Intervals¶
Intervals represent an aggregation of events between a given start and end period.
DynamiteNSM makes direct use of https://github.com/pmphry/netbase Zeek scripts to perform these aggregations on the fly.
The Interval¶
-
class
dynamite_sdk.objects.baselines.Interval(raw_interval_document: dict)[source]¶ -
address= None¶ The monitored IP address
-
connections_count= None¶ Total count of connections this IP was involved in
-
dns_client_connection_count= None¶ Count of dns connections as client
-
dns_producer_consumer_ratio_average= None¶ Avg pcr for dns connections
-
dns_producer_consumer_ratio_max= None¶ Max pcr for dns connections
-
dns_producer_consumer_ratio_min= None¶ Min pcr for dns connections
-
dns_server_connection_count= None¶ Count of dns connections as server
-
elasticsearch_index= None¶ The ElasticSearch index where the interval was found
-
end_time= None¶ End time of the observation
-
event_type= None¶ Always “netbase”
-
external_client_count= None¶ Count fo unique external clients communicating with this IP
-
external_clients= None¶ Unique external clients communicating with this IP
-
external_host_count= None¶ Count of unique hosts communicated with externally
-
external_hosts= None¶ Unique IP’s communicated with externally
-
external_originating_bytes_received= None¶ Sum of bytes received as originator in external conns
-
external_originating_bytes_sent= None¶ Sum of bytes sent as originator in external conns
-
external_originating_packets_received= None¶ Count of packets received as originator in outbound conns
-
external_originating_packets_sent= None¶ Count of packets sent as originator in outbound conns
-
external_port_counts= None¶ Count of unique ports communicated with externally
-
external_ports= None¶ Unique ports communicated with externally
-
forwarder_type= None¶ Always “zeek”
-
http_client_connection_count= None¶ Count of http connections as client
-
http_producer_consumer_ratio_average= None¶ Avg pcr for http connections
-
http_producer_consumer_ratio_max= None¶ Max pcr for http connections
-
http_producer_consumer_ratio_min= None¶ Min pcr for http connections
-
http_server_connection_count= None¶ Count of http connections as server
-
internal_client_count= None¶ Count of unique internal clients communicating with this IP
-
internal_clients= None¶ Unique internal clients communicating with this IP
-
internal_host_count= None¶ Count of unique hosts communicated with internally
-
internal_hosts= None¶ Unique hosts communicated with internally
-
internal_originated_connections= None¶ Count of internal connections by this host
-
internal_originated_rejected_connections= None¶ Count of internal conns originated by this host that were rejected
-
internal_originating_bytes_received= None¶ Sum of bytes received as originator in internal conns
-
internal_originating_bytes_sent= None¶ Sum of bytes sent as originator in internal conns
-
internal_originating_packets_received= None¶ Count of packets recevied in internal conns
-
internal_originating_packets_sent= None¶ Count of packets sent in internal conns
-
internal_port_count= None¶ Count of unique ports communicated with internally
-
internal_ports= None¶ Unique ports communicated with internally
-
internal_received_connections= None¶ Count of internal conns this IP responded to
-
internal_to_highport_count= None¶ Count of internal conns to ports >= 1024
-
internal_to_lowport_count= None¶ Count of internal conns to ports < 1024
-
internal_to_service_count= None¶ Count of internal conns to recognized server
-
interval_size= None¶ The time between start_time and end_time
-
node_hostname= None¶ The hostname of the originating host (collector/agent hostname)
-
node_ip_address= None¶ The ip_address of the originating host (collector/agent IP)
-
originating_agent_tag= None¶ The friendly name of the agent
-
originating_connection_count= None¶ Total count of external conns originated by this IP
-
originating_to_highport_count= None¶ Count of outbound conns originated by this IP to ports >= 1024
-
originating_to_lowport_count= None¶ Count of outbound conns originated by this IP to ports < 1024
-
originating_to_service= None¶ Count of outbound conns originated by this IP to a recognized service
-
rdp_client_connection_count= None¶ Count of rdp connections as client
-
rdp_producer_consumer_ratio_average= None¶ Avg pcr for rdp connections
-
rdp_producer_consumer_ratio_max= None¶ Max pcr for rdp connections
-
rdp_producer_consumer_ratio_min= None¶ Min pcr for rdp connections
-
rdp_server_connection_count= None¶ Count of rdp connections as server
-
rejected_originating_connection_count= None¶ Count of outbound conns originated by this IP that were rejected
-
smb_client_connection_count= None¶ Count of SMB connections as a client
-
smb_producer_consumer_ratio_average= None¶ Avg pcr for smb connections
-
smb_producer_consumer_ratio_max= None¶ Max pcr for smb connections
-
smb_producer_consumer_ratio_min= None¶ Min pcr for smb connections
-
smb_server_connection_count= None¶ Count of SMB connections as a server
-
ssl_client_connection_count= None¶ Count of ssl connections as client
-
ssl_producer_consumer_ratio_average= None¶ Avg pcr for ssl connections
-
ssl_producer_consumer_ratio_max= None¶ Max pcr for ssl connections
-
ssl_producer_consumer_ratio_min= None¶ Min pcr for ssl connections
-
ssl_server_connection_count= None¶ Count of ssl connections as server
-
start_time= None¶ Start time of the observation
-
successful_originating_connection_count= None¶ Count of outbound conns originated by this IP that were successful
-