Intervals

Intervals represent an aggregation of events between a given start and end period.

DynamiteNSM makes direct use of https://github.com/pmphry/netbase Zeek scripts to perform these aggregations on the fly.

The Interval

class dynamite_sdk.objects.baselines.Interval(raw_interval_document: dict)[source]
address = None

The monitored IP address

connections_count = None

Total count of connections this IP was involved in

dns_client_connection_count = None

Count of dns connections as client

dns_producer_consumer_ratio_average = None

Avg pcr for dns connections

dns_producer_consumer_ratio_max = None

Max pcr for dns connections

dns_producer_consumer_ratio_min = None

Min pcr for dns connections

dns_server_connection_count = None

Count of dns connections as server

elasticsearch_index = None

The ElasticSearch index where the interval was found

end_time = None

End time of the observation

event_type = None

Always “netbase”

external_client_count = None

Count fo unique external clients communicating with this IP

external_clients = None

Unique external clients communicating with this IP

external_host_count = None

Count of unique hosts communicated with externally

external_hosts = None

Unique IP’s communicated with externally

external_originating_bytes_received = None

Sum of bytes received as originator in external conns

external_originating_bytes_sent = None

Sum of bytes sent as originator in external conns

external_originating_packets_received = None

Count of packets received as originator in outbound conns

external_originating_packets_sent = None

Count of packets sent as originator in outbound conns

external_port_counts = None

Count of unique ports communicated with externally

external_ports = None

Unique ports communicated with externally

forwarder_type = None

Always “zeek”

http_client_connection_count = None

Count of http connections as client

http_producer_consumer_ratio_average = None

Avg pcr for http connections

http_producer_consumer_ratio_max = None

Max pcr for http connections

http_producer_consumer_ratio_min = None

Min pcr for http connections

http_server_connection_count = None

Count of http connections as server

internal_client_count = None

Count of unique internal clients communicating with this IP

internal_clients = None

Unique internal clients communicating with this IP

internal_host_count = None

Count of unique hosts communicated with internally

internal_hosts = None

Unique hosts communicated with internally

internal_originated_connections = None

Count of internal connections by this host

internal_originated_rejected_connections = None

Count of internal conns originated by this host that were rejected

internal_originating_bytes_received = None

Sum of bytes received as originator in internal conns

internal_originating_bytes_sent = None

Sum of bytes sent as originator in internal conns

internal_originating_packets_received = None

Count of packets recevied in internal conns

internal_originating_packets_sent = None

Count of packets sent in internal conns

internal_port_count = None

Count of unique ports communicated with internally

internal_ports = None

Unique ports communicated with internally

internal_received_connections = None

Count of internal conns this IP responded to

internal_to_highport_count = None

Count of internal conns to ports >= 1024

internal_to_lowport_count = None

Count of internal conns to ports < 1024

internal_to_service_count = None

Count of internal conns to recognized server

interval_size = None

The time between start_time and end_time

node_hostname = None

The hostname of the originating host (collector/agent hostname)

node_ip_address = None

The ip_address of the originating host (collector/agent IP)

originating_agent_tag = None

The friendly name of the agent

originating_connection_count = None

Total count of external conns originated by this IP

originating_to_highport_count = None

Count of outbound conns originated by this IP to ports >= 1024

originating_to_lowport_count = None

Count of outbound conns originated by this IP to ports < 1024

originating_to_service = None

Count of outbound conns originated by this IP to a recognized service

rdp_client_connection_count = None

Count of rdp connections as client

rdp_producer_consumer_ratio_average = None

Avg pcr for rdp connections

rdp_producer_consumer_ratio_max = None

Max pcr for rdp connections

rdp_producer_consumer_ratio_min = None

Min pcr for rdp connections

rdp_server_connection_count = None

Count of rdp connections as server

rejected_originating_connection_count = None

Count of outbound conns originated by this IP that were rejected

smb_client_connection_count = None

Count of SMB connections as a client

smb_producer_consumer_ratio_average = None

Avg pcr for smb connections

smb_producer_consumer_ratio_max = None

Max pcr for smb connections

smb_producer_consumer_ratio_min = None

Min pcr for smb connections

smb_server_connection_count = None

Count of SMB connections as a server

ssl_client_connection_count = None

Count of ssl connections as client

ssl_producer_consumer_ratio_average = None

Avg pcr for ssl connections

ssl_producer_consumer_ratio_max = None

Max pcr for ssl connections

ssl_producer_consumer_ratio_min = None

Min pcr for ssl connections

ssl_server_connection_count = None

Count of ssl connections as server

start_time = None

Start time of the observation

successful_originating_connection_count = None

Count of outbound conns originated by this IP that were successful

to_dataframe() → pandas.core.frame.DataFrame[source]
Returns

DataFrame containng the field headings and single of of values