Metadata fields definitions

octetDeltaCount

The number of octets sent from source to destination for this connection.

integer

octetDeltaCountReverse

The number of octets sent from destination to source for this connection.

integer

packetDeltaCount

The number of packets sent from source to destination for this connection.

integer

packetDeltaCountReverse

The number of packets sent from destination to source for this connection.

integer

protocolIdentifier

The IP protocol used for the connection.

integer

protocolIdentifierName

The name of the IP protocol used for the connection.

string

ipClassOfService

IPv4 TOS field or the IPv6 Traffic Class.

integer

tcpControlBits

TCP flags seen in packets from source to destination for this connection.

integer

tcpControlBitsReverse

TCP flags seen in packets from destination to source for this connection.

integer

sourceTransportPort

Layer 4 port used by the connection source.

integer

sourceIPv4Address

The IPv4 address of the source of the connection.

ip

ingressInterface

Defined by yaf, indicates a flow’s ingress interface (not used by PX).

Integer

destinationTransportPort

Layer 4 port used by the connection destination.

integer

destinationIPv4Address

The IPv4 address of the destination of the connection.

ip

egressInterface

Defined by yaf, indicates a flow’s egress interface (not used by PX).

integer

sourceIPv6Address

The IPv6 address of the source of the connection.

string

destinationIPv6Address

The IPv6 address of the destination of the connection.

string

srcIpOs

The source operating system.

string

dstIpOs

The destination operating system.

string

vlanid

The top level VLAN ID in use.

integer

ipVersion

integer

integer

droppedOctetDeltaCount

The number of octets dropped by the capturing process from source to destination for this connection.

integer

droppedOctetDeltaCountReverse

The number of octets dropped by the capturing process from destination to source for this connection.

integer

droppedPacketDeltaCount

The number of packets dropped by the capturing process from source to destination for this connection.

integer

droppedPacketDeltaCountReverse

The number of packets dropped by the capturing process from destination to source for this connection.

integer

flowEndReason

The reason the flow ended. 1) Idle timeout 2) Active timeout 3) End of flow detected 4) Forced end 5) Lack of resources.

integer

portId

The appliance hashes packets into one of four streams. The portID is 0 to 3.

integer

flowStartNanoseconds

The start of flow timestamp.

dateTimeNanoseconds

flowEndNanoseconds

The end of flow timestamp.

dateTimeNanoseconds

fragmentFlags

IPv4 or IPv6 fragment flags seen in any packet from source to destination for this connection.

integer

fragmentFlagsReverse

IPv4 or IPv6 fragment flags seen in any packet from destination to source for this connection.

integer

padding0ctets

Padding

octets

biflowDirection

Will always be set to zero to indicate that the source and destination were determined arbitrarily (without knowing which endpoint initiated the connection).

integer

vlanId2

Second-level VLAN for the connection.

unsigned16

vlanId3

Third-level VLAN for the connection.

unsigned16

appType

Well-known port number of the protocol found for this event. For example, . http=80, tls=443, smtp=25.

integer

npulseFlowHash

The 5-tuple hash used to correlate metadata events with layer 4 events.

integer

fcapRecord

Proprietary connection record.

octets

filename

Name of the file that caused this event.

string

fileMagic

Information about the files type, determined by the file command on Linux.

string

fileState

“CLOSED”, “TRUNCATED”, “ERROR” or “UNKNOWN” indicating success or failure of reassembled file transfer. “CLOSED” indicates successful reassembly.

string

fileStored

TRUE if reassembled file was saved in PX filesystem. Typically, files are not stored by the PX.

boolean

fileSize

Size of the file that caused this event.

integer

fileMD5

MD5 hash of the file that caused this event.

string

httpUserAgent

The HTTP user agent used for the event.

string

httpGet

URI field from HTTP GET transaction.

string

httpVersion

The HTTP version used for the event.

string

httpReferer

HTTP referer field from an HTTP transaction.

string

httpHost

Hostname portion of an HTTP URL.

string

httpAcceptLanguage

The value of the Accept-Language header for the HTTP event.

string

httpContentType

The value of the Content-Type header for the HTTP event.

string

httpResponse

The response code for the HTTP event.

string

httpURL

Full HTTP URL

string

httpCookie

Cookie contained in an HTTP transaction.

string

httpSetCookie

“Set” cookie contained in an HTTP transaction.

string

httpX-Forwarded-For

The value of the X-Forwarded-For header for the HTTP event.

string

httpAcceptEncoding

The value of the Accept-Encoding header for the HTTP event.

string

httpUsername

Username used for basic authentication for the HTTP event.

string

httpPassword

Password used for basic authentication for the HTTP event.

string

httpMethod

The HTTP method used in the event.

string

dnslsResponse

Boolean indicating a DNS query (0) or a DNS response (1).

Boolean

dnsQRType

Two-octet type field from DNS transaction.

string

dnsQName

Query name field from DNS transaction.

string

dnsTTL

TTL field contained within a DNS answer.

integer

dnsID

ID of an DNS transaction. Used to correlate queries and answers.

integer

dnsIPv4Address

IPv4 address returned in a DNS response A record.

ip

dnsIPv6Address

IPv6 address returned in a DNS response AAAA record.

ip

dnsFlags

The bitmask of all the flags in the DNS header.

integer

ftpUser

The username used for the FTP transaction

string

ftpPassword

The password used for the FTP transaction

string

ftpType

Either “active” or “passive”, indicating that a file transfer occurred using either the active or passive method.

string

ftpResponseCode

The response code to the FTP command in this transaction.

string

ftpResponseData

The response to the FTP command in this transaction.

string

ftpCommand

The FTP command issued.

string

ftpCommandData

The data sent along with the FTP command.

string

mailFrom

The From field from an SMTP, POP3 or IMAP transported email.

string

mailTo

The To fields from an SMTP, POP3 or IMAP transported email.

string

mailContentType

MIME type of an SMTP, POP3, or IMAP transported email.

string

mailSubject

Subject line from an SMTP, POP3, or IMAP transported email.

string

smtpSize

Size of a transported email message in bytes.

string

tlsVersion

TLS version field from TLS exchange.

string

tlsSubject

“Subject” string contained in TLS certificate

string

tlsIssuerDN

Issuer Domain Name contained in TLS certificate.

string

tlsFingerprint

Fingerprint (trusted hash) from TLS certificate.

string