-
Notifications
You must be signed in to change notification settings - Fork 0
/
fields.ini
42 lines (42 loc) · 1.69 KB
/
fields.ini
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
bytesIn:struct:100
bytesOut:struct:100
appProtocol:struct:telnet,smtp,http,imap,snmp,https,ftp,unknow,web
catBehavior:struct:/Found,/Create,/Delete,/Modify,/Check,/Authorization,/Execute
catObject:struct:/Host/Application/Database,/Host,/Host/OperatingSystem,/Host/OperatingSystem,/Network,/Vector,/UNKNOW
catOutcome:struct:OK,FAIL,Attempt
catSignificance:struct:/Compromise,/Suspicious,/Informational,/UNKNOW,/Recon
catTechnique:struct:/TrafficAnomaly,/BruteForce,/UNKNOW
collectorReceiptTime:datetime:now()
databaseName:struct:MySQL,Clickhouse,orcl,DB2,ES,Oracle,ORCL,DM7,mongoDB,mssql,pg,gp
destAddress:ip4:50
destMacAddress:macaddress:50
destPort:int:0,10000
deviceCat:struct:/Audit/Database,/VPN,/IDS/Host
deviceReceiptTime:datetime:now()
deviceSendProductName:struct:DBAudit,AiNTA,windows_eventLog
dvcAction:struct:SELECT,DELETE
eventId:string:32
name:struct:sql操作日志
payload:struct:SELECT (CASE WHEN (EXISTS(SELECT resultid FROM SCOTT.TESTDATA)) THEN 1 ELSE 0 END) FROM DUAL
productVendorName:struct:安恒
srcAddress:ip4:50
severity:struct:2
srcGeoCity:struct:杭州,宁波,金华,上海,北京,深圳,LA,华盛顿
srcMacAddress:macaddress:50
srcPort:int:0,10000
srcUserName:username:100
startTime:datetime:now()
vulnerability:struct:webAccess
dbappWafAlertLog:struct:null
deviceAssetType:struct:fileMd5
direction:struct:00,01,10,11
DPIAlertType:struct:passwd
effectRow:struct:0,1,50,100
costTime:int:0,10000
sqlLen:int:0,200
deviceSendProductVersion:struct:v4.0.61
databaseType:struct:MYSQL,UNKNOWN,ORACLE,DB2,UNKNOWN,ORACLE,DM,MONGODB,SQLSERVER,POSTGRESQL,UNKNOWN
sqlId:string:18
tenant:struct:local
clientPrg:struct:C:\\Users\\hl0rey\\AppData\\Local\\Programs\\Python\\Python37-32\\python3.exe
logType:struct:audit