Application-Related Fields in the Query Data
This section describes some dynamic metadata fields that apply to these protocols/applications:
This document will include more metadata field descriptions in the future. For additional fields not listed here, contact LogRhythm Support.
HTTP Field Names and Descriptions
Field | Description |
---|---|
ClientAddr | The IP address of the traffic source. |
Cookie | Full output of information stored by a server on a client’s system. |
HeaderRaw | The raw header information included in packet transmission. |
Host | Source of the HTTP session (for example, www.logrhythm.com). |
Method | HTTP commands, such as GET, PUT, POST, etc. |
MIMEType | The format or type of data sent over HTTP. |
Referer | HTTP header field that identifies the address of the site that linked to the flow you are inspecting. |
Server | Physical server that transmitted the HTTP traffic to the client. |
ServerAddr | IP address of the server (destination) that transmitted the HTTP traffic to the client. |
ServerAgent | Type of web service running on the destination server. |
SessionPacketCounter | Number of packets received in the flow you are inspecting. |
TimeStart | Time stamp that the flow started. |
TimeEnd | Time stamp that the flow ended. |
HTTPS Field Names and Descriptions
Field | Description |
---|---|
ClientAddr | IP address of the traffic source. |
CommonName | Name given by a company for its SSL certificate. |
ServerAddr | IP address of the server (destination) that transmitted the HTTPS traffic to the client. |
ServerName | Domain from where HTTPS traffic was transmitted. The #serverName field is particularly useful for HTTPS, because URL information is commonly not available for secure traffic. |
SessionPacketCounter | Number of packets received in the flow you are inspecting. |
SubjectAltName | Alternative host names protected by the site’s SSL certificate. |
TimeStart | Time the flow started. |
TimeStop | Time the flow ended. |
SMTP Field Names and Descriptions
Field | Description |
---|---|
AttachFilename | List of all attachments to an email message. |
AttachSize | Total size of all attachments to an email message. |
AttachTransferEncoding | Encoding mechanism used on the email message. |
AttachType | Attachment type (for example, an image or PDF). |
ClientAddr | IP address of the source mail server. |
Duration | Time it took for the email to travel to its recipient. |
MIMEType | The format or type of data in the content of the SMTP traffic. |
RcvdDate | Date an email message was received by the recipient’s mail client.
If multiple recipients exist, you see multiple #receivedDate values.
|
Receiver | Email recipient. |
SenderAlias | Email alias of the sender as defined in the source mail server. |
SenderDomain | Domain of the sender as reported by the source mail server. |
SenderEmail | Email address of the sender. |
Server | Mail server of the destination of an email message. |
ServerAddr | IP address of the destination mail server. |
ServerResp | Communication sent from destination mail server, including response code. |
Subject | Actual subject line of the email message. |
TimeStart | Time email transfer began. |
TimeStop | Time email transfer ended. |
SMB (Samba) Field Names and Descriptions
Field | Description |
---|---|
Callee | Domain of the destination of Samba traffic. |
Caller | Host name of the source system generating traffic over Samba. |
ClientAddr | IP address of the source system generating traffic over Samba. |
CommandString | Command string returned from Samba. |
Filename | If file transfer occurred over Samba, the name of the file is reported here. |
FileSize | If file transfer occurred over Samba, the size of the file is reported here. |
Path | If file transfer occurred over Samba, the network path is reported here. |
ServerAddr | IP address of the destination of Samba traffic. |
SessionPacketCounter | Number of packets transferred during this Samba session. |
TimeStart | Time Samba session began. |
TimeStop | Time Samba session ended. |