eStreamer

Cisco's event streaming protocol, used by Firepower Management Center to export security event data—intrusion alerts, connection logs, file and malware events—to external systems in real time.

Connection Model

DataStream is the eStreamer client: the collector dials out to the Management Center rather than listening for it. The default port is 8302, and a wildcard listen address is rejected.

The connection is mutually authenticated with TLS, and the client certificate is supplied as a PKCS#12 bundle.

The server chain is verified only when a CA is pinned. With no tls.ca_name configured the session is not verified at all — setting insecure_skip_verify is not required to reach that state, it is simply the default. Hostname and SAN checking is skipped in every case by design, since the Management Center is normally reached by address.

Once connected, the exchange proceeds as follows:

1. The client sends an event stream request carrying a checkpoint timestamp and a flag word selecting the event classes and extended fields it wants.
2. If the server answers with a streaming information message, the client replies with a streaming request negotiating the extended service and version pairs it supports.
3. Event data flows from the server. After every message received, the client writes a null message as a keepalive. The server does the same.
4. On reconnect, the client resumes from its checkpoint, so an interrupted stream replays rather than skips. There is one checkpoint per device, not one per event family: whichever record decoded last sets it for all four.

The read timeout is five minutes. A read failure does not stop the collector — it closes the socket, counts the failure, and reconnects a second later; a successful reconnect resets the count to zero. The collector gives up only after eleven accumulated failures whose reconnects also failed.

Message Framing

Every message opens with an 8-byte header.

Field	Width	Description
HeaderVersion	2 bytes	Always 1
MessageType	2 bytes	Selects the message body, from the table below
MessageLength	4 bytes	Length of the body that follows

Message Type	Value	Purpose
NULL_MESSAGE	0	Keepalive
ERROR_MESSAGE	1	Error code and text. The body is read in full rather than skipped, because skipping desynchronizes the stream
EVENT_STREAM_REQUEST	2	Opens the stream
EVENT_DATA	4	Carries event records
HOST_DATA_REQUEST	5	Requests host profile data
SINGLE_HOST_DATA	6	One host profile
MULTIPLE_HOST_DATA	7	Several host profiles
STREAMING_REQUEST	2049	Negotiates extended services
STREAMING_INFORMATION	2051	The server's extended service offer
MESSAGE_BUNDLE	4002	Wraps several sub-messages, each with its own 8-byte header

Record Framing

Event data messages carry records, each with its own header. Two forms exist:

Form	Size	Contents
Standard	8 bytes	Record type, record length
Archive	16 bytes	Record type, record length, archive timestamp, checksum

DataStream requests the archive form and its decoders require it. An event record arriving in the standard form is dropped rather than decoded.

Record Type	Value	Decoded
PACKETDATA_RECORD	2	No. Declared but never dispatched
CONNECTIONSTATISTICS_RECORD	71	Yes
MALWAREEVENT_RECORD	125	Yes
INTRUSIONEVENT_RECORD	400	Yes
FILEEVENT_RECORD	500	Yes
FILEEVENT_RECORDV2	502	Yes

A further 21 record types carry metadata rather than events—rule messages, classifications, device identifiers, file policies, interface names and similar. These populate lookup caches that resolve the numeric identifiers on event records into names.

Event Fields

Each event family is decoded from a versioned block layout and then reduced to a common set of fields before emission. The reduction is substantial: a connection record decodes 123 fields and emits 17. The tables below give what reaches a pipeline.

The families do not share a vocabulary. Connection events describe endpoints as initiator and responder, intrusion events as source and destination, and file and malware events as sending and receiving.

Connection

Field	Description
Date	Event timestamp
InitiatorIP	Address that opened the connection
ResponderIP	Address that received it
InitiatorPort	Initiator port number
ResponderPort	Responder port number
ApplicationProtocol	Detected application protocol
Client	Detected client application
ClientVersion	Client application version
AccessControlPolicy	Policy that evaluated the connection
AccessControlRule	Rule that matched
RuleAction	Action the rule took
RuleReason	Why the action was taken
IngressInterface	Interface the traffic entered on
EgressInterface	Interface it left on
FirstPacketTimestamp	Time of the first packet
LastPacketTimestamp	Time of the last packet

Intrusion

Field	Description
Date	Event timestamp
SourceIP	Source address
DestinationIP	Destination address
SourcePort	Source port number
DestinationPort	Destination port number
Message	Rule message, resolved from the rule identifier
Classification	Rule classification
Priority	Rule priority
Impact	Assessed impact on the target
Blocked	Whether the traffic was blocked
AccessControlPolicy	Policy in force
AccessControlRule	Rule that matched
ApplicationProtocol	Detected application protocol
Client	Detected client application
IngressInterface	Interface the traffic entered on
EgressInterface	Interface it left on

File

Field	Description
Date	Event timestamp
SendingIP	Address that sent the file
ReceivingIP	Address that received it
FileName	File name
FileSHAHash	SHA hash of the file
FileSize	File size in bytes
FileType	Detected file type
FileURI	URI the file was retrieved from
FilePolicy	File policy in force
ThreatScore	Assessed threat score
ApplicationProtocol	Detected application protocol
Action	Action taken on the file
Client	Detected client application
SendingPort	Port the file was sent from
ReceivingPort	Port it was received on

Malware

Field	Description
Date	Event timestamp
EventType	Malware event type
SendingIP	Address that sent the file
ReceivingIP	Address that received it
FileName	File name
FileSHAHash	SHA hash of the file
FileSize	File size in bytes
FileType	Detected file type
DetectionName	Name of the detected malware
Detector	Component that made the detection
ThreatScore	Assessed threat score
ApplicationProtocol	Detected application protocol
Action	Action taken on the file
Client	Detected client application
FileURI	URI the file was retrieved from
SendingPort	Port the file was sent from
ReceivingPort	Port it was received on

Event Selection

The four families are requested independently and all four are enabled by default. Each corresponds to an input identifier in the device configuration: 102 connection, 103 file, 104 malware, 106 intrusion.