JSON representation

JSON representation
{ "sent_bytes": string, "received_bytes": string, "sent_packets": string, "received_packets": string, "session_duration": string, "session_id": string, "parent_session_id": string, "application_protocol_version": string, "community_id": string, "direction": enum (`Direction`), "ip_protocol": enum (`IpProtocol`), "application_protocol": enum (`ApplicationProtocol`), "ftp": { object (`Ftp`) }, "email": { object (`Email`) }, "dns": { object (`Dns`) }, "dhcp": { object (`Dhcp`) }, "http": { object (`Http`) }, "tls": { object (`Tls`) }, "smtp": { object (`Smtp`) }, "asn": string, "dns_domain": string, "carrier_name": string, "organization_name": string, "ip_subnet_range": string }

{
  "sent_bytes": string,
  "received_bytes": string,
  "sent_packets": string,
  "received_packets": string,
  "session_duration": string,
  "session_id": string,
  "parent_session_id": string,
  "application_protocol_version": string,
  "community_id": string,
  "direction": enum (Direction),
  "ip_protocol": enum (IpProtocol),
  "application_protocol": enum (ApplicationProtocol),
  "ftp": {
    object (Ftp)
  },
  "email": {
    object (Email)
  },
  "dns": {
    object (Dns)
  },
  "dhcp": {
    object (Dhcp)
  },
  "http": {
    object (Http)
  },
  "tls": {
    object (Tls)
  },
  "smtp": {
    object (Smtp)
  },
  "asn": string,
  "dns_domain": string,
  "carrier_name": string,
  "organization_name": string,
  "ip_subnet_range": string
}

Fields
`sent_bytes`	`string`
`received_bytes`	`string`
`sent_packets`	`string (int64 format)`
`received_packets`	`string (int64 format)`
`session_duration`	`string (Duration format)` A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: `"3.5s"`.
`session_id`	`string`
`parent_session_id`	`string`
`application_protocol_version`	`string`
`community_id`	`string`
`direction`	`enum (Direction)`
`ip_protocol`	`enum (IpProtocol)`
`application_protocol`	`enum (ApplicationProtocol)`
`ftp`	`object (Ftp)`
`email`	`object (Email)`
`dns`	`object (Dns)`
`dhcp`	`object (Dhcp)`
`http`	`object (Http)`
`tls`	`object (Tls)`
`smtp`	`object (Smtp)`
`asn`	`string`
`dns_domain`	`string`
`carrier_name`	`string`
`organization_name`	`string`
`ip_subnet_range`	`string`

Direction

Enums
`UNKNOWN_DIRECTION`
`INBOUND`
`OUTBOUND`
`BROADCAST`

IpProtocol

Enums
`UNKNOWN_IP_PROTOCOL`
`ICMP`
`IGMP`
`TCP`
`UDP`
`IP6IN4`
`GRE`
`ESP`
`ICMP6`
`EIGRP`
`ETHERIP`
`PIM`
`VRRP`
`SCTP`

ApplicationProtocol

Enums
`UNKNOWN_APPLICATION_PROTOCOL`
`AFP`
`APPC`
`AMQP`
`ATOM`
`BEEP`
`BITCOIN`
`BIT_TORRENT`
`CFDP`
`CIP`
`COAP`
`COTP`
`DCERPC`
`DDS`
`DEVICE_NET`
`DHCP`
`DICOM`
`DNP3`
`DNS`
`E_DONKEY`
`ENRP`
`FAST_TRACK`
`FINGER`
`FREENET`
`FTAM`
`GOOSE`
`GOPHER`
`GRPC`
`HL7`
`H323`
`HTTP`
`HTTPS`
`IEC104`
`IRCP`
`KADEMLIA`
`KRB5`
`LDAP`
`LPD`
`MIME`
`MMS`
`MODBUS`
`MQTT`
`NETCONF`
`NFS`
`NIS`
`NNTP`
`NTCIP`
`NTP`
`OSCAR`
`PNRP`
`PTP`
`QUIC`
`RDP`
`RELP`
`RIP`
`RLOGIN`
`RPC`
`RTMP`
`RTP`
`RTPS`
`RTSP`
`SAP`
`SDP`
`SIP`
`SLP`
`SMB`
`SMTP`
`SNMP`
`SNTP`
`SSH`
`SSMS`
`STYX`
`SV`
`TCAP`
`TDS`
`TOR`
`TSP`
`VTP`
`WHOIS`
`WEB_DAV`
`X400`
`X500`
`XMPP`

