Events

Events are high level representation of a transaction on the network. Events must have the following attributes to be considered an event

  • A timestamp

  • Source/Destination IP

  • Source/Destination Port

The Event

The Event class can represent almost any kind of transaction stored within DynamiteNSM.

As a matter of fact all network based events can be derived from this class.

class dynamite_sdk.objects.events.Event(raw_event_document: dict)[source]

Super generic Event; any Zeek/Flow event can be normalized into this object

destination_ip_address = None

The recipient IP in the event

destination_port = None

The recipient port in the event

elasticsearch_index = None

The ElasticSearch index where the event was found

event_time = None

The UTC-0 time at which the event occurred

event_type = None

The type of event (Either “flow” or a Zeek log prefix)

forwarder_type = None

Either “zeek” or “netflow”

node_hostname = None

The hostname of the originating host (collector/agent hostname)

node_ip_address = None

The ip_address of the originating host (collector/agent IP)

originating_agent_tag = None

The friendly name of the agent (Zeek events only)

source_ip_address = None

The sender IP in the event

source_port = None

The sender port in the event

to_dataframe() → pandas.core.frame.DataFrame[source]
Returns

DataFrame containng the field headings and single of of values

uid = None

The unique id for the Zeek connection

Connection Event

The Connection Event class is used to normalize two kinds of event sources.

  • The first are events derived from the Zeek conn.log.

  • The second are events derived from NetFlow devices.

class dynamite_sdk.objects.events.ConnectionEvent(raw_event_document: dict)[source]

Represents a log generated either by a NetFlow forwarder OR Zeek conn.log

https://docs.zeek.org/en/stable/scripts/base/protocols/conn/main.zeek.html#type-Conn::Info

client_autonomous_system = None

The name corresponding to an ASN for the client system

client_city = None

The city for the client in the conversation

client_country = None

The country for the client in the conversation

client_country_code = None

The country code for the client in the conversation

client_geo_location = None

The geographical coordinates for the client in the conversation

client_hostname = None

The hostname of the client in the conversation

client_ip_address = None

The IP address of the client in the conversation

connection_state = None

The state of the connection

destination_autonomous_system = None

The name corresponding to an ASN for the destination system

destination_bytes = None

The number of bytes received

destination_city = None

The city for the destination in the conversation

destination_country = None

The country for the destination in the conversation

destination_country_code = None

The country code for the destination in the conversation

destination_geo_location = None

The geographical coordinates for the dst in the conversation

destination_mac_address = None

The Layer2 MAC address of the destination device

destination_packets = None

The number of packets received

duration = None

The number of seconds for a given connection

history = None

The state history of connections as a string of letters

ip_protocol = None

Layer3 transport protocol TCP/UDP/ICMP

originated_locally = None

True, if the connection originated from inside the network

server_autonomous_system = None

The name corresponding to an ASN for the server system

server_city = None

The city for the server in the conversation

server_country = None

The country for the server in the conversation

server_country_code = None

The country code for the server in the conversation

server_geo_location = None

The geographical coordinates for the server in the conversation

server_hostname = None

The hostname of the server in the conversation

server_ip_address = None

The IP address of the server in the conversation

service = None

An identification of an application protocol being sent

service_port = None

A recognized service port (non-ephemeral)

source_autonomous_system = None

The name corresponding to an ASN for the source system

source_bytes = None

The number of bytes sent

source_city = None

The city for the source in the conversation

source_country = None

The country for the source in the conversation

source_country_code = None

The country code for the source in the conversation

source_geo_location = None

The geographical coordinates for the source in the conversation

source_mac_address = None

The Layer2 MAC address of the source device

source_packets = None

The number of packets sent

total_bytes = None

Total bytes both sent and received

total_packets = None

Total packets sent

uid = None

A unique identifier for the connection

Protocol Events

The Dynamite SDK also supports a handful of protocol based events. These are derived from Zeek protocol logs.

Additional log support is being added everyday!

DHCP Event

class dynamite_sdk.objects.events.DhcpEvent(raw_event_document: dict)[source]

Represents a Zeek dhcp.log

https://docs.zeek.org/en/stable/scripts/base/protocols/dhcp/main.zeek.html#type-DHCP::Info

assigned_ip_address = None

IP address assigned by the server

client_fqdn = None

FQDN given by client in Client FQDN

client_ip_address = None

The IP address of the client requesting the DHCP lease

client_message = None

Message typically accompanied with a DHCP_DECLINE

client_port = None

Client port # seen at time of server handing out IP (expected as 68/udp)

domain = None

Domain given by the server

duration = None

The time from the first message to the last

hostname = None

Name given by client in Hostname

lease_time = None

IP address lease interval (seconds)

mac_address = None

Client’s hardware address

message_types = None

The DHCP message types seen by this DHCP transaction

requested_ip_address = None

IP address requested by the client

server_ip_address = None

The IP address of the server involved in actually handing out the lease

server_message = None

Message typically accompanied with a DHCP_NAK

server_port = None

Server port # seen at time of server handing out IP (expected as 67/udp).

uids = None

Series of unique ids of the connections over which DHCP is occurring.

