A packet with an invalid signature field in the header was received on an SMB2 connection

Application Inspection triggers are composed of user-defined code that automatically executes on system events through the ExtraHop trigger API. By writing triggers, you can collect custom metric data about the activities on your network. In addition, triggers can perform operations on protocol messages (such as an HTTP request) before the packet is discarded.

The ExtraHop system monitors, extracts, and records a core set of Layer 7 (L7) metrics for devices on the network, such as response counts, error counts, and processing times. After these metrics are recorded for a given L7 protocol, the packets are discarded, freeing resources for continued processing.

Triggers enable you to:

• Generate and store custom metrics to the internal datastore of the ExtraHop system. For example, while the ExtraHop system does not collect information about which user agent generated an HTTP request, you can generate and collect that level of detail by writing a trigger and committing the data to the datastore. You can also view custom data that is stored in the datastore by creating custom metrics pages and displaying those metrics through the Metric Explorer and dashboards.
• Generate and send records for long-term storage and retrieval to a recordstore.
• Create a user-defined application that collects metrics across multiple types of network traffic to capture information with cross-tier impact. For example, to gain a unified view of all the network traffic associated with a website—from web transactions to DNS requests and responses to database transactions—you can create an application that contains all of these website-related metrics.
• Generate custom metrics and send the information to syslog consumers such as Splunk, or to third party databases such as MongoDB or Kafka.
• Initiate a packet capture to record individual flows based on user-specified criteria. You can download captured flows and process them through third-party tools. Your ExtraHop system must be licensed for packet capture to access this feature.

The purpose of this guide is to provide reference material when writing the blocks of JavaScript code that run when trigger conditions are met. The Trigger API resources section contains a list of topics that provide a comprehensive overview of trigger concepts and procedures.

The ExtraHop Trigger API enables you to create custom metrics that collect data about your environment, beyond what is provided by built-in protocol metrics.

You can create custom metrics of the following data types:

The number of metric events that occurred over a specific time range. For example, to record information about the number of HTTP requests over time, select a top-level count metric. You could also select a detail count metric to record information about the number of times clients accessed a server, with the IPAddress key and an integer representing the number of accesses as a value.

Custom metrics are supported for the following source types:

• Application
• Device
• Network
• FlowInterface
• FlowNetwork

For more information about the differences between top-level and detail metrics, see the Metrics FAQ.

Global functions can be called on any event.

cache (key: String, valueFn: () => Any): Any Caches the specified parameters in a table to enable efficient lookup and return of large data sets. key: String An identifier that indicates the location of the cached value. A key must be unique within a trigger. valueFn: () => Any A zero-argument function that returns a non-null value.

In the following example, the cache method is called with large amounts of data hard-coded into the trigger script:

In the following example, a list of known user agents in a JBoss trigger is normalized before it is compared with the observed user agent. The trigger converts the list to lowercase and trims excess whitespace, and then caches the entries.

The following values are valid for the related Web UI categories:

The following properties are automatically added to records and are not represented on the objects returned by the built-in record accessors, such as HTTP.record:

• ex
• flowID
• client
• clientAddr
• clientPort
• receiver
• receiverAddr
• receiverPort
• sender
• senderAddr
• senderPort
• server
• serverAddr
• serverPort
• timestamp
• vlan

For example, to access the flowID property in an HTTP record, you would include HTTP.record.Flow.id in your statement.

In the following example, the two property and value pairs that have been added to the record variable are committed to a custom record by the commitRecord function:

On most events, you can commit a built-in record that contains default properties. For example, a built-in record such as the HTTP.record object can be the basis for a custom record.

The following example code commits a custom record that includes all of the built-in metrics from the HTTP.record object and an additional metric from the HTTP.headers property:

You can access a built-in record object on the following events:

Multiple calls to debug and log statements in which the message is the same value will display once every 30 seconds.

The limit for debug log entries is 2048 bytes. To log larger entries, see Remote.Syslog.

The Trigger API classes in this section provide functionality that is broadly applicable across all events.

The Application class enables you collect metrics across multiple types of network traffic to capture information with cross-tier impact. For example, if you want a unified view of all the network traffic associated with a website—from web transactions to DNS requests and responses to database transactions—you can write a trigger to create a custom application that contains all of these related metrics. The Application class also enables you to create custom metrics and commit the metric data to applications. Applications can only be created and defined through triggers.

The methods in this section cannot be called directly on the Application class. You can only call these methods on specific Application class instances. For example, the following statement is valid:

However, the following statement is invalid:

The application ID must be a string. For built-in application metrics, the metrics are committed only once, even if the commit() method is called multiple times on the same event.

The following statement creates an application named "myApp" and commits built-in metrics to the application:

If you plan to commit custom metrics to an application, you can create the application without calling the commit() method. For example, if the application does not already exist, the following statement creates the application and commits the custom metric to the application:

You can call the Application.commit method only on the following events:

id: String The unique ID of the application, as shown in the ExtraHop Web UI on the page for that application.

• Example: Create an application container

The Buffer class provides access to binary data.

A buffer is an object with the characteristics of an array. Each element in the array is a number between 0 and 255, representing one byte. Each buffer object has a length property (the number of items in an array) and a square bracket operator.

Encrypted payload is not decrypted for TCP and UDP payload analysis.

UDP_PAYLOAD requires a matching string but TCP_PAYLOAD does not. If you do not specify a matching string for TCP_PAYLOAD, the trigger runs one time after the first N bytes of payload.

decode(type: String): String Interprets the contents of the buffer and returns a string with one of the following options: equals(buffer: Buffer): Boolean Performs an equality test between Buffer objects, where buffer is the object to be compared against. slice(start: Number, [end: Number]): Buffer Returns the specified bytes in a buffer as a new buffer. Bytes are selected starting at the given start argument and ending at (but not including) the end argument. start: Number Integer that specifies where to start the selection. Specify negative numbers to select from the end of a buffer. This is zero-based. end: Number Optional integer that specifies where to end the selection. If omitted, all elements from the start position and to the end of the buffer will be selected. Specify negative numbers to select from the end of a buffer. This is zero-based. toString(): String Converts the buffer to a string. unpack(format: String, [offset: Number]): Array Processes binary or fixed-width data from any buffer object, such as one returned by HTTP.payload, Flow.client.payload, or Flow.sender.payload, according to the given format string and, optionally, at the specified offset.

Returns a JavaScript array that contains one or more unpacked fields and contains the absolute payload byte position +1 of the last byte in the unpacked object. The bytes value can be specified as the offset in further calls to unpack a buffer.

The table below displays supported buffer string formats:

length: Number The number of bytes in the buffer.

The Detection class enables you to retrieve information about detections on the ExtraHop system.

DETECTION_UPDATE Runs when a detection is created or updated on the ExtraHop system.

applianceId: Number If called on a Command appliance, returns the ID of the connected Discover appliance that the detection occurred on. If called on a Discover appliance, returns 0. assignee: String The assignee of the ticket associated with the detection. categories: Array of Strings The list of categories the detection belongs to. description: String The description of the detection.

The following table shows common Markdown formats that you can include in the description:

The Device class enables you to retrieve device attributes and add custom metrics at the device level.

Device(id: String) Constructor for the Device object that accepts one parameter, which is a unique 16-character string ID.

If supplied with an ID from an existing Device object, the constructor creates a copy of that object with all of the object properties, as shown in the following example:

Metrics committed to a Device object through a metricAdd* function are persisted to the datastore

The methods described in this section are present only on instances of the Device class. The majority of the methods enable you to create device-level custom metrics, as shown in the following example:

The following properties enable you to retrieve device attributes and are present only on instances of the Device class.

To direct a trigger to run only on the initial discovery of a device, see the NEW_DEVICE event discussed in the Discover class.

If the trigger is running on an event associated with a Flow object, the hasTrigger property value is true on at least one of the Device objects in the flow.

The hasTrigger property is useful to distinguish device roles. For example, if a trigger is assigned to a group of proxy servers, you can easily determine whether a device is acting as the client or the server, rather than checking for IP addresses or device IDs, such as in the following example:

The Discover class enables you to retrieve information about newly discovered devices and applications.

NEW_APPLICATION Runs when an application is first discovered. This event consumes capture resources.

application: Application A newly discovered application.

Applies only to NEW_APPLICATION events.

Applies only to NEW_DEVICE events.

• Example: Send discovered device data to a remote syslog server

The ExternalData class enables you to retrieve data sent from external sources to the Trigger API through the ExtraHop REST API.

body: String The external data sent to the trigger. type: String An identifier that describes the data sent to the trigger. The type is defined when the data is sent to the ExtraHop REST API.

Flow refers to a conversation between two endpoints over a protocol such as TCP, UDP or ICMP. The Flow class provides access to elements of these conversations, such as endpoint IP addresses and age of the flow. The Flow class also contains a flow store designed to pass objects from request to response on the same flow.

If a flow is associated with an ExtraHop-monitored L7 protocol, events that correlate to the protocol will run in addition to flow events. For example, a flow associated with HTTP will also run the HTTP_REQUEST and HTTP_RESPONSE events.

Through a combination of L7 payload analysis, observation of TCP handshakes, and port number-based heuristics, the FLOW_CLASSIFY event identifies the L7 protocol and the device roles for the endpoints in a flow such as client/server or sender/receiver.

The nature of a flow can change over its lifetime, for example, tunneling over HTTP or switching from SMTP to SMTP-SSL. In these cases, FLOW_CLASSIFY runs again after the protocol change.

