367 строки
8.6 KiB
Plaintext
367 строки
8.6 KiB
Plaintext
// Common Schema 4.0 definition. Generated from Collector Bond definition by applying the following steps:
|
|
// 1) Take CommonSchemaEvent.bond and rename it to CsProtocol.bond.
|
|
// 2) Remove comments, Bond metadata, BOM-marker, normalize tabs and linebreaks.
|
|
// 3) Comment out recursive Ingest.processedIngest field.
|
|
// 4) Change namespace to CsProtocol.
|
|
// 5) Change CommonSchemaEvent struct name to Record.
|
|
// 6) Replace 'nullable' with 'vector'.
|
|
// 7) Remove default 'nothing' for strings to avoid maybe<>.
|
|
// 8) Remove bonded<>.
|
|
|
|
namespace CsProtocol;
|
|
|
|
struct Ingest
|
|
{
|
|
1: required int64 time;
|
|
2: required string clientIp;
|
|
3: optional int64 auth;
|
|
4: optional int64 quality;
|
|
5: optional int64 uploadTime;
|
|
6: optional string userAgent;
|
|
7: optional string client;
|
|
// 8: optional vector<Ingest> processedIngest;
|
|
}
|
|
|
|
struct User
|
|
{
|
|
1: optional string id;
|
|
2: optional string localId;
|
|
3: optional string authId;
|
|
4: optional string locale;
|
|
}
|
|
|
|
struct Loc
|
|
{
|
|
1: optional string id;
|
|
2: optional string country;
|
|
3: optional string timezone;
|
|
}
|
|
|
|
struct Device
|
|
{
|
|
1: optional string id;
|
|
2: optional string localId;
|
|
3: optional string authId;
|
|
4: optional string authSecId;
|
|
5: optional string deviceClass;
|
|
6: optional string orgId;
|
|
7: optional string orgAuthId;
|
|
8: optional string make;
|
|
9: optional string model;
|
|
10: optional string authIdEnt;
|
|
}
|
|
|
|
struct Os
|
|
{
|
|
1: optional string locale;
|
|
2: optional string expId;
|
|
3: optional int32 bootId;
|
|
4: optional string name;
|
|
5: optional string ver;
|
|
}
|
|
|
|
struct App
|
|
{
|
|
1: optional string expId;
|
|
2: optional string userId;
|
|
3: optional string env;
|
|
4: optional int32 asId;
|
|
5: optional string id;
|
|
6: optional string ver;
|
|
7: optional string locale;
|
|
8: optional string name;
|
|
9: optional string sesId;
|
|
}
|
|
|
|
struct Utc
|
|
{
|
|
1: optional string stId;
|
|
2: optional string aId;
|
|
3: optional string raId;
|
|
4: optional string op;
|
|
5: optional int64 cat;
|
|
6: optional int64 flags;
|
|
7: optional string sqmId;
|
|
9: optional string mon;
|
|
10: optional int32 cpId;
|
|
11: optional string bSeq;
|
|
12: optional string epoch;
|
|
13: optional int64 seq;
|
|
// cs4.0 fields
|
|
14: optional double popSample;
|
|
15: optional int64 eventFlags;
|
|
16: optional int64 wsId;
|
|
17: optional int64 wcmp;
|
|
18: optional int64 wPId;
|
|
}
|
|
|
|
struct M365a
|
|
{
|
|
1: optional string enrolledTenantId;
|
|
2: optional uint64 msp;
|
|
}
|
|
|
|
struct Xbl
|
|
{
|
|
5: optional map<string, string> claims;
|
|
10: optional string nbf;
|
|
20: optional string exp;
|
|
30: optional string sbx;
|
|
40: optional string dty;
|
|
50: optional string did;
|
|
60: optional string xid;
|
|
70: optional uint64 uts;
|
|
80: optional string pid;
|
|
90: optional string dvr;
|
|
100: optional uint32 tid;
|
|
110: optional string tvr;
