Events¶
Events are high level representation of a transaction on the network. Events must have the following attributes to be considered an event
A timestamp
Source/Destination IP
Source/Destination Port
The Event¶
The Event class can represent almost any kind of transaction stored within DynamiteNSM.
As a matter of fact all network based events can be derived from this class.
-
class
dynamite_sdk.objects.events.Event(raw_event_document: dict)[source]¶ Super generic Event; any Zeek/Flow event can be normalized into this object
-
destination_ip_address= None¶ The recipient IP in the event
-
destination_port= None¶ The recipient port in the event
-
elasticsearch_index= None¶ The ElasticSearch index where the event was found
-
event_time= None¶ The UTC-0 time at which the event occurred
-
event_type= None¶ The type of event (Either “flow” or a Zeek log prefix)
-
forwarder_type= None¶ Either “zeek” or “netflow”
-
node_hostname= None¶ The hostname of the originating host (collector/agent hostname)
-
node_ip_address= None¶ The ip_address of the originating host (collector/agent IP)
-
originating_agent_tag= None¶ The friendly name of the agent (Zeek events only)
-
source_ip_address= None¶ The sender IP in the event
-
source_port= None¶ The sender port in the event
-
to_dataframe() → pandas.core.frame.DataFrame[source]¶ - Returns
DataFrame containng the field headings and single of of values
-
uid= None¶ The unique id for the Zeek connection
-
Connection Event¶
The Connection Event class is used to normalize two kinds of event sources.
The first are events derived from the Zeek conn.log.
The second are events derived from NetFlow devices.
-
class
dynamite_sdk.objects.events.ConnectionEvent(raw_event_document: dict)[source]¶ Represents a log generated either by a NetFlow forwarder OR Zeek conn.log
https://docs.zeek.org/en/stable/scripts/base/protocols/conn/main.zeek.html#type-Conn::Info
-
client_autonomous_system= None¶ The name corresponding to an ASN for the client system
-
client_city= None¶ The city for the client in the conversation
-
client_country= None¶ The country for the client in the conversation
-
client_country_code= None¶ The country code for the client in the conversation
-
client_geo_location= None¶ The geographical coordinates for the client in the conversation
-
client_hostname= None¶ The hostname of the client in the conversation
-
client_ip_address= None¶ The IP address of the client in the conversation
-
connection_state= None¶ The state of the connection
-
destination_autonomous_system= None¶ The name corresponding to an ASN for the destination system
-
destination_bytes= None¶ The number of bytes received
-
destination_city= None¶ The city for the destination in the conversation
-
destination_country= None¶ The country for the destination in the conversation
-
destination_country_code= None¶ The country code for the destination in the conversation
-
destination_geo_location= None¶ The geographical coordinates for the dst in the conversation
-
destination_mac_address= None¶ The Layer2 MAC address of the destination device
-
destination_packets= None¶ The number of packets received
-
duration= None¶ The number of seconds for a given connection
-
history= None¶ The state history of connections as a string of letters
-
ip_protocol= None¶ Layer3 transport protocol TCP/UDP/ICMP
-
originated_locally= None¶ True, if the connection originated from inside the network
-
server_autonomous_system= None¶ The name corresponding to an ASN for the server system
-
server_city= None¶ The city for the server in the conversation
-
server_country= None¶ The country for the server in the conversation
-
server_country_code= None¶ The country code for the server in the conversation
-
server_geo_location= None¶ The geographical coordinates for the server in the conversation
-
server_hostname= None¶ The hostname of the server in the conversation
-
server_ip_address= None¶ The IP address of the server in the conversation
-
service= None¶ An identification of an application protocol being sent
-
service_port= None¶ A recognized service port (non-ephemeral)
-
source_autonomous_system= None¶ The name corresponding to an ASN for the source system
-
source_bytes= None¶ The number of bytes sent
-
source_city= None¶ The city for the source in the conversation
-
source_country= None¶ The country for the source in the conversation
-
source_country_code= None¶ The country code for the source in the conversation
-
source_geo_location= None¶ The geographical coordinates for the source in the conversation
-
source_mac_address= None¶ The Layer2 MAC address of the source device
-
source_packets= None¶ The number of packets sent
-
total_bytes= None¶ Total bytes both sent and received
-
total_packets= None¶ Total packets sent
-
uid= None¶ A unique identifier for the connection
-
Protocol Events¶
The Dynamite SDK also supports a handful of protocol based events. These are derived from Zeek protocol logs.
