From 5f251554680bc3936dd6010d6cae836e05031e4b Mon Sep 17 00:00:00 2001 From: natedogs911 Date: Tue, 27 Jun 2017 07:40:15 -0700 Subject: [PATCH 1/5] added ODM branch per SPOT-182 From 8c4725ad15c71acff55f5bc71892cddfbc3bac6d Mon Sep 17 00:00:00 2001 From: Carlos Giraldo Date: Tue, 8 Aug 2017 09:24:31 +0200 Subject: [PATCH 2/5] Removing response_info_code and response_info_msg, because they are just a specific case of response_status_code --- docs/open-data-model/open-data-model.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/open-data-model/open-data-model.md b/docs/open-data-model/open-data-model.md index 768fd528..d013ba86 100644 --- a/docs/open-data-model/open-data-model.md +++ b/docs/open-data-model/open-data-model.md @@ -358,8 +358,6 @@ etc.). | | response_status_code | int | HTTP response status code | 404 | | | response_status_msg | string | HTTP response status message | “Not found” | | | response_body_len | int | Length of response body | 98 | -| | response_info_code | int | HTTP response info code | 100 | -| | response_info_msg | string | HTTP response info message | “Some string” | | | response_resp_fuids | string | Response FUIDS | | | | response_mime_types | string | Mime types | “cgi,bat,exe” | | | response_headers | MAP | Response headers | response_headers[‘SERVER’] response_headers[‘SET-COOKIE’’] response_headers[‘DATE’] | From 38c3128b76f0af051a990aeaf23d661075a77d20 Mon Sep 17 00:00:00 2001 From: Carlos Giraldo Date: Tue, 8 Aug 2017 09:28:57 +0200 Subject: [PATCH 3/5] setting IPv6 types to int128. --- docs/open-data-model/open-data-model.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/open-data-model/open-data-model.md b/docs/open-data-model/open-data-model.md index d013ba86..b5f4aa01 100644 --- a/docs/open-data-model/open-data-model.md +++ b/docs/open-data-model/open-data-model.md @@ -271,15 +271,15 @@ etc.). | | out_bytes | int | Bytes out | 9344 | | | additional_attrs | String (JSON Map) | Custom event attributes | "building":"729","cube":"401" | | | dvc_time | long | UTC timestamp from device where event/alert originates or is received | 1472653952 | -| | dvc_ip4/dvc_ip6 | long | IP address of device | Integer representaion of 10.1.1.1 | +| | dvc_ip4/dvc_ip6 | int128 | IP address of device | Integer representaion of 10.1.1.1 | | | dvc_host | string | Hostname of device | Integer representaion of 10.1.1.1 | | | dvc_type | string | Device type that generated the log | Unix, Windows, Sonicwall | | | dvc_vendor | string | Vendor | Microsoft, Fireeye, Intel Security | | | dvc_version | string | Version | 5.4 | -| | fwd_ip4/fwd_ip6 | long | Forwarded from device | Integer representation of 10.1.1.1 | +| | fwd_ip4/fwd_ip6 | int128 | Forwarded from device | Integer representation of 10.1.1.1 | | | version | string | Version | “3.2.2” | | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | -| **Network** | src_ip4/src_ip6 | bigint | Source ip address of event | Integer representation of 10.1.1.1 | +| **Network** | src_ip4/src_ip6 | int128 | Source ip address of event | Integer representation of 10.1.1.1 | | | src_host | string | Source FQDN of event | test.companyA.com | | | src_domain | string | Domain name of source address | companyA.com | | | src_port | int | Source port of event | 1025 | @@ -289,7 +289,7 @@ etc.). | | src_city | string | Source city | Shenghai | | | src_lat | int | Source latitude | | | | src_long | int | Source longitude | | -| | dst_ip4/dst_ip6 | bigint | Destination ip address of event | Integer representaion of 10.1.1.1 | +| | dst_ip4/dst_ip6 | int128 | Destination ip address of event | Integer representaion of 10.1.1.1 | | | dst_host | string | Destination FQDN of event | test.companyA.com | | | dst_domain | string | Domain name of destination address | companyA.com | | | dst_port | int | Destination port of event | 80 | @@ -520,7 +520,7 @@ The data model for endpoint context information is as follows: |------------------|--------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------| | dvc_time | bigint | Timestamp from when the endpoint context information is obtained | 1472653952 | | ip4 | bigint | IP address of endpoint | Integer representaion of 10.1.1.1 | -| ip6 | bigint | IP address of endpoint | Integer representaion of 10.1.1.1 | +| ip6 | int128 | IP address of endpoint | Integer representaion of 10.1.1.1 | | os | string | Operating system | Redhat Linux 6.5.1 | | os_version | string | Version of OS | 5.4 | | os_sp | string | Service pack | SP 2.3.4.55 | From 71406a0606ae2d0b7cb4ceaecf0d80a58aaac6b7 Mon Sep 17 00:00:00 2001 From: Carlos Giraldo Date: Tue, 8 Aug 2017 09:48:34 +0200 Subject: [PATCH 4/5] Changing ipv4 data type to int (32bits). --- docs/open-data-model/open-data-model.