The FLOW_CLASSIFY event is useful for initiating an action on a flow based on the earliest knowledge of flow information such as the L7 protocol, client/server IP addresses, or sender/receiver ports.

Common actions initiated upon FLOW_CLASSIFY include starting a packet capture through the captureStart() method or associating the flow with an application container through the addApplication() method.

Additional options are available when you create a trigger that runs on this event. By default, FLOW_CLASSIFY does not run upon flow expiration; however, you can configure a trigger to do so in order to accumulate metrics for flows that were not classified before expiring. See Advanced trigger options for more information.

The FLOW_DETACH event is useful for detecting malicious content sent by clients and servers. The following is an example of how a trigger can detect bad DNS responses upon FLOW_DETACH events:

FLOW_TICK provides a means to periodically check for certain conditions on the flow, such as zero windows and Nagle delays, and then take an action, such as initiating a packet capture or sending a syslog message.

The following is an example of FLOW_TICK:

FLOW_TURN also exposes a Turn object.

Flow refers to a conversation between two endpoints over a protocol; an endpoint can be one of the following components:

• client
• server
• sender
• receiver

The methods and properties described in this section are called or accessed for a specified endpoint on the flow. For example, to access the device property from an HTTP client, the syntax is Flow.client.device.

The endpoint that you specify depends on the events associated with the trigger. For example, the ACTIVEMQ_MESSAGE event only supports sender and receiver endpoints. The following table displays a list of events that can be associated with a flow and the endpoints supported for each event:

On a flow, traffic moves in each direction between two endpoints. The commitRecord() method only records flow details in one direction, such as from the client to the server. To record details about the entire flow you must call commitRecord() twice, once for each direction, and specify the endpoint in the syntax—for example, Flow.client.commitRecord() and Flow.server.commitRecord().

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

To view the default properties committed to the record object, see the record property below.

Access only on FLOW_TICK, FLOW_TURN, or FLOW_RECORD events or an error will occur.

Specify the device role in the syntax—for example, Flow.client.dscp or Flow.server.dscp.

The value is zero for each entry that has no bytes of the specific DSCP since the last FLOW_TICK event.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Specify the device role in the syntax—for example, Flow.client.dscpName or Flow.receiver.dscpName.

The value is zero for each entry that has no packets of the specific DSCP since the last FLOW_TICK event.

Applies only to FLOW_TICK or FLOW_TURN events.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

This condition may be detected in the TCP_CLOSE event and in any impacted L7 events (for example, HTTP_REQUEST or DB_RESPONSE).

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on TCP_PAYLOAD, UDP_PAYLOAD, or SSL_PAYLOAD events or an error will occur.

Access only on FLOW_TICK, FLOW_TURN, or FLOW_RECORD events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

The record object contains the following default properties:

• age
• bytes (L3)

  Note:

  This property represents the total number of bytes that were transmitted by the flow at the time that the FLOW_RECORD event ran. The FLOW_RECORD event runs several times over the course of each flow, so the value will increase every time the event runs.

• dscpName
• first
• last
• pkts
• proto
• senderAddr
• senderPort
• receiverAddr
• receiverPort
• tcpFlags

Specify the device role in the syntax—for example, Flow.client.record or Flow.server.record.

Access the record object only on FLOW_RECORD events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

addApplication(name: String, [turnTiming: Boolean]): void Creates an application with the specified name and collects L2-L4 metrics from the flow. The application can be viewed from the Web UI and the metrics are displayed on an L4 page in the application. A flow can be associated with one or more applications at a given instant; the L2-L4 metrics collected by each application will be the same.

Calling Flow.addApplication(name) on a FLOW_CLASSIFY event is common on unsupported protocols. For flows on supported protocols with L7 trigger events, it is recommended to call the Application(name).commit() method, which collects a larger set of protocol metrics.

The turnTiming flag is set to false by default. If set to true, the ExtraHop system collects additional turn timing metrics for the flow. If this flag is omitted, no turn timing metrics are recorded for the application on the associated flow. Turn timing analysis analyzes L4 behavior in order to infer L7 processing times when the monitored protocol follows a client-request, server-response pattern and in which the client sends the first message. "Banner" protocols (where the server sends the first message) and protocols where data flows in both directions concurrently are not recommended for turn timing analysis.

• The maximum length is 256 characters
• A separate capture is created for each flow.
• Capture files with the same name are differentiated by timestamps.

The following is an example of Flow.captureStart():

You can call this method only on FLOW_RECORD events, and each unique record is committed only once for built-in records.

To view the properties committed to the record object, see the record property below.

You can call this method only on FLOW_RECORD events, and each unique record is committed only once for built-in records.

To view the properties committed to the record object, see the record property below.

The Flow object properties and methods discussed in this section are available to every L7 trigger event associated with the flow.

By default, the ExtraHop system uses loosely-initiated protocol classification, so it will try to classify flows even after the connection was initiated. Loose initiation can be turned off for ports that do not always carry the protocol traffic (for example, the wildcard port 0). For such flows, device1, port1, and ipaddr1 represent the device with the numerically lower IP address and device2, port2, and ipaddr2 represent the device with the numerically higher IP address.

Access only on FLOW_TICK, FLOW_TURN, or FLOW_RECORD events or an error will occur.

Access only on FLOW_TICK, FLOW_TURN, or FLOW_RECORD events or an error will occur.

The value is zero for each entry that has no bytes of the specific DSCP since the last FLOW_TICK event.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

The value is zero for each entry that has no bytes of the specific DSCP since the last FLOW_TICK event.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

See the dscpName property in the Endpoints section for a list of supported DSCP code names.

See the dscpName property in the Endpoints section for a list of supported DSCP code names.

The value is zero for each entry that has no packets of the specific DSCP since the last FLOW_TICK event.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

The value is zero for each entry that has no packets of the specific DSCP since the last FLOW_TICK event.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

This condition may be detected in the TCP_CLOSE event and in any impacted L7 events (for example, HTTP_REQUEST or DB_RESPONSE).

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

This property is not valid during TCP_OPEN events.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on TCP_PAYLOAD, UDP_PAYLOAD, and SSL_PAYLOAD events or an error will occur.

Access only on TCP_PAYLOAD, UDP_PAYLOAD, or SSL_PAYLOAD events or an error will occur.

Access only on FLOW_TICK, FLOW_TURN, or FLOW_RECORD events or an error will occur.

Access only on FLOW_TICK, FLOW_TURN, or FLOW_RECORD events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

The object represents traffic sent in a single direction from one of two devices in the flow; the other device is represented by the record2 property. The device represented by the record1 property remains consistent for the flow.

Access the record object only on FLOW_RECORD events or an error will occur.

The record object contains the following default properties:

• age
• bytes (L3)
• dscpName
• first
• last
• pkts
• proto
• senderAddr
• senderPort
• receiverAddr
• receiverPort
• tcpFlags

The object represents traffic sent in a single direction from one of two devices in the flow; the other device is represented by the record1 property. The device represented by the record2 property remains consistent for the flow.

Access the record object only on FLOW_RECORD events or an error will occur.

The record object contains the following default properties:

• age
• bytes (L3)
• dscpName
• first
• last
• pkts
• proto
• senderAddr
• senderPort
• receiverAddr
• receiverPort
• tcpFlags

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

For events that occur on the same flow, you can apply the flow store instead of the session table to share information. For example:

Most flow store triggers should have a structure similar to the following example:

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

The FlowInterface class enables you to retrieve flow interface attributes and to add custom metrics at the interface level.

FlowInterface(id: string) A constructor for the FlowInterface object that accepts a flow interface ID. An error occurs if the flow interface ID does not exist on the ExtraHop appliance.

The methods in this section enable you to create custom metrics on a flow interface. The methods are present only on instances of the NetFlow class. For example, the following statement collects metrics from NetFlow traffic on the ingress interface:

However, you can call the FlowInterface method as a static method on NETFLOW_RECORD events. For example, the following statement collects metrics from NetFlow traffic on both the ingress and egress interfaces:

id: String A string that uniquely identifies the flow interface. number: Number The flow interface number reported by the NetFlow record.

The FlowNetwork class enables you to retrieve flow network attributes and to add custom metrics at the flow network level.

FlowNetwork(id: string) A constructor for the FlowNetwork object that accepts a flow network ID. An error occurs if the flow network ID does not exist on the ExtraHop appliance.

The methods in this section enable you to create custom metrics on a flow network. The methods are present only on instances of the NetFlow class. For example, the following statement collects metrics from NetFlow traffic on an individual network:

However, you can call the FlowNetwork method as a static method on NETFLOW_RECORD events. For example, the following statement collects metrics from NetFlow traffic on both devices on the flow network:

id: String A string that uniquely identifies the flow network. ipaddr: IPAddress The IP address of the management interface on the flow network.

The GeoIP class enables you to retrieve the approximate country-level or city-level location of a specific address.

Values returned by GeoIP methods are obtained from the MaxMind GeoLite2 Country database or the MaxMind GeoLite2 City database unless configured otherwise by the Geomap Data Source settings in the ExtraHop Admin UI.

From the Geomap Data Source settings, you can upload custom databases and specify which database to reference by default for city or country lookups.