Additional log support is being added everyday!
DHCP Event¶
-
class
dynamite_sdk.objects.events.DhcpEvent(raw_event_document: dict)[source]¶ Represents a Zeek dhcp.log
https://docs.zeek.org/en/stable/scripts/base/protocols/dhcp/main.zeek.html#type-DHCP::Info
-
assigned_ip_address= None¶ IP address assigned by the server
-
client_fqdn= None¶ FQDN given by client in Client FQDN
-
client_ip_address= None¶ The IP address of the client requesting the DHCP lease
-
client_message= None¶ Message typically accompanied with a DHCP_DECLINE
-
client_port= None¶ Client port # seen at time of server handing out IP (expected as 68/udp)
-
domain= None¶ Domain given by the server
-
duration= None¶ The time from the first message to the last
-
hostname= None¶ Name given by client in Hostname
-
lease_time= None¶ IP address lease interval (seconds)
-
mac_address= None¶ Client’s hardware address
-
message_types= None¶ The DHCP message types seen by this DHCP transaction
-
requested_ip_address= None¶ IP address requested by the client
-
server_ip_address= None¶ The IP address of the server involved in actually handing out the lease
-
server_message= None¶ Message typically accompanied with a DHCP_NAK
-
server_port= None¶ Server port # seen at time of server handing out IP (expected as 67/udp).
-
uids= None¶ Series of unique ids of the connections over which DHCP is occurring.
-
DNS Event¶
-
class
dynamite_sdk.objects.events.DnsEvent(raw_event_document: dict)[source]¶ Represents a Zeek dns.log
https://docs.zeek.org/en/stable/scripts/base/protocols/dns/main.zeek.html#type-DNS::Info
-
answers= None¶ A set of resource descriptions in the query answer
True if the responding server is an authority for the domain name
-
message_truncated= None¶ True if the message was truncated
-
query= None¶ The domain name that is the subject of the DNS query
-
query_class= None¶ The QCLASS value specifying the class of the query
-
query_class_name= None¶ A descriptive name for the class of the query
-
query_type= None¶ A QTYPE value specifying the type of the query
-
query_type_name= None¶ A descriptive name for the type of the query
-
recursion_available= None¶ True if server supports recursive queries
-
recursion_desired= None¶ True if the client wants recursive service for this query
-
rejected= None¶ True if the DNS query was rejected by the server
-
response_code= None¶ The response code value in DNS response messages
-
response_code_name= None¶ A descriptive name for the response code value
-
round_trip_time= None¶ The delay between when the request was seen until the answer started
-
transaction_id= None¶ A 16-bit identifier assigned by the program that generated the DNS query
-
HTTP Event¶
-
class
dynamite_sdk.objects.events.HttpEvent(raw_event_document: dict)[source]¶ Represents a Zeek http.log
https://docs.zeek.org/en/stable/scripts/base/protocols/http/main.zeek.html#type-HTTP::Info
-
client_header_names= None¶ The list of HTTP header names sent by the client
Variable names extracted from all cookies
-
host= None¶ Value of the HOST header
-
info_code= None¶ Last seen 1xx informational reply code returned by the server
-
info_message= None¶ Last seen 1xx informational reply message returned by the server
-
method= None¶ Verb used in the HTTP request (GET, POST, HEAD, etc.)
