | Domain name of destination address | companyA.com | | | dst_port | int | Destination port of event | 80 | @@ -307,7 +307,7 @@ etc.). | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | | **File** | file_name | string | Filename from event | output.csv | | | file_path | string | File path | /root/output.csv | -| | file_atime | bigint | Timestamp (UTC) of file access | 1472653952 | +| | file_atime | long | Timestamp (UTC) of file access | 1472653952 | | | file_acls | string | File permissions | rwx-rwx-rwx | | | file_type | string | Type of file | “.doc” | | | file_size | int | Size of file in bytes | 1244 | @@ -358,8 +358,6 @@ etc.). | | response_status_code | int | HTTP response status code | 404 | | | response_status_msg | string | HTTP response status message | “Not found” | | | response_body_len | int | Length of response body | 98 | -| | response_info_code | int | HTTP response info code | 100 | -| | response_info_msg | string | HTTP response info message | “Some string” | | | response_resp_fuids | string | Response FUIDS | | | | response_mime_types | string | Mime types | “cgi,bat,exe” | | | response_headers | MAP | Response headers | response_headers[‘SERVER’] response_headers[‘SET-COOKIE’’] response_headers[‘DATE’] | @@ -375,7 +373,7 @@ etc.). | | headers_msg_id | string | Message ID | Coming soon | | | headers_in_reply_to | string | In reply to header | Coming soon | | | headers_subject | string | Subject | Coming soon | -| | headers_x_originating_ip4 | bigint | Originating IP address | Coming soon | +| | headers_x_originating_ip4 | int128 | Originating IP address | Coming soon | | | headers_first_received | string | First to receive message | Coming soon | | | headers_second_received | string | Second to receive message | Coming soon | | | last_reply | string | Last reply in message chain | Coming soon | @@ -435,9 +433,9 @@ etc.). | | key_exchange_algorithm | string | Coming soon | Coming soon | | | host_key_algorithm | string | Coming soon | Coming soon | | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | -| **DHCP** | assigned_ip4 | bigint | Coming soon | Coming soon | +| **DHCP** | assigned_ip4 | int | Coming soon | Coming soon | | | mac | string | Coming soon | Coming soon | -| | lease_time | double | Coming soon | Coming soon | +| | lease_time | int | mechanism through which a DHCP server knows when a host will stop using an IP address | 2592000 | | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | | **IRC** | user | string | Coming soon | Coming soon | | | nickname | string | Coming soon | Coming soon | @@ -485,13 +483,13 @@ The data model for user context information is as follows: | **Attribute** | **Data Type** | **Description** | **Sample Values** | |------------------|------------------------------------------------------|--------------------------------------------------------------|-------------------------------------| -| dvc_time | bigint | Timestamp from when the user context information is obtained | 1472653952 | -| created | bigint | Timestamp from when user was created | 1472653952 | -| Changed–––– | bigint | Timestamp from when user was updated | 1472653952 | -| lastlogon | bigint | Timestamp from when user last logged on | 1472653952 | +| dvc_time | long | Timestamp from when the user context information is obtained | 1472653952 | +| created | long | Timestamp from when user was created | 1472653952 | +| Changed–––– | long | Timestamp from when user was updated | 1472653952 | +| lastlogon | long | Timestamp from when user last logged on | 1472653952 | | logoncount | int | Number of times account has logged on | 232 | -| lastreset | bigint | Timestamp from when user last reset passwod | 1472653952 | -| expiration | bigint | Date/time when user expires | 1472653952 | +| lastreset | long | Timestamp from when user last reset passwod | 1472653952 | +| expiration | long | Date/time when user expires | 1472653952 | | userid | string | Unique user id | 1234 | | username | string | Username in event log/alert | jsmith | | name_first | string | First name | John | @@ -520,9 +518,9 @@ The data model for endpoint context information is as follows: | **Abbreviation** | **Data Type** | **Description** | **Sample Values** | |------------------|--------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------| -| dvc_time | bigint | Timestamp from when the endpoint context information is obtained | 1472653952 | -| ip4 | bigint | IP address of endpoint | Integer representaion of 10.1.1.1 | -| ip6 | bigint | IP address of endpoint | Integer representaion of 10.1.1.1 | +| dvc_time | long | Timestamp from when the endpoint context information is obtained | 1472653952 | +| ip4 | int | IP address of endpoint | Integer representaion of 10.1.1.1 | +| ip6 | int128 | IP address of endpoint | Integer representaion of 2001:db8::1 | | os | string | Operating system | Redhat Linux 6.5.1 | | os_version | string | Version of OS | 5.4 | | os_sp | string | Service pack | SP 2.3.4.55 | @@ -561,9 +559,9 @@ The data model for VPN context information is based on the VPN logs as follows: | **Abbreviation** | **Data Type** | **Description** | **Sample Values** | |------------------|-------------------------|----------------------------------------------------------------------------|------------------------------------------------------| -| dvc_time | bigint | Timestamp from when the endpoint context information is obtained | 1472653952 | -| ip4 | bigint | IP address of VPN box | Integer representaion of 10.1.1.1 | -| ip6 | bigint | IP address of VPN box | Integer representaion of 10.1.1.1 | +| dvc_time | long | Timestamp from when the endpoint context information is obtained | 1472653952 | +| ip4 | int | IP address of VPN box | Integer representaion of 10.1.1.1 | +| ip6 | int128 | IP address of VPN box | Integer representaion of 2001:db8::1 | | vpn_vendor | string | Vendor VPN | Cisco | | vpn_version | string | Version VPN | 3.0 | | vpn_sp | string | VPN Service pack | 5 | @@ -596,9 +594,9 @@ as follows: | registry_domain_id | string | Registry Domain ID | | | registrar_whois_server | string | Registrar WHOIS Server | | | registrar_url | string | Registrar URL | | -| update_date | bigint | UTC timestamp | | -| creation_date | bigint | Creation Date | | -| registrar_registration_expiration_date | bigint | Registrar Registration Expiration Date | | +| update_date | long | UTC timestamp | | +| creation_date | long | Creation Date | | +| registrar_registration_expiration_date | long | Registrar Registration Expiration Date | | | registrar | string | Registrar | | | registrar_iana_id | string | Registrar IANA ID | | | registrar_abuse_contact_email | string | Registrar Abuse Contact Email | | @@ -739,13 +737,13 @@ representation are detailed below. {"name":"eventtime", "type":"long", "doc":"Stop time of event""}, -{"name":"src_ip4", "type":"long", "doc":”Source IP Address"}, +{"name":"src_ip4", "type":"int", "doc":”Source IP Address"}, {"name":"src_host", "type":"string",”doc”:”Source hostname}, {"name":"src_port", "type":"int",”doc”:”Source port”}, -{"name":"dst_ip4", "type":"long", "doc"::”Destination IP Address"}, +{"name":"dst_ip4", "type":"int", "doc"::”Destination IP Address"}, {"name":"dst_host", "type":"string", "doc":”Destination IP Address"},