|
|
120: optional string sty;
|
|
130: optional string sid;
|
|
140: optional int64 eid;
|
|
150: string ip;
|
|
}
|
|
|
|
struct Javascript
|
|
{
|
|
10: optional string libVer;
|
|
15: optional string osName;
|
|
20: optional string browser;
|
|
21: optional string browserVersion;
|
|
25: optional string platform;
|
|
30: optional string make;
|
|
35: optional string model;
|
|
40: optional string screenSize;
|
|
45: optional string msfpc;
|
|
50: optional string mc1Id;
|
|
60: optional uint64 mc1Lu;
|
|
70: optional bool isMc1New;
|
|
80: optional string ms0;
|
|
90: optional string anid;
|
|
100: optional string a;
|
|
110: optional string msResearch;
|
|
120: optional string csrvc;
|
|
130: optional string rtCell;
|
|
140: optional string rtEndAction;
|
|
150: optional string rtPermId;
|
|
160: optional string r;
|
|
170: optional string wtFpc;
|
|
180: optional string omniId;
|
|
190: optional string gsfxSession;
|
|
200: optional string domain;
|
|
210: required bool userConsent;
|
|
220: optional string browserLang;
|
|
230: optional string serviceName;
|
|
999: optional string dnt;
|
|
}
|
|
|
|
struct Protocol
|
|
{
|
|
1: optional int32 metadataCrc;
|
|
2: optional vector<vector<string>> ticketKeys;
|
|
3: optional string devMake;
|
|
4: optional string devModel;
|
|
5: optional uint64 msp;
|
|
}
|
|
|
|
|
|
struct Receipts
|
|
{
|
|
1: optional int64 originalTime;
|
|
2: optional int64 uploadTime;
|
|
3: optional string originalName;
|
|
4: optional uint64 flags = 0;
|
|
}
|
|
|
|
struct Net
|
|
{
|
|
1: optional string provider;
|
|
2: optional string cost;
|
|
3: optional string type;
|
|
}
|
|
|
|
|
|
struct Sdk
|
|
{
|
|
// NOTE: libVer moved from 1 to 5??
|
|
1: optional string ver;
|
|
2: optional string epoch;
|
|
3: optional int64 seq;
|
|
4: optional string installId;
|
|
5: optional string libVer;
|
|
}
|
|
|
|
struct Cloud
|
|
{
|
|
1: optional string fullEnvName;
|
|
2: optional string location;
|
|
3: optional string environment;
|
|
4: optional string deploymentUnit;
|
|
5: optional string name;
|
|
6: optional string roleInstance;
|
|
7: optional string role;
|
|
}
|
|
|
|
struct Service
|
|
{
|
|
1: optional string name;
|
|
2: optional string role;
|
|
3: optional string roleVersion;
|
|
}
|
|
|
|
struct Cs
|
|
{
|
|
1: optional string sig;
|
|
}
|
|
|
|
struct Mscv
|
|
{
|
|
1: optional string cV;
|
|
}
|
|
|
|
struct IntWeb
|
|
{
|
|
1: optional string mc1Id;
|
|
2: optional string msfpc;
|
|
3: optional string anid;
|
|
4: optional string serviceName;
|
|
5: optional map<string, string> mscom;
|
|
}
|
|
|
|
struct IntService
|
|
{
|
|
1: optional string fullEnvName;
|
|
2: optional string location;
|
|
3: optional string environment;
|
|
4: optional string deploymentUnit;
|
|
5: optional string name;
|
|
}
|
|
|
|
struct Web
|
|
{
|
|
10: optional string browser;
|
|
20: optional string browserVer;
|
|
30: optional string screenRes;
|
|
40: optional string domain;
|
|
50: required bool userConsent;
|
|
60: optional string browserLang;
|
|
70: optional bool isManual;
|
|
}
|
|
|
|
enum ValueKind
|
|
{
|
|