We recommend uploading only a custom city-level database if you intend to call both GeoIP.getCountry() and GeoIP.getPreciseLocation() methods in triggers. If both types of custom databases are uploaded, the ExtraHop system retrieves values for both methods from the city-level database and ignores the country-level database, which is considered to be a subset of the city-level database.

Returns null in any field for which no data is available, or returns a null object if all field data is unavailable.

In the following code example, the getCountry() method is called on each specified event and retrieves rough location data for each client IP address:

Returns null in any field for which no data is available, or returns a null object if all field data is unavailable.

The IPAddress class enables you to retrieve IP address attributes. The IPAddress class is also available as a property for the Flow class.

IPAddress (ip: String | Number, [mask: Number]) Constructor for the IPAddress class that takes two parameters: ip: String The IP address string in CIDR format. mask: Number The subnet mask in a numerical format, representing the number of leftmost '1' bits in the mask (optional).

equals (equals: IPAddress): Boolean Performs an equality test between IPAddress objects as shown in the following example:if (Flow.client.ipaddr.toString() === "10.10.10.10") { // perform a task } mask (mask: Number): IPAddress Sets the subnet mask of the IPAddress object as shown in the following example:if ((Flow.ipaddr1.mask(24).toString() === "173.194.33.0")|| (Flow.ipaddr2.mask(24).toString() === "173.194.33.0")) {Flow.setApplication("My L4 App");}

The mask parameter specifies the subnet mask in a numerical format, representing the number of leftmost '1' bits in the mask (optional).

hostNames: Array of Strings An array of hostnames associated with the IPAddress. isBroadcast: Boolean The value is true if the IP address is a broadcast address. isExternal: Boolean The value is true if the IP address is external to your network. isLinkLocal: Boolean The value is true if the IP address is a link local address such as (169.254.0.0/16). isMulticast: Boolean The value is true if the IP address is a multicast address. isRFC1918: Boolean The value is true if the IP address belongs to one of the RFC1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). The value is always false for IPv6 addresses. isV4: Boolean The value is true if the IP address is an IPv4 address. isV6: Boolean The value is true if the IP address is an IPv6 address.

The Network class enables you to add custom metrics at the global level.

metricAddCount (metric_name: String, count: Number, [options: Object]):void Creates a custom top-level count metric. Commits the metric data to the specified network. metric_name: String The name of the top-level count metric. count: Number The increment value. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following property: highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true. metricAddDetailCount (metric_name: String, key: String | IPAddress, count: Number, [options: Object]):void Creates a custom detail count metric by which you can drill down. Commits the metric data to the specified network. metric_name: String The name of the detail count metric. key: String | IPAddress The key specified for the detail metric. A null value is silently discarded. count: Number The increment value. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following property: highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true. metricAddDataset (metric_name: String, val: Number, [options: Object]):void Creates a custom top-level dataset metric. Commits the metric data to the specified network. metric_name: String The name of the top-level dataset metric. val: Number The observed value, such as a processing time. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following properties: freq: Number An option that enables you to simultaneously record multiple occurrences of particular values in the dataset when set to the number of occurrences specified by the val parameter. If no value is specified, the default value is 1. highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true. metricAddDetailDataset (metric_name: String, key: String | IPAddress, val: Number, [options: Object]):void Creates a custom detail dataset metric by which you can drill down. Commits the metric data to the specified network. metric_name: String The name of the detail count metric. key: String | IPAddress The key specified for the detail metric. A null value is silently discarded. val: Number The observed value, such as a processing time. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following properties: freq: Number An option that enables you to simultaneously record multiple occurrences of particular values in the dataset when set to the number of occurrences specified by the val parameter. If no value is specified, the default value is 1. highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true. metricAddDistinct (metric_name: String, item: Number | String | IPAddress:void Creates a custom top-level distinct count metric. Commits the metric data to the specified network. metric_name: String The name of the top-level distinct count metric. item: Number | String | IPAddress The value to be placed into the HyperLogLog set specified by the metric_name parameter. The value is converted to a string before it is placed in the HyperLogLog set. metricAddDetailDistinct (metric_name: String, key: String | IPAddress, item: Number | String | IPAddress:void Creates a custom detail distinct count metric by which you can drill down. Commits the metric data to the specified network. metric_name: String The name of the detail distinct count metric. key: String | IPAddress The key specified for the detail metric. A null value is silently discarded. item: Number | String | IPAddress The value to be placed into the HyperLogLog set specified by the metric_name parameter. The value is converted to a string before it is placed in the HyperLogLog set. metricAddMax (metric_name: String, val: Number, [options: Object]):void Creates a custom top-level maximum metric. Commits the metric data to the specified network. metric_name: String The name of the top-level maximum metric. val: Number The observed value, such as a processing time. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following properties: highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true. metricAddDetailMax (metric_name: String, key: String | IPAddress, val: Number, [options: Object]):void Creates a custom detail maximum metric by which you can drill down. Commits the metric data to the specified network. metric_name: String The name of the detail maximum metric. key: String | IPAddress The key specified for the detail metric. A null value is silently discarded. val: Number The observed value, such as a processing time. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following properties: highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true. metricAddSampleset (metric_name: String, val: Number, [options: Object]):void Creates a custom top-level sampleset metric. Commits the metric data to the specified network. metric_name: String The name of the top-level sampleset metric. val: Number The observed value, such as a processing time. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following properties: highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true. metricAddDetailSampleset (metric_name: String, key: String | IPAddress, val: Number, [options: Object]):void Creates a custom detail sampleset metric by which you can drill down. Commits the metric data to the specified network. metric_name: String The name of the detail sampleset metric. key: String | IPAddress The key specified for the detail metric. A null value is silently discarded. val: Number The observed value, such as a processing time. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following properties: highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true. metricAddSnap (metric_name: String, count: Number, [options: Object]):void Creates a custom top-level snapshot metric. Commits the metric data to the specified network. metric_name: String The name of the top-level snapshot metric. count: Number The observed value, such as current established connections. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following properties: highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true. metricAddDetailSnap (metric_name: String, key: String | IPAddress, count: Number, [options: Object]):void Creates a custom detail snapshot metric by which you can drill down. Commits the metric data to the specified network. metric_name: String The name of the detail sampleset metric. key: String | IPAddress The key specified for the detail metric. A null value is silently discarded. count: Number The observed value, such as current established connections. Must be a non-zero, positive signed 64-bit integer. A NaN value is silently discarded. options: Object An optional object that can contain the following properties: highPrecision: Boolean A flag that enables one-second granularity for the custom metric when set to true.

The Session class provides access to the session table. It is designed to support coordination across multiple independently executing triggers. The session table's global state means any changes by a trigger or external process become visible to all other users of the session table. Because the session table is in-memory, changes are not saved when you restart the ExtraHop appliance or the capture process.

Here are some important things to know about session tables:

• The session table supports ordinary JavaScript values, enabling you to add JS objects to the table.
• Session table entries can be evicted when the table grows too large or when the configured expiration is reached.
• The ExtraHop Command appliance cluster nodes do not share their global states. The ECA does not run triggers; it only manages them.
• The ExtraHop Open Data Context API exposes the session table via the management network, enabling coordination with external processes through the memcache protocol.

The Session class is not limited only to the SESSION_EXPIRE event. You can apply the Session class to any ExtraHop event.

The SESSION_EXPIRE event is not associated with any particular flow, so triggers on SESSION_EXPIRE events cannot commit device metrics through Device.metricAdd*() methods or Flow.client.device.metricAdd*() methods. To commit device metrics on this event, you must add Device objects to the session table through the Device() instance method.

add(key: String, value*, [options: Object]): * Adds the specified key in the session table. If the key is present, the corresponding value is returned without modifying the key entry in the table. If the key is not present, a new entry is created for the key and value, and the new value is returned.

You can configure an Options object for the specified key.

If changes to the Options object are included, the key options are updated. and old options are merged with new ones. If the expire option is modified, the expiration timer is reset.

If changes to the Options object is included, the key options are updated, and old options are merged with new ones. If the expire option is provided, the expiration timer is reset.

expire: Number The duration after which eviction occurrs, expressed in seconds. If the value is null or undefined, the entry is evicted only when the session table grows too large. notify: Boolean Indicates whether the key is available on SESSION_EXPIRE events. The default value is false. priority: String Priority level that determines which entries to evict if the session table grows too large. Valid values are PRIORITY_LOW, PRIORITY_NORMAL, and PRIORITY_HIGH. The default value is PRIORITY_NORMAL.

PRIORITY_LOW: Number Default value is 0. PRIORITY_NORMAL: Number Default value is 1. PRIORITY_HIGH: Number Default value is 2.

expiredKeys :Array An array of objects with the following properties: age: Number The age of the expired object, expressed in milliseconds. Age is the amount of time elapsed between when the object in the session table was added or modified, and the SESSION_EXPIRE event. The age determines whether the key was evicted or expired. name: String The key of the expired object. value: Number | String | IPAddress | Boolean | Device The value of the entry in the session table.

Expired keys include keys that were evicted because the table grew too large.

The expiredKeys property can be accessed only on SESSION_EXPIREevents or an error will occur.

• Example: Record data to a session table

The System class enables you to retrieve information about the ExtraHop Discover appliance on which a trigger is running. This information in useful in environments with multiple Discover appliances.

uuid: string The universally unique identifier (UUID) of the ExtraHop Discover appliance. ipaddr: IPAddress The IPAddress object of the primary management interface (Interface 1) on the ExtraHop Discover appliance. hostname: string The hostname for the ExtraHop Discover appliance configured in the ExtraHop Admin UI.