Ftp

JSON representation
{ "command": string }

Fields
`command`	`string`

Email

JSON representation
{ "from": string, "reply_to": string, "to": [ string ], "cc": [ string ], "bcc": [ string ], "mail_id": string, "subject": [ string ], "bounce_address": string }

Fields
`from`	`string`
`reply_to`	`string`
`to[]`	`string`
`cc[]`	`string`
`bcc[]`	`string`
`mail_id`	`string`
`subject[]`	`string`
`bounce_address`	`string`

Dns

JSON representation

JSON representation
{ "id": integer, "response": boolean, "opcode": integer, "authoritative": boolean, "truncated": boolean, "recursion_desired": boolean, "recursion_available": boolean, "response_code": integer, "questions": [ { object (`Question`) } ], "answers": [ { object (`ResourceRecord`) } ], "authority": [ { object (`ResourceRecord`) } ], "additional": [ { object (`ResourceRecord`) } ] }

{
  "id": integer,
  "response": boolean,
  "opcode": integer,
  "authoritative": boolean,
  "truncated": boolean,
  "recursion_desired": boolean,
  "recursion_available": boolean,
  "response_code": integer,
  "questions": [
    {
      object (Question)
    }
  ],
  "answers": [
    {
      object (ResourceRecord)
    }
  ],
  "authority": [
    {
      object (ResourceRecord)
    }
  ],
  "additional": [
    {
      object (ResourceRecord)
    }
  ]
}

Fields
`id`	`integer (uint32 format)`
`response`	`boolean`
`opcode`	`integer (uint32 format)`
`authoritative`	`boolean`
`truncated`	`boolean`
`recursion_desired`	`boolean`
`recursion_available`	`boolean`
`response_code`	`integer (uint32 format)`
`questions[]`	`object (Question)`
`answers[]`	`object (ResourceRecord)`
`authority[]`	`object (ResourceRecord)`
`additional[]`	`object (ResourceRecord)`

Question

JSON representation
{ "name": string, "type": integer, "class": integer, "prevalence": { object (`Prevalence`) } }

Fields
`name`	`string`
`type`	`integer (uint32 format)`
`class`	`integer (uint32 format)`
`prevalence`	`object (Prevalence)`

ResourceRecord

JSON representation
{ "name": string, "type": integer, "class": integer, "ttl": integer, "data": string, "binary_data": string }

Fields
`name`	`string`
`type`	`integer (uint32 format)`
`class`	`integer (uint32 format)`
`ttl`	`integer (uint32 format)`
`data`	`string`
`binary_data`	`string (bytes format)` A base64-encoded string.

Dhcp

JSON representation

JSON representation
{ "opcode": enum (`OpCode`), "htype": integer, "hlen": integer, "hops": integer, "transaction_id": integer, "seconds": integer, "flags": integer, "ciaddr": string, "yiaddr": string, "siaddr": string, "giaddr": string, "chaddr": string, "sname": string, "file": string, "options": [ { object (`Option`) } ], "type": enum (`MessageType`), "lease_time_seconds": integer, "client_hostname": string, "client_identifier": string, "requested_address": string }

