Network

A network event.

JSON representation 
{
  "sent_bytes": string,
  "received_bytes": string,
  "sent_packets": string,
  "received_packets": string,
  "session_duration": string,
  "session_id": string,
  "parent_session_id": string,
  "application_protocol_version": string,
  "community_id": string,
  "direction": enum (Direction),
  "ip_protocol": enum (IpProtocol),
  "application_protocol": enum (ApplicationProtocol),
  "ftp": {
    object (Ftp)
  },
  "email": {
    object (Email)
  },
  "dns": {
    object (Dns)
  },
  "dhcp": {
    object (Dhcp)
  },
  "http": {
    object (Http)
  },
  "tls": {
    object (Tls)
  },
  "smtp": {
    object (Smtp)
  },
  "asn": string,
  "dns_domain": string,
  "carrier_name": string,
  "organization_name": string,
  "ip_subnet_range": string
}
Fields
sent_bytes

string

The number of bytes sent.
received_bytes

string

The number of bytes received.
sent_packets

string (int64 format)

The number of packets sent.
received_packets

string (int64 format)

The number of packets received.
session_duration

string (Duration format)

The duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
session_id

string

The ID of the network session.
parent_session_id

string

The ID of the parent network session.
application_protocol_version

string

The version of the application protocol. e.g. "1.1, 2.0"
community_id

string

Community ID network flow value.
direction

enum (Direction)

The direction of network traffic.
ip_protocol

enum (IpProtocol)

The IP protocol.
application_protocol

enum (ApplicationProtocol)

The application protocol.
ftp

object (Ftp)

FTP info.
email

object (Email)

Email info for the sender/recipient.
dns

object (Dns)

DNS info.
dhcp

object (Dhcp)

DHCP info.
http

object (Http)

HTTP info.
tls

object (Tls)

TLS info.
smtp

object (Smtp)

SMTP info. Store fields specific to SMTP not covered by Email.
asn

string

Autonomous system number.
dns_domain

string

DNS domain name.
carrier_name

string

Carrier identification.
organization_name

string

Organization name (e.g Google).
ip_subnet_range

string

Associated human-readable IP subnet range (e.g. 10.1.2.0/24).

Ftp

FTP info.

JSON representation 
{
  "command": string
}
Fields
command

string

The FTP command.

Email

Email info.

JSON representation 
{
  "from": string,
  "reply_to": string,
  "to": [
    string
  ],
  "cc": [
    string
  ],
  "bcc": [
    string
  ],
  "mail_id": string,
  "subject": [
    string
  ],
  "bounce_address": string
}
Fields
from

string

The 'from' address.
reply_to

string

The 'reply to' address.
to[]

string

A list of 'to' addresses.
cc[]

string

A list of 'cc' addresses.
bcc[]

string

A list of 'bcc' addresses.
mail_id

string

The mail (or message) ID.
subject[]

string

The subject line(s) of the email.
bounce_address

string

The envelope from address. https://en.wikipedia.org/wiki/Bounce_address

Dns

DNS information.

JSON representation 
{
  "id": integer,
  "response": boolean,
  "opcode": integer,
  "authoritative": boolean,
  "truncated": boolean,
  "recursion_desired": boolean,
  "recursion_available": boolean,
  "response_code": integer,
  "questions": [
    {
      object (Question)
    }
  ],
  "answers": [
    {
      object (ResourceRecord)
    }
  ],
  "authority": [
    {
      object (ResourceRecord)
    }
  ],
  "additional": [
    {
      object (ResourceRecord)
    }
  ]
}
Fields
id

integer (uint32 format)

DNS query id.
response

boolean

Set to true if the event is a DNS response. See QR field from RFC1035.
opcode

integer (uint32 format)

The DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
authoritative

boolean

Other DNS header flags. See RFC1035, section 4.1.1.
truncated

boolean

Whether the DNS response was truncated.
recursion_desired

boolean

Whether a recursive DNS lookup is desired.
recursion_available

boolean

Whether a recursive DNS lookup is available.
response_code

integer (uint32 format)

Response code. See RCODE from RFC1035.
questions[]

object (Question)

A list of domain protocol message questions.
answers[]

object (ResourceRecord)

A list of answers to the domain name query.
authority[]

object (ResourceRecord)

A list of domain name servers which verified the answers to the domain name queries.
additional[]

object (ResourceRecord)

A list of additional domain name servers that can be used to verify the answer to the domain.

Question

DNS Questions. See RFC1035, section 4.1.2.

JSON representation 
{
  "name": string,
  "type": integer,
  "class": integer,
  "prevalence": {
    object (Prevalence)
  }
}
Fields
name

string

The domain name.
type

integer (uint32 format)

The code specifying the type of the query.
class

integer (uint32 format)

The code specifying the class of the query.
prevalence

object (Prevalence)

The prevalence of the domain within the customer's environment.

ResourceRecord

DNS Resource Records. See RFC1035, section 4.1.3.

JSON representation 
{
  "name": string,
  "type": integer,
  "class": integer,
  "ttl": integer,
  "data": string,
  "binary_data": string
}
Fields
name

string

The name of the owner of the resource record.
type

integer (uint32 format)

The code specifying the type of the resource record.
class

integer (uint32 format)

The code specifying the class of the resource record.
ttl

integer (uint32 format)

The time interval for which the resource record can be cached before the source of the information should again be queried.
data

string

The payload or response to the DNS question for all responses encoded in UTF-8 format
binary_data

string (bytes format)

The raw bytes of any non-UTF8 strings that might be included as part of a DNS response.

A base64-encoded string.