The ThreatIntel class enables you to see whether threats have been found for IP addresses, hostnames, or URIs. (ExtraHop Reveal(x) Premium and Ultra only)

hasIP(address: IPAddress): boolean The value is true if the threats have been found for the specified IP address. If no intelligence information is available on the appliance, the value is null. hasDomain(domain: String): boolean The value is true if the threats have been found for the specified domain. If no intelligence information is available on the appliance, the value is null. hasURI(uri: String): boolean The value is true if the threats have been found for the specified URI. If no intelligence information is available on the appliance, the value is null.

isAvailable: boolean The value is true if threat intelligence information is available on this appliance.

The Trigger class enables you to access details about a running trigger.

isDebugEnabled: boolean The value is true if debugging is enabled for the trigger. The value is determined by the state of the Enable debug log checkbox in the Edit Trigger pane in the ExtraHop Web UI.

The VLAN class represents a VLAN on the network.

id: Number The numerical ID for a VLAN.

The Trigger API classes in this section enable you to access properties and record metrics from protocol, message, and flow activity that occurs on the ExtraHop appliance.

The AAA (Authentication, Authorization, and Accounting) class enables you to store metrics and access properties on AAA_REQUEST or AAA_RESPONSE events.

AAA_REQUEST Runs when the ExtraHop system finishes processing an AAA request . AAA_RESPONSE Runs on every AAA response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either an AAA_REQUEST or AAA_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed on each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

authenticator: String The value of the authenticator field (RADIUS only). avps:Array avpLength: Number The size of the AVP, expressed in bytes. This value includes the AVP header data, as well as the value. id: Number The numeric ID of the attribute represented as an integer. isGrouped: Boolean The value is true if this is a grouped AVP (Diameter only). name: String The name for the given AVP. vendor: String The vendor name for vendor AVPs (Diameter only). value: String | Array | Number For single AVPs, a string or numeric value. For grouped AVPs (Diameter only), an array of objects. isDiameter: Boolean The value is true if the request or response is Diameter. isError: Boolean The value is true if the response is an error. To retrieve the error details in Diameter, check AAA.statusCode. To retrieve the error details in RADIUS, check the AVP with code 18 (Reply-Message).

Access only on AAA_RESPONSE events or an error will occur.

Access only on AAA_RESPONSE events or an error will occur.

The following table contains valid Diameter command codes:

The following table contains valid RADIUS command codes:

Access only on AAA_RESPONSE events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on AAA_REQUEST events or an error will occur.

Access only on AAA_RESPONSE events or an error will occur.

Access only on AAA_RESPONSE events or an error will occur.

The ActiveMQ class enables you to store metrics and access properties on ACTIVEMQ_MESSAGE events. ActiveMQ is an implementation of the Java Messaging Service (JMS).

ACTIVEMQ_MESSAGE Runs on every JMS message processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an ACTIVEMQ_MESSAGE event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

correlationId: String The JMSCorrelationID field of the message. expiration: Number The JMSExpiration field of the message. msg: Buffer The message body. For TEXT_MESSAGE format messages, this returns the body of the message as a UTF-8 string. For all other message formats, this returns the raw bytes. msgFormat: String The message format. Possible values are:

• BYTES_MESSAGE
• MAP_MESSAGE
• MESSAGE
• OBJECT_MESSAGE
• STREAM_MESSAGE
• TEXT_MESSAGE
• BLOG_MESSAGE

• 0 is the lowest priority.
• 9 is the highest priority.
• 0-4 are gradations of normal priority.
• 5-9 are gradations of expedited priority.

The record object contains the following default properties:

• correlationId
• expiration
• msgFormat
• msgId
• persistent
• priority
• queue
• receiverBytes
• receiverIsBroker
• receiverL2Bytes
• receiverPkts
• receiverRTO
• receiverZeroWnd
• redeliveryCount
• replyTo
• roundTripTime
• senderBytes
• senderIsBroker
• senderL2Bytes
• senderPkts
• senderRTO
• senderZeroWnd
• timeStamp
• totalMsgLength

Apache JServ Protocol (AJP) proxies inbound requests from a web server to an application server and is often applied to load-balanced environments where one or more front-end web servers feed requests into one or more application servers. The AJP class enables you to store metrics and access properties on AJP_REQUEST and AJP_RESPONSE events.

AJP_REQUEST Runs after the web server sends an AJP Forward Request message to a servlet container, and then transfers any subsequent request body. AJP_RESPONSE Runs after a servlet container sends an AJP End Response message to signal that the servlet container has finished processing an AJP Forward Request and has sent back the requested information.

commitRecord(): Void Commits a record object to the ExtraHop Explore appliance on an AJP_RESPONSE event. Record commits on AJP_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

attributes: Object An array of optional AJP attributes sent with the request, such as remote_user, auth_type, query_string, jvm_route, ssl_cert, ssl_cipher, and ssl_session.

Access only on AJP_REQUEST events or an error will occur.

The name of the server to which the HTTP client made the original request.

When accessed on AJP_RESPONSE events, an array of headers conveyed in the AJP Send Headers message by the server to the end user browser.

Access only on AJP_RESPONSE events or an error will occur.

The record object contains the following default properties:

• fwdReqClientAddr
• fwdReqHost
• fwdReqIsEncrypted
• fwdReqServerName
• fwdReqServerPort
• method
• processingTime
• protocol
• reqSize
• rspSize
• statusCode
• uri

Access only on AJP_RESPONSE events or an error will occur.

Access only on AJP_RESPONSE events or an error will occur.

Access only on AJP_RESPONSE events or an error will occur.

Access only on AJP_RESPONSE events or an error will occur.

Access only on AJP_RESPONSE events or an error will occur.

Access only on AJP_RESPONSE events or an error will occur.

Access only on AJP_RESPONSE events or an error will occur.

Access only on AJP_RESPONSE events or an error will occur.

Cisco Discovery Protocol (CDP) is a proprietary protocol that enables connected Cisco devices to send information to each other. The CDP class enables you to access properties on CDP_FRAME events.

CDP_FRAME Runs on every CDP frame processed by the device.

destination: String The destination MAC address. The most common destination is 01:00:0c:cc:cc:cc, indicating a multicast address. checksum: Number The CDP checksum. source: Device The device sending the CDP frame. ttl: Number The time to live, expressed in seconds. This is the length of time during which the information in this frame is valid, starting with when the information is received. tlvs: Array of Objects An array containing each type, length, value (TLV) field. A TLV field contains information such as the device ID, address, and platform. Each field is an object with the following properties: type: Number The type of TLV. value: Buffer The value of the TLV. version: Number The CDP protocol version.

The CIFS class enables you to store metrics and access properties on CIFS_REQUEST and CIFS_RESPONSE events.

CIFS_REQUEST Runs on every CIFS request processed by the device. CIFS_RESPONSE Runs on every CIFS response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on a CIFS_RESPONSE event. Record commits on CIFS_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

The buffer contains the N first bytes of the payload, where N is the number of payload bytes specified by the Bytes to Buffer field when the trigger was configured through the ExtraHop WebUI. The default number of bytes is 2048. For more information, see Advanced trigger options.

For larger volumes of payload bytes, the payload might be spread across a series of READ or WRITE commands so that no single trigger event contains the entire requested payload. You can reassemble the payload into a single, consolidated buffer through the Flow.store and payloadOffset properties.

Access only on CIFS_RESPONSE events or an error will occur.

The record object contains the following default properties:

• accessTime
• clientZeroWnd
• error
• isCommandCreate
• isCommandDelete
• isCommandFileInfo
• isCommandLock
• isCommandRead
• isCommandRename
• isCommandWrite
• method
• processingTime
• reqSize
• reqXfer
• resource
• rspBytes
• rspXfer
• serverZeroWnd
• share
• statusCode
• user
• warning

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_REQUEST events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

Access only on CIFS_RESPONSE events or an error will occur.

• Example: Monitor CIFS actions on devices

The DB, or database, class enables you to store metrics and access properties on DB_REQUEST and DB_RESPONSE events.

DB_REQUEST Runs on every database request processed by the device. DB_RESPONSE Runs on every database response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on a DB_RESPONSE event. Record commits on DB_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

appName: String The client application name, which is extracted only for MS SQL connections. correlationId: Number The correlation ID for DB2 applications. The value is null for non-DB2 applications. database: String The database instance. In some cases, such as when login events are encrypted, the database name is not available. error: String The detailed error messages recorded by the ExtraHop system in string format. If there are multiple errors in one response, the errors are concatenated into one string.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

The array contains each of the following parameters:

The value of the params property is the same when accessed on either the DB_REQUEST or the DB_RESPONSE event.

Access only on DB_RESPONSE events or an error will occur.

The record object contains the following default properties:

• appName
• clientZeroWnd
• correlationId
• database
• error
• isReqAborted
• isRspAborted
• method
• procedure
• reqSize
• reqTimeToLastByte
• rspSize
• rspTimeToFirstByte
• rspTimeToLastByte
• processingTime
• serverZeroWnd
• statement
• table
• user

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

Access only on DB_RESPONSE events or an error will occur.

• Sybase
• Sybase IQ
• MySQL
• PostgreSQL
• IBM Informix
• MS SQL TDS
• Oracle TNS
• DB2

Returns an empty field if there is no table name in the request.