DNS Event

class dynamite_sdk.objects.events.DnsEvent(raw_event_document: dict)[source]

Represents a Zeek dns.log

https://docs.zeek.org/en/stable/scripts/base/protocols/dns/main.zeek.html#type-DNS::Info

answers = None

A set of resource descriptions in the query answer

authoritative_answer = None

True if the responding server is an authority for the domain name

message_truncated = None

True if the message was truncated

query = None

The domain name that is the subject of the DNS query

query_class = None

The QCLASS value specifying the class of the query

query_class_name = None

A descriptive name for the class of the query

query_type = None

A QTYPE value specifying the type of the query

query_type_name = None

A descriptive name for the type of the query

recursion_available = None

True if server supports recursive queries

recursion_desired = None

True if the client wants recursive service for this query

rejected = None

True if the DNS query was rejected by the server

response_code = None

The response code value in DNS response messages

response_code_name = None

A descriptive name for the response code value

round_trip_time = None

The delay between when the request was seen until the answer started

transaction_id = None

A 16-bit identifier assigned by the program that generated the DNS query

HTTP Event

class dynamite_sdk.objects.events.HttpEvent(raw_event_document: dict)[source]

Represents a Zeek http.log

https://docs.zeek.org/en/stable/scripts/base/protocols/http/main.zeek.html#type-HTTP::Info

client_header_names = None

The list of HTTP header names sent by the client

cookie_variables = None

Variable names extracted from all cookies

host = None

Value of the HOST header

info_code = None

Last seen 1xx informational reply code returned by the server

info_message = None

Last seen 1xx informational reply message returned by the server

method = None

Verb used in the HTTP request (GET, POST, HEAD, etc.)

origin = None

Value of the Origin header from the client

originating_filenames = None

An ordered list of filenames from the client

originating_fuids = None

An ordered list of file unique IDs from the client

originating_mime_types = None

An ordered list of mime types from the client

password = None

Password if basic-auth is performed for the request

proxied = None

All of the headers that may indicate if the request was proxied

recipient_filenames = None

An ordered list of filenames from the server

recipient_fuids = None

An ordered list of file unique IDs from the server

recipient_mime_types = None

An ordered list of mime types from the server

referrer = None

Value of the “referer” header

request_body_length = None

Actual uncompressed content size of the data transferred from the client

response_body_length = None

Actual uncompressed content size of the data transferred from the server

server_header_names = None

The list of HTTP header names sent by the server

status_code = None

Status code returned by the server

status_message = None

Status message returned by the server

transaction_depth = None

The depth into the connection of this request/response transaction

uri = None

URI used in the request

uri_variables = None

Variable names from the URI

user_agent = None

Value of the User-Agent header from the client

username = None

Username if basic-auth is performed for the request

version = None

Value of the version portion of the request

SIP Event

class dynamite_sdk.objects.events.SipEvent(raw_event_document: dict)[source]

Represents a Zeek sip.log

https://docs.zeek.org/en/stable/scripts/base/protocols/sip/main.zeek.html#type-SIP::Info

c_sequence = None

Contents of the CSeq: header from the client

call_id = None

Contents of the Call-ID: header from the client

content_type = None

Contents of the Content-Type: header from the server

method = None

Verb used in the SIP request (INVITE, REGISTER etc)

reply_to = None

Contents of the Reply-To: header

request_body_length = None

Contents of the Content-Length: header from the client

request_from = None

Contents of the request From: header

request_path = None

The client message transmission path, as extracted from the headers

request_to = None

Contents of the To: header

response_body_length = None

Contents of the Content-Length: header from the server

response_from = None

Contents of the response From: header

response_path = None

The server message transmission path, as extracted from the headers

response_to = None

Contents of the response To: header

status_code = None

Status code returned by the server

status_message = None

Status message returned by the server

subject = None

Contents of the Subject: header from the client

transaction_depth = None

The depth into the connection of this request/response transaction

uri = None

URI used in the request

user_agent = None

Contents of the User-Agent: header from the client

warning = None

Contents of the Warning: header

SNMP Event

class dynamite_sdk.objects.events.SnmpEvent(raw_event_document: dict)[source]

Represents a Zeek snmp.log

https://docs.zeek.org/en/stable/scripts/base/protocols/snmp/main.zeek.html#type-SNMP::Info

community_string = None

The community string of the first SNMP packet associated with the session

display_string = None

The system description of the SNMP responder endpoint

duration = None

The time between first/last packet sent in SNMP session

get_bulk_requests = None

The number of variable bindings in GetBulkRequest PDUs seen

get_requests = None

The number of variable bindings in GetRequest/GetNextRequest PDUs seen

get_responses = None

The number of variable bindings in GetResponse/Response PDUs

set_requests = None

The number of variable bindings in SetRequest PDUs seen for the session

up_since = None

The time at which the SNMP responder endpoint claims it’s been up since

version = None

The version of SNMP being used

SSH Event

class dynamite_sdk.objects.events.SshEvent(raw_event_document: dict)[source]

Represents a Zeek ssh.log

https://docs.zeek.org/en/stable/scripts/base/protocols/ssh/main.zeek.html#type-SSH::Info

authentication_attempts = None

The number of authentication attempts observed

authentication_success = None

True if successfully authenticated

cipher_algorithm = None

The encryption algorithm in use

client_version_string = None

The client’s version string

compression_algorithm = None

The compression algorithm in use

direction = None

Direction of the connection (Outbound/Inbound)

host_key = None

The server’s key fingerprint

host_key_algorithm = None

The server host key’s algorithm

key_algorithm = None

The key exchange algorithm in use

mac_algorithm = None

The signing (MAC) algorithm in use

server_version_string = None

The server’s version string

version = None

SSH major version (1 or 2)