-
origin= None¶ Value of the Origin header from the client
-
originating_filenames= None¶ An ordered list of filenames from the client
-
originating_fuids= None¶ An ordered list of file unique IDs from the client
-
originating_mime_types= None¶ An ordered list of mime types from the client
-
password= None¶ Password if basic-auth is performed for the request
-
proxied= None¶ All of the headers that may indicate if the request was proxied
-
recipient_filenames= None¶ An ordered list of filenames from the server
-
recipient_fuids= None¶ An ordered list of file unique IDs from the server
-
recipient_mime_types= None¶ An ordered list of mime types from the server
-
referrer= None¶ Value of the “referer” header
-
request_body_length= None¶ Actual uncompressed content size of the data transferred from the client
-
response_body_length= None¶ Actual uncompressed content size of the data transferred from the server
-
server_header_names= None¶ The list of HTTP header names sent by the server
-
status_code= None¶ Status code returned by the server
-
status_message= None¶ Status message returned by the server
-
transaction_depth= None¶ The depth into the connection of this request/response transaction
-
uri= None¶ URI used in the request
-
uri_variables= None¶ Variable names from the URI
-
user_agent= None¶ Value of the User-Agent header from the client
-
username= None¶ Username if basic-auth is performed for the request
-
version= None¶ Value of the version portion of the request
-
SIP Event¶
-
class
dynamite_sdk.objects.events.SipEvent(raw_event_document: dict)[source]¶ Represents a Zeek sip.log
https://docs.zeek.org/en/stable/scripts/base/protocols/sip/main.zeek.html#type-SIP::Info
-
c_sequence= None¶ Contents of the CSeq: header from the client
-
call_id= None¶ Contents of the Call-ID: header from the client
-
content_type= None¶ Contents of the Content-Type: header from the server
-
method= None¶ Verb used in the SIP request (INVITE, REGISTER etc)
-
reply_to= None¶ Contents of the Reply-To: header
-
request_body_length= None¶ Contents of the Content-Length: header from the client
-
request_from= None¶ Contents of the request From: header
-
request_path= None¶ The client message transmission path, as extracted from the headers
-
request_to= None¶ Contents of the To: header
-
response_body_length= None¶ Contents of the Content-Length: header from the server
-
response_from= None¶ Contents of the response From: header
-
response_path= None¶ The server message transmission path, as extracted from the headers
-
response_to= None¶ Contents of the response To: header
-
status_code= None¶ Status code returned by the server
-
status_message= None¶ Status message returned by the server
-
subject= None¶ Contents of the Subject: header from the client
-
transaction_depth= None¶ The depth into the connection of this request/response transaction
-
uri= None¶ URI used in the request
-
user_agent= None¶ Contents of the User-Agent: header from the client
-
warning= None¶ Contents of the Warning: header
-
SNMP Event¶
-
class
dynamite_sdk.objects.events.SnmpEvent(raw_event_document: dict)[source]¶ Represents a Zeek snmp.log
https://docs.zeek.org/en/stable/scripts/base/protocols/snmp/main.zeek.html#type-SNMP::Info
-
community_string= None¶ The community string of the first SNMP packet associated with the session
-
display_string= None¶ The system description of the SNMP responder endpoint
-
duration= None¶ The time between first/last packet sent in SNMP session
-
get_bulk_requests= None¶ The number of variable bindings in GetBulkRequest PDUs seen
-
get_requests= None¶ The number of variable bindings in GetRequest/GetNextRequest PDUs seen
-
get_responses= None¶ The number of variable bindings in GetResponse/Response PDUs
-
set_requests= None¶ The number of variable bindings in SetRequest PDUs seen for the session
-
up_since= None¶ The time at which the SNMP responder endpoint claims it’s been up since
-
version= None¶ The version of SNMP being used
-
SSH Event¶
-
class
dynamite_sdk.objects.events.SshEvent(raw_event_document: dict)[source]¶ Represents a Zeek ssh.log
https://docs.zeek.org/en/stable/scripts/base/protocols/ssh/main.zeek.html#type-SSH::Info
-
authentication_attempts= None¶ The number of authentication attempts observed
-
authentication_success= None¶ True if successfully authenticated
-
cipher_algorithm= None¶ The encryption algorithm in use
-
client_version_string= None¶ The client’s version string
-
compression_algorithm= None¶ The compression algorithm in use
-
direction= None¶ Direction of the connection (Outbound/Inbound)
-
host_key= None¶ The server’s key fingerprint
-
host_key_algorithm= None¶ The server host key’s algorithm
-
key_algorithm= None¶ The key exchange algorithm in use
-
mac_algorithm= None¶ The signing (MAC) algorithm in use
-
server_version_string= None¶ The server’s version string
-
version= None¶ SSH major version (1 or 2)
-