The DHCP class enables you to store metrics and access properties on DHCP_REQUEST and DHCP_ RESPONSE events.

DHCP_REQUEST Runs on every DHCP request processed by the device. DHCP_RESPONSE Runs on every DHCP response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either a DHCP_REQUEST or DHCP_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed on each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

Returns null if the specified option code is not present in the message.

chaddr: String The client hardware address of the DHCP client. clientReqDelay: Number The time elapsed before the client attempts to acquire or renew a DHCP lease, expressed in seconds.

Access only on DHCP_REQUEST events or an error will occur.

Access only on DHCP_RESPONSE events or an error will occur.

• DHCPDISCOVER
• DHCPOFFER
• DHCPREQUEST
• DHCPDECLINE
• DHCPACK
• DHCPNAK
• DHCPRELEASE
• DHCPINFORM
• DHCPFORCERENEW
• DHCPLEASEQUERY
• DHCPLEASEUNASSIGNED
• DHCPLEASEUNKNOWN
• DHCPLEASEACTIVE
• DHCPBULKLEASEQUERY
• DHCPLEASEQUERYDONE

Access only on DHCP_RESPONSE events or an error will occur.

Access only on DHCP_RESPONSE events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on DHCP_RESPONSE events or an error will occur.

Access only on DHCP_RESPONSE events or an error will occur.

Access only on DHCP_RESPONSE events or an error will occur.

Access only on DHCP_RESPONSE events or an error will occur.

Access only on DHCP_RESPONSE events or an error will occur.

Access only on DHCP_RESPONSE events or an error will occur.

The DICOM (Digital Imaging and Communications in Medicine) class enables you to store metrics and access properties on DICOM_REQUEST and DICOM_ RESPONSE events.

DICOM_REQUEST Runs on every DICOM request processed by the device. DICOM_RESPONSE Runs on every DICOM response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on a DICOM_REQUEST or DICOM_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed on each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

The data element is represented by a unique ordered pair of integers that represent the group tag and element tag numbers. For example, the ordered pair "0008, 0008" represents the "image type" element. A Registry of DICOM Data Elements and defined tags is available at dicom.nema.org.

calledAETitle: String The application entity (AE) title of the destination device or program. callingAETitle: String The application entity (AE) title of the source device or program. elements: Array An array of presentation data values (PDV) command elements and data elements that comprise a DICOM message. error: String The detailed error message recorded by the ExtraHop system. isReqAborted: Boolean Returns The value is true if the connection is closed before the DICOM request is complete.

Access only on DICOM_REQUEST events or an error will occur.

Access only on DICOM_RESPONSE events or an error will occur.

Access only on DICOM_RESPONSE events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on DICOM_REQUEST events or an error will occur.

The number of L2 request bytes, including L2 headers.

Access only on DICOM_REQUEST events or an error will occur.

Access only on DICOM_REQUEST events or an error will occur.

Access only on DICOM_RESPONSE events or an error will occur.

Access only on DICOM_RESPONSE events or an error will occur.

Access only on DICOM_RESPONSE events or an error will occur.

Access only on DICOM_RESPONSE events or an error will occur.

Access only on DICOM_RESPONSE events or an error will occur.

The DNS class enables you to store metrics and access properties on DNS_REQUEST and DNS_RESPONSE events.

DNS_REQUEST Runs on every DNS request processed by the device. DNS_RESPONSE Runs on every DNS response processed by the device.

answersInclude(term: String | IPAddress): Boolean Returns true if the specified term is present in a DNS response. For string terms, the method checks both the name and data record in the answer section of the response. For IPAddress terms, the method checks only the data record in the answer section.

Can be called only on DNS_RESPONSE events.

The event determines which properties are committed to the record object. To view the default properties committed on each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

answers: Array An array of objects that correspond to answer resource records.

Access only on DNS_RESPONSE events or an error will occur.

The objects contain the following properties:

• A
• AAAA
• NS
• PTR
• CNAME
• MX
• SRV
• SOA
• TXT

Returns OTHER for error codes that are unrecognized by the system; however, errorNum specifies the numeric code value.

Access only on DNS_RESPONSE events or an error will occur.

Access only on DNS_RESPONSE events or an error will occur.

Access only on DNS_RESPONSE events or an error will occur.

Access only on DNS_RESPONSE events or an error will occur.

Access only on DNS_REQUEST events or an error will occur.

Access only on DNS_RESPONSE events or an error will occur.

Access only on DNS_REQUEST events or an error will occur.

Access only on DNS_REQUEST events or an error will occur.

Access only on DNS_RESPONSE events or an error will occur.

Returns OTHER for codes that are unrecognized by the system; however, the opcodeNum property specifies the numeric code value.

Access only on DNS_RESPONSE events or an error will occur.

Returns OTHER for types that are unrecognized by the system; however, the qtypeNum property specifies the numeric type value.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on DNS_REQUEST events or an error will occur.

Access only on DNS_REQUEST events or an error will occur.

Access only on DNS_REQUEST events or an error will occur.

Access only on DNS_RESPONSE events or an error will occur.

Access only on DNS_RESPONSE events or an error will occur.

Access only on DNS_RESPONSE events or an error will occur.

The FIX class enables you to store metrics and access properties on FIX_REQUEST and FIX_RESPONSE events.

FIX_REQUEST Runs on every FIX request processed by the device. FIX_RESPONSE Runs on every FIX response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either a FIX_REQUEST or FIX_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed for each event see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

fields: Array A list of FIX fields. Because they are text-based, the key-value protocol fields are exposed as an array of objects with name and value properties containing strings. For example:8=FIX.4.2<SOH>9=233<SOH>35=G<SOH>34=206657...

translates to:

Key string representation is translated, if possible. With extensions, a numeric representation is used. For example, it is not possible to determine 9178=0 (as seen in actual captures). The key is instead translated to "9178". Fields are extracted after message length and version fields are extracted all the way to the checksum (last field). The checksum is not extracted.

In the following example, the trigger debug(JSON.stringify(FIX.fields)); shows the following fields:

To debug and print all FIX fields, enable debugging on the trigger and enter the following code:

The following output is display in the trigger's Debug Log:

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

The FTP class enables you to store metrics and access properties on FTP_REQUEST and FTP_RESPONSE events.

FTP_REQUEST Runs on every FTP request processed by the device. FTP_RESPONSE Runs on every FTP response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an FTP_RESPONSE event. Record commits on FTP_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

args: String The arguments to the command.

Access only on FTP_RESPONSE events or an error will occur.

• The value is / when method == "CWD".
• The value is /subdir for subsequent commands (rather than CWD becoming the changed to directory as part of the CWD response trigger).

Includes "..." at the beginning of the path in the event of a resync or the path is truncated.

Includes "..." at the end of the path if the path is too long. Path truncates at 4096 characters.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

The record object contains the following default properties:

• args
• clientZeroWnd
• cwd
• error
• isReqAborted
• isRspAborted
• method
• path
• processingTime
• reqBytes
• reqL2Bytes
• reqPkts
• reqRTO
• roundTripTime
• rspBytes
• rspL2Bytes
• rspPkts
• rspRTO
• serverZeroWnd
• statusCode
• transferBytes
• user

Access the record object only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

Access only on FTP_RESPONSE events or an error will occur.

The following codes are valid:

Access only on FTP_RESPONSE events or an error will occur.

The HL7 class enables you to store metrics and access properties on HL7_REQUEST and HL7_RESPONSE events.

HL7_REQUEST Runs on every HL7 request processed by the device. HL7_RESPONSE Runs on every HL7 response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an HL7_RESPONSE event. Record commits on HL7_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

ackCode: String The two character acknowledgment code.

Access only on HL7_RESPONSE events or an error will occur.

Access only on HL7_RESPONSE events or an error will occur.

Access only on HL7_RESPONSE events or an error will occur.

The record object contains the following default properties:

• ackCode
• ackId
• clientZeroWnd
• msgId
• msgType
• roundTripTime
• processingTime
• serverZeroWnd
• version

Access the record object only on HL7_RESPONSE events or an error will occur.

Access only on HL7_RESPONSE events or an error will occur.

The HTTP class enables you to store metrics and access properties on HTTP_REQUEST and HTTP_RESPONSE events.

HTTP_REQUEST Runs on every HTTP request processed by the device. HTTP_RESPONSE Runs on every HTTP response processed by the device.

Additional payload options are available when you create a trigger that runs on either of these events. See Advanced trigger options for more information.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an HTTP_RESPONSE event. Record commits on HTTP_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

age: Number For HTTP_REQUEST events, the time from the first byte of the request until the last seen byte of the request. For HTTP_RESPONSE events, the time from the first byte of the request until the last seen byte of the response. The time is expressed in milliseconds. Specifies a valid value on malformed and aborted requests. The value is NaN on expired requests and responses, or if the timing is invalid. contentType: String The value of the content-type HTTP header. cookies: Array An array of objects that represents cookies and contains properties such as "domain" and "expires." The properties correspond to the attributes of each cookie as shown in the following example:var cookies = HTTP.cookies, cookie, i; for (i = 0; i < cookies.length; i++) { cookie = cookies[i]; if (cookie.domain) { debug("domain: " + cookie.domain); } } headers: Object An array-like object that enables access to HTTP header names and values. Header information is available through one of the following properties: length: Number The number of headers. string property: The name of the header, accessible in a dictionary-like fashion, as shown in the following example:var headers = HTTP.headers; session = headers["X-Session-Id"]; accept = headers.accept; numeric property: Corresponds to the order in which the headers appear on the wire. The returned object has a name and a value property. Numeric properties are useful for iterating over all the headers and disambiguating headers with duplicate names as shown in the following example:var headers = HTTP.headers; for (i = 0; i < headers.length; i++) { hdr = headers[i]; debug("headers[" + i + "].name: " + hdr.name); debug("headers[" + i + "].value: " + hdr.value); }

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

The buffer contains the N first bytes of the payload, where N is the number of payload bytes specified by the Bytes to Buffer field when the trigger was configured through the ExtraHop WebUI. The default number of bytes is 2048. For more information, see Advanced trigger options.