{
  "opcode": enum (OpCode),
  "htype": integer,
  "hlen": integer,
  "hops": integer,
  "transaction_id": integer,
  "seconds": integer,
  "flags": integer,
  "ciaddr": string,
  "yiaddr": string,
  "siaddr": string,
  "giaddr": string,
  "chaddr": string,
  "sname": string,
  "file": string,
  "options": [
    {
      object (Option)
    }
  ],
  "type": enum (MessageType),
  "lease_time_seconds": integer,
  "client_hostname": string,
  "client_identifier": string,
  "requested_address": string
}

Fields
`opcode`	`enum (OpCode)`
`htype`	`integer (uint32 format)`
`hlen`	`integer (uint32 format)`
`hops`	`integer (uint32 format)`
`transaction_id`	`integer (uint32 format)`
`seconds`	`integer (uint32 format)`
`flags`	`integer (uint32 format)`
`ciaddr`	`string`
`yiaddr`	`string`
`siaddr`	`string`
`giaddr`	`string`
`chaddr`	`string`
`sname`	`string`
`file`	`string`
`options[]`	`object (Option)`
`type`	`enum (MessageType)`
`lease_time_seconds`	`integer (uint32 format)`
`client_hostname`	`string`
`client_identifier`	`string (bytes format)` A base64-encoded string.
`requested_address`	`string`

OpCode

Enums
`UNKNOWN_OPCODE`
`BOOTREQUEST`
`BOOTREPLY`

Option

JSON representation
{ "code": integer, "data": string }

Fields

Fields
`code`	`integer (uint32 format)`
`data`	`string (bytes format)` A base64-encoded string.

code

integer (uint32 format)

data

string (bytes format)

A base64-encoded string.

MessageType

Enums
`UNKNOWN_MESSAGE_TYPE`
`DISCOVER`
`OFFER`
`REQUEST`
`DECLINE`
`ACK`
`NAK`
`RELEASE`
`INFORM`
`WIN_DELETED`
`WIN_EXPIRED`

Http

JSON representation
{ "method": string, "referral_url": string, "user_agent": string, "response_code": integer, "parsed_user_agent": { } }

Fields
`method`	`string`
`referral_url`	`string`
`user_agent`	`string`
`response_code`	`integer`
`parsed_user_agent`

Client

JSON representation
{ "certificate": { object (`Certificate`) }, "ja3": string, "server_name": string, "supported_ciphers": [ string ] }

Fields
`certificate`	`object (Certificate)`
`ja3`	`string`
`server_name`	`string`
`supported_ciphers[]`	`string`

Certificate

JSON representation
{ "version": string, "serial": string, "subject": string, "issuer": string, "md5": string, "sha1": string, "sha256": string, "not_before": string, "not_after": string }

Fields
`version`	`string`
`serial`	`string`
`subject`	`string`
`issuer`	`string`
`md5`	`string`
`sha1`	`string`
`sha256`	`string`
`not_before`	`string (Timestamp format)` A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: `"2014-10-02T15:01:23Z"` and `"2014-10-02T15:01:23.045123456Z"`.
`not_after`	`string (Timestamp format)` A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: `"2014-10-02T15:01:23Z"` and `"2014-10-02T15:01:23.045123456Z"`.

Server

JSON representation
{ "certificate": { object (`Certificate`) }, "ja3s": string }

Fields
`certificate`	`object (Certificate)`
`ja3s`	`string`

Smtp

JSON representation
{ "helo": string, "mail_from": string, "rcpt_to": [ string ], "server_response": [ string ], "message_path": string, "is_webmail": boolean, "is_tls": boolean }

Fields
`helo`	`string`
`mail_from`	`string`
`rcpt_to[]`	`string`
`server_response[]`	`string`
`message_path`	`string`
`is_webmail`	`boolean`
`is_tls`	`boolean`

Network

Direction

IpProtocol

ApplicationProtocol

Ftp

Email

Dns

Question

ResourceRecord

Dhcp

OpCode

Option

MessageType

Http

Client

Certificate

Server

Smtp