ValueInt64 = 0,
|
|
ValueUInt64 = 1,
|
|
ValueInt32 = 2,
|
|
ValueUInt32 = 3,
|
|
ValueDouble = 4,
|
|
ValueString = 5,
|
|
ValueBool = 6,
|
|
ValueDateTime = 7,
|
|
ValueGuid = 8,
|
|
ValueArrayInt64 = 9,
|
|
ValueArrayUInt64 = 10,
|
|
ValueArrayInt32 = 11,
|
|
ValueArrayUInt32 = 12,
|
|
ValueArrayDouble = 13,
|
|
ValueArrayString = 14,
|
|
ValueArrayBool = 15,
|
|
ValueArrayDateTime = 16,
|
|
ValueArrayGuid = 17
|
|
}
|
|
|
|
enum PIIKind
|
|
{
|
|
NotSet = 0,
|
|
DistinguishedName = 1,
|
|
GenericData = 2,
|
|
IPV4Address = 3,
|
|
IPv6Address = 4,
|
|
MailSubject = 5,
|
|
PhoneNumber = 6,
|
|
QueryString = 7,
|
|
SipAddress = 8,
|
|
SmtpAddress = 9,
|
|
Identity = 10,
|
|
Uri = 11,
|
|
Fqdn = 12,
|
|
IPV4AddressLegacy = 13
|
|
}
|
|
|
|
struct PII
|
|
{
|
|
1: optional PIIKind Kind = NotSet;
|
|
}
|
|
|
|
enum CustomerContentKind
|
|
{
|
|
NotSet = 0,
|
|
GenericContent = 1
|
|
}
|
|
|
|
struct CustomerContent
|
|
{
|
|
1: optional CustomerContentKind Kind = NotSet;
|
|
}
|
|
|
|
struct Attributes
|
|
{
|
|
1: optional vector<PII> pii;
|
|
2: optional vector<CustomerContent> customerContent;
|
|
}
|
|
|
|
struct Value
|
|
{
|
|
1: optional ValueKind type = ValueString;
|
|
2: optional vector<Attributes> attributes;
|
|
3: optional string stringValue;
|
|
4: optional int64 longValue; // all integer types, data time, bool is represented here
|
|
5: optional double doubleValue;
|
|
6: optional vector<vector<uint8>> guidValue;
|
|
10: optional vector<vector<string>> stringArray;
|
|
11: optional vector<vector<int64>> longArray; // all vectors of integer types, data time, bool are represented here
|
|
12: optional vector<vector<double>> doubleArray;
|
|
13: optional vector<vector<vector<uint8>>> guidArray;
|
|
}
|
|
|
|
struct Data
|
|
{
|
|
1: optional map<string, Value> properties;
|
|
}
|
|
|
|
struct Record
|
|
{
|
|
1: required string ver;
|
|
2: required string name;
|
|
3: required int64 time;
|
|
4: optional double popSample = 100.0;
|
|
5: optional string iKey;
|
|
6: optional int64 flags;
|
|
7: optional string cV;
|
|
20: optional vector<Ingest> extIngest;
|
|
21: optional vector<Protocol> extProtocol;
|
|
22: optional vector<User> extUser;
|
|
23: optional vector<Device> extDevice;
|
|
24: optional vector<Os> extOs;
|
|
25: optional vector<App> extApp;
|
|
26: optional vector<Utc> extUtc;
|
|
27: optional vector<Xbl> extXbl;
|
|
28: optional vector<Javascript> extJavascript;
|
|
29: optional vector<Receipts> extReceipts;
|
|
31: optional vector<Net> extNet;
|
|
32: optional vector<Sdk> extSdk;
|
|
33: optional vector<Loc> extLoc;
|
|
34: optional vector<Cloud> extCloud;
|
|
35: optional vector<Service> extService;
|
|
36: optional vector<Cs> extCs;
|
|
37: optional vector<M365a> extM365a;
|
|
41: optional vector<Data> ext;
|
|
42: optional vector<Mscv> extMscv;
|
|
43: optional vector<IntWeb> extIntWeb;
|
|
44: optional vector<IntService> extIntService;
|
|
45: optional vector<Web> extWeb;
|
|
51: optional map<string, string> tags;
|
|
60: optional string baseType;
|
|
61: optional vector<Data> baseData;
|
|
70: vector<Data> data;
|
|
}
|