The following script is an example of HTTP payload analysis:

Access only on HTTP_RESPONSE events or an error will occur.

The record object contains the following default properties:

• clientZeroWnd
• contentType
• host
• isPipelined
• isReqAborted
• isRspAborted
• isRspChunked
• isRspCompressed
• method
• origin
• query
• referer
• reqBytes
• reqL2Bytes
• reqPkts
• reqRTO
• reqSize
• reqTimeToLastByte
• roundTripTime
• rspBytes
• rspL2Bytes
• rspPkts
• rspRTO
• rspSize
• rspTimeToFirstHeader
• rspTimeToFirstPayload
• rspTimeToLastByte
• rspVersion
• serverZeroWnd
• statusCode
• thinkTime
• title
• processingTime
• uri
• userAgent

Access the record object only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

Access only on HTTP_RESPONSE events or an error will occur.

The IBMMQ class enables you to store metrics and access properties on IBMMQ_REQUEST and IBMMQ_ RESPONSE events.

IBMMQ_REQUEST Runs on every IBMMQ request processed by the device. IBMMQ_RESPONSE Runs on every IBMMQ response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either an IBMMQ_REQUEST or IBMMQ_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

channel: String The communication channel name. conversationID: Number The identifier for the MQ conversation. correlationId: String The IBMMQ correlation ID. error:String The error string that corresponds to the error code on the wire. method:String The wire protocol request or response method name.

The following ExtraHop method names differ from the Wireshark method names:

Queue messages that are greater than 32K might be broken into more than one segment. A trigger is run for each segment and only the first segment has a non-null message.

Buffer data can be converted to a printable string through the toString() function or formatted through unpack commands.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

• Example: Collect IBMMQ metrics

The ICA class enables you to store metrics and access properties on ICA_OPEN, ICA_AUTH, ICA_TICK, and ICA_ CLOSE events.

ICA_AUTH Runs when the ICA authentication is complete. ICA_CLOSE Runs when the ICA session is closed. ICA_OPEN Runs immediately after the ICA application is initially loaded. ICA_TICK Runs periodically while the user interacts with the ICA application.

After the ICA_OPEN event has run at least once, the ICA_TICK event is run anytime latency is reported and returned by the clientLatency or networkLatency properties described below.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either an ICA_OPEN, ICA_TICK, or ICA_CLOSE event. Record commits on ICA_AUTH events are not supported.

The event determines which properties are committed to the record object. To view the default properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

application: String The name of the application being launched. authDomain: String The Windows authentication domain to which the user belongs. channels: Array An array of objects containing information about virtual channels observed since the last ICA_TICK event.

Access only on ICA_TICKevents or an error will occur.

Each object contains the following properties:

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Client latency is reported when a packet from the client on the EUEM channel reports the result of a single ICA round trip measurement.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

The value is null if the ICA_TICK event did not result from a clipboard data transfer, or if the channel specified by the tickChannel property is not a clipboard channel.

The maximum number of bytes in the buffer is specified by the Clipboard Bytes to Buffer field when the trigger was configured through the ExtraHop Web UI. The default maximum object size is 1024 bytes. For more information, see the Advanced trigger options.

To determine the direction of the clipboard data transfer, access this property through Flow.sender, Flow.receiver, Flow.client, or Flow.server.

Access only on ICA_TICK events or an error will occur.

• TEXT
• BITMAP
• METAFILEPICT
• SYMLINK
• DIF
• TIFF
• OEMTEXT
• DIB
• PALLETTE
• PENDATA
• RIFF
• WAVE
• UNICODETEXT
• EHNMETAFILE
• OWNERDISPLAY
• DSPTEXT
• DSPBITMAP
• DSPMETAFILEPICT
• DSPENHMETAFILE

The value is null if the ICA_TICK event did not result from a clipboard data transfer, or if the channel specified by the tickChannel property is not a clipboard channel.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_CLOSE events or an error will occur.

Access only on ICA_CLOSE events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_OPEN, ICA_CLOSE, or ICA_TICK events or an error will occur.

Network latency is reported when a specific ICA packet from the client contains latency information.

Access only on ICA_TICK events or an error will occur.

The buffer contains the N first bytes of the payload, where N is the number of payload bytes specified by the Bytes to Buffer field when the trigger was configured through the ExtraHop WebUI. The default number of bytes is 2048. For more information, see Advanced trigger options.

The value is null if the channel specified by the tickChannel property is not a file channel.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access the record object only on ICA_OPEN, ICA_CLOSE, and ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

Access only on ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

Access only on ICA_CLOSE or ICA_TICK events or an error will occur.

• CTXCLI: clipboard
• CTXCDM: file
• CTXEUE: end user experience monitoring

Access only on ICA_TICK events or an error will occur.

The ICMP class enables you to store metrics and access properties on ICMP_MESSAGE events.

ICMP_MESSAGE Runs on every ICMP message processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an ICMP_MESSAGE event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

gwAddr: IPAddress For a redirect message, returns the address of the gateway to which traffic for the network specified in the internet destination network field of the original datagram's data should be sent. Returns null for all other messages.

The following running config example changes the ICMP message_length_ max from its default of 4096 bytes to 1234 bytes:

The following table displays type IDs for the ICMP messages:

The following table displays the ICMPv4 message types available:

The following table displays the ICMPv6 message types available:

The value is null if the internet header and 64 bits of the Original Data datagram is not present in the message or if the IP protocol is not TCP or UDP.

Access only on ICMP_MESSAGE events or an error will occur.

The record object contains the following default properties:

• gwAddr
• hopLimit
• msgCode
• msgId
• msgLength
• msgText
• msgType
• nextHopMTU
• pointer
• seqNum
• version

The Kerberos class enables you to store metrics and access properties on KERBEROS_REQUEST and KERBEROS_ RESPONSE events.

KERBEROS_REQUEST Runs on every Kerberos AS-REQ and TGS-REQ message type processed by the device. KERBEROS_RESPONSE Runs on every Kerberos AS-REP and TGS-REP message type processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either a KERBEROS_REQUEST or KERBEROS_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

addresses: Array of Objects The addresses from which the requested ticket is valid.

Access only on KERBEROS_REQUEST events or an error will occur.

Access only on KERBEROS_RESPONSE events or an error will occur.

Access only on KERBEROS_REQUEST events or an error will occur.

Access only on KERBEROS_REQUEST events or an error will occur.

Access only on KERBEROS_REQUEST events or an error will occur.

• AP_REP
• AP_REQ
• AS_REP
• AS_REQAUTHENTICATOR
• ENC_AS_REP_PART
• ENC_KRB_CRED_PART
• ENC_KRB_PRIV_PART
• ENC_P_REP_PART
• ENC_TGS_REP_PART
• ENC_TICKET_PART
• KRB_CRED
• KRB_ERROR
• KRB_PRIV
• KRB_SAFE
• TGS_REP
• TGS_REQ
• TICKET

Access only on KERBEROS_RESPONSE events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on KERBEROS_REQUEST events or an error will occur.

The LDAP class enables you to store metrics and access properties on LDAP_REQUEST and LDAP_RESPONSE events.

LDAP_REQUEST Runs on every LDAP request processed by the device. LDAP_RESPONSE Runs on every LDAP response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either an LDAP_REQUEST or LDAP_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

bindDN: String The bind DN of the LDAP request.

Access only on LDAP_REQUEST events or an error will occur.

Access only on LDAP_RESPONSE events or an error will occur.

Access only on LDAP_RESPONSE events or an error will occur.

• BindRequest
• SearchRequest
• ModifyRequest
• AddRequest
• DelRequest
• ModifyDNRequest
• CompareRequest
• ExtendedRequest

Applies only to LDAP_RESPONSE events.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on LDAP_REQUEST events or an error will occur.

Access only on LDAP_REQUEST events or an error will occur.

Access only on LDAP_REQUEST events or an error will occur.

The LLDP class enables you to access properties on LLDP_FRAME events.

LLDP_FRAME Runs on every LLDP frame processed by the device.

chassisId: Buffer The chassis ID, obtained from the chassisId data field, or type-length-value (TLV). chassisIdSubtype: Number The chassis ID subtype, obtained from the chassisID TLV. destination: String The destination MAC address. The destination MAC address. The most common destinations are 01-80-C2-00-00-00, 01-80-C2-00-00-03 and 01-80-C2-00-00-0E, indicating multicast addresses. optTLVs: Array An array containing the optional TLVs. Each TLV is an object with the following properties: customSubtype: Number The subtype of an organizationally specific TLV. isCustom: Boolean Returns true if the object is an organizationally specific TLV. oui: Number The organizationally unique identifier for organizationally specific TLVs. type: Number The type of TLV. value: String The value of the TLV. portId: Buffer The port ID, obtained from the portId TLV. portIdSubtype: Number The port ID subtype, obtained from the portId TLV. source: Device The device sending the LLDP frame. ttl: Number The time to live, expressed in seconds. This is the length of time during which the information in this frame is valid, starting with when the information is received.