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/open-data-model/open-data-model.md b/docs/open-data-model/open-data-model.md index b5f4aa01..81d99a7b 100644 --- a/docs/open-data-model/open-data-model.md +++ b/docs/open-data-model/open-data-model.md @@ -373,7 +373,7 @@ etc.). | | headers_msg_id | string | Message ID | Coming soon | | | headers_in_reply_to | string | In reply to header | Coming soon | | | headers_subject | string | Subject | Coming soon | -| | headers_x_originating_ip4 | bigint | Originating IP address | Coming soon | +| | headers_x_originating_ip4 | int128 | Originating IP address | Coming soon | | | headers_first_received | string | First to receive message | Coming soon | | | headers_second_received | string | Second to receive message | Coming soon | | | last_reply | string | Last reply in message chain | Coming soon | @@ -433,7 +433,7 @@ etc.). | | key_exchange_algorithm | string | Coming soon | Coming soon | | | host_key_algorithm | string | Coming soon | Coming soon | | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | -| **DHCP** | assigned_ip4 | bigint | Coming soon | Coming soon | +| **DHCP** | assigned_ip4 | int | Coming soon | Coming soon | | | mac | string | Coming soon | Coming soon | | | lease_time | double | Coming soon | Coming soon | | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | @@ -519,8 +519,8 @@ The data model for endpoint context information is as follows: | **Abbreviation** | **Data Type** | **Description** | **Sample Values** | |------------------|--------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------| | dvc_time | bigint | Timestamp from when the endpoint context information is obtained | 1472653952 | -| ip4 | bigint | IP address of endpoint | Integer representaion of 10.1.1.1 | -| ip6 | int128 | IP address of endpoint | Integer representaion of 10.1.1.1 | +| ip4 | int | IP address of endpoint | Integer representaion of 10.1.1.1 | +| ip6 | int128 | IP address of endpoint | Integer representaion of 2001:db8::1 | | os | string | Operating system | Redhat Linux 6.5.1 | | os_version | string | Version of OS | 5.4 | | os_sp | string | Service pack | SP 2.3.4.55 | @@ -560,8 +560,8 @@ The data model for VPN context information is based on the VPN logs as follows: | **Abbreviation** | **Data Type** | **Description** | **Sample Values** | |------------------|-------------------------|----------------------------------------------------------------------------|------------------------------------------------------| | dvc_time | bigint | Timestamp from when the endpoint context information is obtained | 1472653952 | -| ip4 | bigint | IP address of VPN box | Integer representaion of 10.1.1.1 | -| ip6 | bigint | IP address of VPN box | Integer representaion of 10.1.1.1 | +| ip4 | int | IP address of VPN box | Integer representaion of 10.1.1.1 | +| ip6 | int128 | IP address of VPN box | Integer representaion of 2001:db8::1 | | vpn_vendor | string | Vendor VPN | Cisco | | vpn_version | string | Version VPN | 3.0 | | vpn_sp | string | VPN Service pack | 5 | @@ -737,13 +737,13 @@ representation are detailed below. {"name":"eventtime", "type":"long", "doc":"Stop time of event""}, -{"name":"src_ip4", "type":"long", "doc":”Source IP Address"}, +{"name":"src_ip4", "type":"int", "doc":”Source IP Address"}, {"name":"src_host", "type":"string",”doc”:”Source hostname}, {"name":"src_port", "type":"int",”doc”:”Source port”}, -{"name":"dst_ip4", "type":"long", "doc"::”Destination IP Address"}, +{"name":"dst_ip4", "type":"int", "doc"::”Destination IP Address"}, {"name":"dst_host", "type":"string", "doc":”Destination IP Address"}, From 964a9f0668d88e2b7c300b7ae0649a770e2e26fd Mon Sep 17 00:00:00 2001 From: Carlos Giraldo Date: Tue, 8 Aug 2017 09:55:41 +0200 Subject: [PATCH 5/5] Setting all timestamp fields to long (64bits). --- docs/open-data-model/open-data-model.md | 26 ++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/open-data-model/open-data-model.md b/docs/open-data-model/open-data-model.md index 81d99a7b..5000a342 100644 --- a/docs/open-data-model/open-data-model.md +++ b/docs/open-data-model/open-data-model.md @@ -307,7 +307,7 @@ etc.). | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | | **File** | file_name | string | Filename from event | output.csv | | | file_path | string | File path | /root/output.csv | -| | file_atime | bigint | Timestamp (UTC) of file access | 1472653952 | +| | file_atime | long | Timestamp (UTC) of file access | 1472653952 | | | file_acls | string | File permissions | rwx-rwx-rwx | | | file_type | string | Type of file | “.doc” | | | file_size | int | Size of file in bytes | 1244 | @@ -435,7 +435,7 @@ etc.). | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | | **DHCP** | assigned_ip4 | int | Coming soon | Coming soon | | | mac | string | Coming soon | Coming soon | -| | lease_time | double | Coming soon | Coming soon | +| | lease_time | int | mechanism through which a DHCP server knows when a host will stop using an IP address | 2592000 | | **Category** | **Attribute** | **Data Type** | **Description** | **Sample Values** | | **IRC** | user | string | Coming soon | Coming soon | | | nickname | string | Coming soon | Coming soon | @@ -483,13 +483,13 @@ The data model for user context information is as follows: | **Attribute** | **Data Type** | **Description** | **Sample Values** | |------------------|------------------------------------------------------|--------------------------------------------------------------|-------------------------------------| -| dvc_time | bigint | Timestamp from when the user context information is obtained | 1472653952 | -| created | bigint | Timestamp from when user was created | 1472653952 | -| Changed–––– | bigint | Timestamp from when user was updated | 1472653952 | -| lastlogon | bigint | Timestamp from when user last logged on | 1472653952 | +| dvc_time | long | Timestamp from when the user context information is obtained | 1472653952 | +| created | long | Timestamp from when user was created | 1472653952 | +| Changed–––– | long | Timestamp from when user was updated | 1472653952 | +| lastlogon | long | Timestamp from when user last logged on | 1472653952 | | logoncount | int | Number of times account has logged on | 232 | -| lastreset | bigint | Timestamp from when user last reset passwod | 1472653952 | -| expiration | bigint | Date/time when user expires | 1472653952 | +| lastreset | long | Timestamp from when user last reset passwod | 1472653952 | +| expiration | long | Date/time when user expires | 1472653952 | | userid | string | Unique user id | 1234 | | username | string | Username in event log/alert | jsmith | | name_first | string | First name | John | @@ -518,7 +518,7 @@ The data model for endpoint context information is as follows: | **Abbreviation** | **Data Type** | **Description** | **Sample Values** | |------------------|--------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------| -| dvc_time | bigint | Timestamp from when the endpoint context information is obtained | 1472653952 | +| dvc_time | long | Timestamp from when the endpoint context information is obtained | 1472653952 | | ip4 | int | IP address of endpoint | Integer representaion of 10.1.1.1 | | ip6 | int128 | IP address of endpoint | Integer representaion of 2001:db8::1 | | os | string | Operating system | Redhat Linux 6.5.1 | @@ -559,7 +559,7 @@ The data model for VPN context information is based on the VPN logs as follows: | **Abbreviation** | **Data Type** | **Description** | **Sample Values** | |------------------|-------------------------|----------------------------------------------------------------------------|------------------------------------------------------| -| dvc_time | bigint | Timestamp from when the endpoint context information is obtained | 1472653952 | +| dvc_time | long | Timestamp from when the endpoint context information is obtained | 1472653952 | | ip4 | int | IP address of VPN box | Integer representaion of 10.1.1.1 | | ip6 | int128 | IP address of VPN box | Integer representaion of 2001:db8::1 | | vpn_vendor | string | Vendor VPN | Cisco | @@ -594,9 +594,9 @@ as follows: | registry_domain_id | string | Registry Domain ID | | | registrar_whois_server | string | Registrar WHOIS Server | | | registrar_url | string | Registrar URL | | -| update_date | bigint | UTC timestamp | | -| creation_date | bigint | Creation Date | | -| registrar_registration_expiration_date | bigint | Registrar Registration Expiration Date | | +| update_date | long | UTC timestamp | | +| creation_date | long | Creation Date | | +| registrar_registration_expiration_date | long | Registrar Registration Expiration Date | | | registrar | string | Registrar | | | registrar_iana_id | string | Registrar IANA ID | | | registrar_abuse_contact_email | string | Registrar Abuse Contact Email | |