Dhcp

DHCP information.

JSON representation 
{
  "opcode": enum (OpCode),
  "htype": integer,
  "hlen": integer,
  "hops": integer,
  "transaction_id": integer,
  "seconds": integer,
  "flags": integer,
  "ciaddr": string,
  "yiaddr": string,
  "siaddr": string,
  "giaddr": string,
  "chaddr": string,
  "sname": string,
  "file": string,
  "options": [
    {
      object (Option)
    }
  ],
  "type": enum (MessageType),
  "lease_time_seconds": integer,
  "client_hostname": string,
  "client_identifier": string,
  "requested_address": string,
  "client_identifier_string": string
}
Fields
opcode

enum (OpCode)

The BOOTP op code.
htype

integer (uint32 format)

Hardware address type.
hlen

integer (uint32 format)

Hardware address length.
hops

integer (uint32 format)

Hardware ops.
transaction_id

integer (uint32 format)

Transaction ID.
seconds

integer (uint32 format)

Seconds elapsed since client began address acquisition/renewal process.
flags

integer (uint32 format)

Flags.
ciaddr

string

Client IP address (ciaddr).
yiaddr

string

Your IP address (yiaddr).
siaddr

string

IP address of the next bootstrap server.
giaddr

string

Relay agent IP address (giaddr).
chaddr

string

Client hardware address (chaddr).
sname

string

Server name that the client wishes to boot from.
file

string

Boot image filename.
options[]

object (Option)

List of DHCP options.
type

enum (MessageType)

DHCP message type.
lease_time_seconds

integer (uint32 format)

Lease time in seconds. See RFC2132, section 9.2.
client_hostname

string

Client hostname. See RFC2132, section 3.14.
client_identifier

string (bytes format)

Client identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.

A base64-encoded string.
requested_address

string

Requested IP address. See RFC2132, section 9.1.
client_identifier_string

string

Client identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.

Option

DHCP options.

JSON representation 
{
  "code": integer,
  "data": string
}
Fields
code

integer (uint32 format)

Code. See RFC1533.
data

string (bytes format)

Data.

A base64-encoded string.

Http

Specify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".

JSON representation 
{
  "method": string,
  "referral_url": string,
  "user_agent": string,
  "response_code": integer,
  "parsed_user_agent": {
    object (UserAgentProto)
  }
}
Fields
method

string

The HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
referral_url

string

The URL for the HTTP referer.
user_agent

string

The User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
response_code

integer

The response status code, for example 200, 302, 404, or 500.
parsed_user_agent

object (UserAgentProto)

The parsed user_agent string.

Tls

Transport Layer Security (TLS) information.

JSON representation 
{
  "client": {
    object (Client)
  },
  "server": {
    object (Server)
  },
  "cipher": string,
  "curve": string,
  "version": string,
  "version_protocol": string,
  "established": boolean,
  "next_protocol": string,
  "resumed": boolean
}
Fields
client

object (Client)

Certificate information for the client certificate.
server

object (Server)

Certificate information for the server certificate.
cipher

string

Cipher used during the connection.
curve

string

Elliptical curve used for a given cipher.
version

string

TLS version.
version_protocol

string

Protocol.
established

boolean

Indicates whether the TLS negotiation was successful.
next_protocol

string

Protocol to be used for tunnel.
resumed

boolean

Indicates whether the TLS connection was resumed from a previous TLS negotiation.

Client

Transport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).

JSON representation 
{
  "certificate": {
    object (Certificate)
  },
  "ja3": string,
  "server_name": string,
  "supported_ciphers": [
    string
  ]
}
Fields
certificate

object (Certificate)

Client certificate.
ja3

string

JA3 hash from the TLS ClientHello, as a hex-encoded string.
server_name

string

Host name of the server, that the client is connecting to.
supported_ciphers[]

string

Ciphers supported by the client during client hello.

Certificate

Certificate information

JSON representation 
{
  "version": string,
  "serial": string,
  "subject": string,
  "issuer": string,
  "md5": string,
  "sha1": string,
  "sha256": string,
  "not_before": string,
  "not_after": string
}
Fields
version

string

Certificate version.
serial

string

Certificate serial number.
subject

string

Subject of the certificate.
issuer

string

Issuer of the certificate.
md5

string

The MD5 hash of the certificate, as a hex-encoded string.
sha1

string

The SHA1 hash of the certificate, as a hex-encoded string.
sha256

string

The SHA256 hash of the certificate, as a hex-encoded string.
not_before

string (Timestamp format)

Indicates when the certificate is first valid.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
not_after

string (Timestamp format)

Indicates when the certificate is no longer valid.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Server

Transport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).

JSON representation 
{
  "certificate": {
    object (Certificate)
  },
  "ja3s": string
}
Fields
certificate

object (Certificate)

Server certificate.
ja3s

string

JA3 hash from the TLS ServerHello, as a hex-encoded string.

Smtp

SMTP info. See RFC 2821.

JSON representation 
{
  "helo": string,
  "mail_from": string,
  "rcpt_to": [
    string
  ],
  "server_response": [
    string
  ],
  "message_path": string,
  "is_webmail": boolean,
  "is_tls": boolean
}
Fields
helo

string

The client's 'HELO'/'EHLO' string.
mail_from

string

The client's 'MAIL FROM' string.
rcpt_to[]

string

The client's 'RCPT TO' string(s).
server_response[]

string

The server's response(s) to the client.
message_path

string

The message's path (extracted from the headers).
is_webmail

boolean

If the message was sent via a webmail client.
is_tls

boolean

If the connection switched to TLS.