The LLMNR class enables you to store metrics and access properties on LLMNR_REQUEST and LLMNR_RESPONSE events.

LLMNR_REQUEST Runs on every LLMNR request processed by the device. LLMNR_RESPONSE Runs on every LLMNR response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an LLMNR_REQUEST or LLMNR_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed on each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

answer: Object

An object that corresponds to an answer resource record.

Access only on LLMNR_RESPONSE events or an error will occur.

The objects contain the following properties:

• A
• AAAA
• NS
• PTR
• CNAME
• MX
• SRV
• SOA
• TXT

Returns OTHER for error codes that are unrecognized by the system; however, errorNum specifies the numeric code value.

Access only on LLMNR_RESPONSE events or an error will occur.

Access only on LLMNR_RESPONSE events or an error will occur.

Returns OTHER for codes that are unrecognized by the system; however, the opcodeNum property specifies the numeric code value.

Returns OTHER for types that are unrecognized by the system; however, the qtypeNum property specifies the numeric type value.

The event on which the method was called determines which default properties the record object contains, as displayed in the following table:

Access only on LLMNR_REQUEST events or an error will occur.

Access only on LLMNR_REQUEST events or an error will occur.

Access only on LLMNR_REQUEST events or an error will occur.

Access only on LLMNR_RESPONSE events or an error will occur.

Access only on LLMNR_RESPONSE events or an error will occur.

Access only on LLMNR_RESPONSE events or an error will occur.

The Memcache class enables you to store metrics and access properties on MEMCACHE_REQUEST and MEMCACHE_RESPONSE events.

MEMCACHE_REQUEST Runs on every memcache request processed by the device. MEMCACHE_RESPONSE Runs on every memcache response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either a MEMCACHE_REQUEST or MEMCACHE_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

accessTime: Number The access time, expressed in milliseconds. Available only if the first key that was requested produced a hit.

Access only on MEMCACHE_RESPONSE events or an error will occur.

Access only on MEMCACHE_RESPONSE events or an error will occur.

Access only on MEMCACHE_RESPONSE events or an error will occur.

Access only on MEMCACHE_REQUEST events or an error will occur.

Access only on MEMCACHE_RESPONSE events or an error will occur.

Access only on MEMCACHE_RESPONSE events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

The value of the reqKeys property is the same when accessed on either the MEMCACHE_REQUEST or the MEMCACHE_RESPONSE event.

Access only on MEMCACHE_REQUEST events or an error will occur.

The number of L7 request bytes, excluding Memcache headers. The value is NaN for requests with no payload, such as GET and DELETE.

Access only on MEMCACHE_RESPONSE events or an error will occur.

Access only on MEMCACHE_RESPONSE events or an error will occur.

• Example: Record Memcache hits and misses
• Example: Parse memcache keys

The Modbus class enables you to access properties from MODBUS_REQUEST and MODBUS_RESPONSE events. Modbus is a serial communications protocol that enables connections between multiple devices on the same network.

MODBUS_REQUEST Runs on every request sent by a Modbus client. A Modbus client in the ExtraHop system is the Modbus master device. MODBUS_RESPONSE Runs on every response sent by a Modbus server. A Modbus server in the ExtraHop system is the Modbus slave device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on a MODBUS_RESPONSE event. Record commits on MODBUS_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

error: String The detailed error message recorded by the ExtraHop system.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

The record object contains the following default properties:

• error
• functionId
• functionName
• protocolId
• reqL2Bytes
• rspL2Bytes
• reqPkts
• rspPkts
• reqBytes
• rspBytes
• reqRTO
• rspRTO
• roundTripTime
• clientZeroWnd
• serverZeroWnd
• statusCode
• txId
• unitId

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

The number of L4 response bytes, excluding L4 headers.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

Access only on MODBUS_RESPONSE events or an error will occur.

The MongoDB class enables you to store metrics and access properties on MONGODB_REQUEST and MONGODB_ RESPONSE events.

MONGODB_REQUEST Runs on every MongoDB request processed by the device. MONGODB_RESPONSE Runs on every MongoDB response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either a MONGODB_REQUEST or MONGODB_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

collection: String The name of the database collection specified in the current request. database: String The MongoDB database instance. In some cases, such as when login events are encrypted, the database name is not available. error: String The detailed error message recorded by the ExtraHop system.

Access only on MONGODB_RESPONSE events or an error will occur.

Access only on MONGODB_RESPONSE events or an error will occur.

Access only on MONGODB_RESPONSE events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

If BSON documents are truncated, isReqTruncated flag is set. Truncated values are represented as follows:

• Primitive string values like code, code with scope, and binary data are partially extracted.
• Objects and Arrays are partially extracted.
• All other primitive values like Numbers, Dates, RegExp, etc., are substituted with null.

If no documents are included in the request, an empty array is returned.

The value of the request property is the same when accessed on either the MONGODB_REQUEST or the MONGODB_RESPONSE event.

Access only on MONGODB_RESPONSE events or an error will occur.

Access only on MONGODB_RESPONSE events or an error will occur.

Access only on MONGODB_RESPONSE events or an error will occur.

The MSMQ class enables you to store metrics and access properties on MSMQ_MESSAGE events.

MSMQ_MESSAGE Runs on every MSMQ user message processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an MSMQ_MESSAGE event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

adminQueue: String The name of the administration queue of the message. correlationId: Buffer The application-generated correlation ID of the message. dstQueueMgr: String The destination message broker of the message. isEncrypted: Boolean The value is true if the payload is encrypted. label: String The label or description of the message. msgClass: String The message class of the message. The following values are valid:

• MQMSG_CLASS_NORMAL
• MQMSG_CLASS_ACK_REACH_QUEUE
• MQMSG_CLASS_NACK_ACCESS_DENIED
• MQMSG_CLASS_NACK_BAD_DST_Q
• MQMSG_CLASS_NACK_BAD_ENCRYPTION
• MQMSG_CLASS_NACK_BAD_SIGNATURE
• MQMSG_CLASS_NACK_COULD_NOT_ENCRYPT
• MQMSG_CLASS_NACK_HOP_COUNT_EXCEEDED
• MQMSG_CLASS_NACK_NOT_TRANSACTIONAL_MSG
• MQMSG_CLASS_NACK_NOT_TRANSACTIONAL_Q
• MQMSG_CLASS_NACK_PURGED
• MQMSG_CLASS_NACK_Q_EXCEEDED_QUOTA
• MQMSG_CLASS_NACK_REACH_QUEUE_TIMEOUT
• MQMSG_CLASS_NACK_SOURCE_COMPUTER_GUID_CHANGED
• MQMSG_CLASS_NACK_UNSUPPORTED_CRYPTO_PROVIDER
• MQMSG_CLASS_ACK_RECEIVE
• MQMSG_CLASS_NACK_Q_DELETED
• MQMSG_CLASS_NACK_Q_PURGED
• MQMSG_CLASS_NACK_RECEIVE_TIMEOUT
• MQMSG_CLASS_NACK_RECEIVE_TIMEOUT_AT_SENDER
• MQMSG_CLASS_REPORT

The record object contains the following default properties:

• adminQueue
• dstQueueMgr
• isEncrypted
• label
• msgClass
• msgId
• priority
• queue
• receiverBytes
• receiverL2Bytes
• receiverPkts
• receiverRTO
• receiverZeroWnd
• responseQueue
• roundTripTime
• senderBytes
• senderL2Bytes
• senderPkts
• senderRTO
• serverZeroWnd
• srcQueueMgr

The NetFlow class object enables you to store metrics and access properties on NETFLOW_RECORD events.

The ExtraHop Discover appliance can be licensed for the NetFlow module, which supports the following flow types:

• NetFlow version 5 (Cisco)
• NetFlow version 9 (Cisco)
• IPFIX (open standard based on RFC 5101)

NETFLOW_RECORD Runs upon receipt of a flow record from a flow network.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on a NETFLOW_RECORD event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

age: Number The amount of time elapsed, expressed in seconds, between the first and last property values reported in the NetFlow record. deltaBytes: Number The number of L3 bytes in the flow since the last NETFLOW_RECORD event. deltaPkts: Number The number of packets in the flow since the last NETFLOW_RECORD event. dscp: Number The number representing the last differentiated services code point (DSCP) value of the flow packet. dscpName: String The name associated with the DSCP value of the flow packet. The following table displays well-known DSCP names:

The record object contains the following default properties:

• age
• dscpName
• deltaBytes
• deltaPkts
• egressInterface
• first
• format
• ingressInterface
• last
• network
• networkAddr
• nextHop
• proto
• receiverAddr
• receiverAsn
• receiverPort
• receiverPrefixLength
• senderAddr
• senderAsn
• senderPort
• senderPrefixLength
• tcpFlagName
• tcpFlags

The NFS class enables you to store metrics and access properties on NFS_REQUEST and NFS_RESPONSE events.

