| Table of Contents | ||||
|---|---|---|---|---|
|
Introduction
The tags beginning with threatintel.bandura identify events generated by ThreatBlockr (formerly Bandura ThreatBlockr) belonging to ThreatBlockr.
Valid tags and data tables
The full tag must have 4 levels. The first two are fixed asthreatintel.bandura. The third level identifies the type of events sent, and the fourth level indicates the event subtypesubtypes.
...
Technology
...
Brand
...
Type
...
Subtype
...
threatintel
...
bandura
...
dnslog
dnsresplog
packetlog
These are the valid tags and corresponding data tables that will receive the parsers' data:
Product / Service | Tags | Data |
|---|
tables | ||
|---|---|---|
ThreatBlockr (formerly Bandura ThreatBlockr) |
|
|
|
| |
|
|
For more information, read more About Devo tags.
Table structure
These are the fields displayed in these tables:
threatintel.bandura.threatblockr.dnslog
threatintel.bandura.threatblockr.dnsresplog
threatintel.bandura.threatblockr.packetlog
threatintel.bandura.threatblockr.dnslog
Field | Type | Extra fields |
|---|---|---|
eventdate |
| |
hostname |
| |
action |
| |
proto |
| |
reason |
| |
src |
| |
dst |
| |
src_port |
| |
dst_port |
| |
domain |
| |
dl_active |
| |
dl_inactive |
| |
al_active |
| |
al_inactive |
| |
hostchain |
| ✓ |
tag |
| ✓ |
rawMessage |
| ✓ |
threatintel.bandura.threatblockr.dnsresplog
Field | Type | Extra fields |
|---|---|---|
eventdate |
| |
hostname |
| |
action |
| |
proto |
| |
reason |
| |
src |
| |
dst |
| |
src_port |
| |
dst_port |
| |
query_type |
| |
query_name |
| |
answer_type |
| |
answer_name |
| |
answer_value |
| |
hostchain |
| ✓ |
tag |
| ✓ |
rawMessage |
| ✓ |
threatintel.bandura.threatblockr.packetlog
Field | Type | Extra fields |
|---|---|---|
eventdate |
| |
hostname |
| |
action |
| |
direction |
| |
_group |
| |
proto |
| |
country |
| |
as_num |
| |
as_name |
| |
reason |
| |
src |
| |
dst |
| |
src_port |
| |
dst_port |
| |
dl_active |
| |
dl_inactive |
| |
al_active |
| |
al_inactive |
| |
flags |
| |
tl |
| |
tl_category |
| |
tl_threshold |
| |
tl_score |
| |
hostchain |
| ✓ |
tag |
| ✓ |
rawMessage |
| ✓ |
How is data sent to Devo?
...