NFS_REQUEST Runs on every NFS request processed by the device. NFS_RESPONSE Runs on every NFS response processed by the device

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an NFS_RESPONSE event. Record commits on NFS_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

accessTime: Number The amount of time taken by the server to access a file on disk, expressed in milliseconds. For NFS, it is the time from every non-pipelined READ and WRITE command in an NFS flow until the payload containing the response is recorded by the ExtraHop system. The value is NaN on malformed and aborted responses, or if the timing is invalid or is not applicable.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_REQUEST events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

The record object contains the following default properties:

• accessTime
• authMethod
• clientZeroWnd
• error
• isCommandFileInfo
• isCommandRead
• isCommandWrite
• isRspAborted
• method
• offset
• processingTime
• renameDirChanged
• reqSize
• reqXfer
• resource
• rspSize
• rspXfer
• serverZeroWnd
• statusCode
• txID
• user
• version

Access the record object only on NFS_RESPONSE events or an error will occur.

Access only on NFS_REQUEST events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_REQUEST events or an error will occur.

Access only on NFS_REQUEST events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

Access only on NFS_RESPONSE events or an error will occur.

The NTLM class enables you to store metrics and access properties on NTLM_MESSAGE events.

NTLM_MESSAGE Runs on every NTLM message processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an NTLM_MESSAGE event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

containsMIC: Boolean The value is true if the message includes a Message Integrity Code (MIC) that ensures that the message has not been tampered with. challenge: String The hexadecimal-encoded challenge hash string. domain: String The client domain name included in the challenge hash calculation. flags: Number The bitwise OR of the NTLM negotiate flags. For more information, see the NTLM documentation on the Microsoft website. msgType: String The type of NTLM message. The following message types are valid:

• NTLM_AUTH
• NTLM_CHALLENGE
• NTLM_NEGOTIATE

The record object contains the following default properties:

• challenge
• domain
• flags
• l7proto
• msgType
• proto
• receiverAddr
• receiverPort
• senderAddr
• senderPort
• user
• windowsVersion
• workstation

The POP3 class enables you to store metrics and access properties on POP3_REQUEST and POP3_RESPONSE events.

POP3_REQUEST Runs on every POP3 request processed by the device. POP3_RESPONSE Runs on every POP3 response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on a POP3_RESPONSE event. Record commits on POP3_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

dataSize: Number The size of the message, expressed in bytes.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

The record object contains the following default properties:

• clientZeroWnd
• dataSize
• error
• isEncrypted
• isReqAborted
• isRspAborted
• method
• processingTime
• recipientList
• reqSize
• reqTimeToLastByte
• rspSize
• rspTimeToFirstByte
• rspTimeToLastByte
• sender
• serverZeroWnd
• statusCode

Access the record object only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

Access only on POP3_RESPONSE events or an error will occur.

RDP (Remote Desktop Protocol) is a proprietary protocol created by Microsoft that enables a Windows computer to connect to another Windows computer on the same network or over the Internet. The RDP class enables you to store metrics and access properties on RDP_OPEN, RDP_CLOSE, or RDP_TICK events.

RDP_CLOSE Runs when an RDP connection is closed. RDP_OPEN Runs when a new RDP connection is opened. RDP_TICK Runs periodically while the user interacts with the RDP application.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either an RDP_OPEN, RDP_CLOSE, or RDP_TICK event.

The event determines which properties are committed to the record object. To view the default properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

clientBuild: String The build number of the RDP client. This property is not available if the RDP connection is encrypted. clientName: String The name of the client computer. This property is not available if the RDP connection is encrypted. cookie: String The auto-connect cookie stored by the RDP client. desktopHeight: Number The height of the desktop, expressed in pixels. This property is not available if the RDP connection is encrypted. desktopWidth: Number The width of the desktop, expressed in pixels. This property is not available if the RDP connection is encrypted. error: String The detailed error message recorded by the ExtraHop system. inEncrypted: Boolean The value is true if the RDP connection is encrypted. isError: Boolean The value is true if an error occurred on the event. keyboardLayout: String The keyboard layout, which indicates the arrangement of keys and the input language. This property is not available if the RDP connection is encrypted. record: Object The record object committed to the ExtraHop Explore appliance through a call to RDP.commitRecord() on either an RDP_OPEN, RDP_CLOSE, or RDP_TICK event.

The event on which the method was called determines which default properties the record object contains, as displayed in the following table:

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Access only on RDP_TICK events or an error will occur.

Remote Dictionary Server (Redis) is an open-source, in-memory data structure server. The Redis class enables you to store metrics and access properties on REDIS_REQUEST and REDIS_RESPONSE events.

REDIS_REQUEST Runs on every Redis request processed by the device. REDIS_RESPONSE Runs on every Redis response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either a REDIS_REQUEST or REDIS_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

errors: Array An array of detailed error messages recorded by the ExtraHop system.

Access only on REDIS_RESPONSE events or an error will occur.

Access only on REDIS_RESPONSE events or an error will occur.

Access only on REDIS_RESPONSE events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on REDIS_RESPONSE events or an error will occur.

Access only on REDIS_RESPONSE events or an error will occur.

Access only on REDIS_RESPONSE events or an error will occur.

Access only on REDIS_RESPONSE events or an error will occur.

The RPC class enables you to store metrics and access properties from Microsoft Remote Procedure Call (MSRPC) activity on RPC_REQUEST and RPC_RESPONSE events.

RPC_REQUEST Runs on every RPC request processed by the device. RPC_RESPONSE Runs on every RPC response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an RPC_REQUEST or RPC_RESPONSE event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

The record object contains the following default properties:

• proto
• clientAddr
• serverAddr
• clientPort
• serverPort
• clientBytes
• clientL2Bytes
• clientPkts
• serverBytes
• serverL2Bytes
• serverPkts
• serverRTO
• clientRTO
• clientZeroWnd
• serverZeroWnd
• roundTripTime
• interface
• operation

The RTCP class enables you to store metrics and access properties on RTCP_MESSAGE events.

RTCP_MESSAGE Runs on every RTCP UDP packet processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an RTCP_MESSAGE event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

callId: String The Call ID for associating with a SIP flow. packets: Array An array of RTCP packet objects where each object represents a packet and contains a packetType field. Each object has different fields based on the message type, as described below. packetType: String The type of packet. If the packet type is not recognizable, then the packetType will be "Unknown N" where N is the RTP control packet type value.

APP packet objects have the following fields: name: String The name chosen by the person defining the set of APP packets to be unique. Interpreted as four case-sensitive ASCII characters. ssrc: Number The SSRC of the sender. value: Buffer The optional application-dependent data.

BYE packet objects have the following fields: packetType: Number Contains the number 203 to identify this as an RTCP BYE packet.

SR packet objects have the following fields: ntpTimestamp: Number The NTP timestamp, converted to milliseconds since the epoch (January 1, 1970). reportBlocks: Array An array of report objects which contain: fractionLost: Number The 8-bit number indicating the number of packets lost divided by the number of packets expected. jitter: Number An estimate of the statistical variance of the RTP data packet interarrival time, expressed in milliseconds. lastSR: Number The middle 32 bits of the ntp_Timestamp received as part of the most recent RTCP sender report (SR) packet from the source SSRC. If no SR has been received yet, this field is set to zero. lastSRDelay: Number The delay between receiving the last SR packet from the source SSRC and sending this reception block, expressed in units of 1/65536 seconds. If no SR packet has been received yet, this field is set to zero. packetsLost: Number The total number of RTP data packets from the source SSRC that have been lost since the beginning of reception. seqNum: Number The highest sequence number received from the source SSRC. ssrc: Number The SSRC of the sender. rtpTimestamp: Number The RTP timestamp, converted to milliseconds since the epoch (January 1, 1970). senderOctets: Number The sender octet count. senderPkts: Number The sender packet count.

RR packet objects have the following fields: reportBlocks: Array An array of report objects which contain: fractionLost: Number The 8-bit number indicating the number of packets last divided by the number of packets expected. jitter: Number An estimate of the statistical variance of the RTP data packet interarrival, expressed in milliseconds. lastSR: Number The middle 32 bits of the ntp_Timestamp received as part of the most recent RTCP sender report (SR) packet from the source SSRC. If no SR has been received yet, this field is set to zero. lastSRDelay: Number The delay between receiving the last SR packet from the source SSRC and sending this reception report block, expressed in units of 1/65536 seconds. If no SR packet has been received yet, this field is set to zero. packetsLost: Number The total number of RTP data packets from the source SSRC that have been lost since the beginning of reception. seqNum: Number The highest sequence number received from the source SSRC. ssrc: Number The SSRC of the sender. ssrc: Number The SSRC of the sender.

SDES packet objects have the following fields: descriptionBlocks: Array An array of objects that contain: type: Number The SDES type.

XR packet objects have the following fields: ssrc: Number The SSRC of the sender. xrBlocks: Array An array of report blocks which contain: statSummary: Object Type 6 only. The statSummary object contains the following properties: beginSeq: Number The beginning sequence number for the interval. devJitter: Number The standard deviation of the relative transit time between each two packet series in the sequence interval. devTTLOrHL: Number The standard deviation of TTL or Hop Limit values of data packets in the sequence number range. dupPackets: Number The number of duplicate packets in the sequence number interval. endSeq: Number The ending sequence number for the interval. lostPackets: Number The number of lost packets in the sequence number interval. maxJitter: Number The maximum relative transmit time between two packets in the sequence interval, expressed in milliseconds. maxTTLOrHL: Number The maximum TTL or Hop Limit value of data packets in the sequence number range. meanJitter: Number The mean relative transit time between two packet series in the sequence interval, rounded to the nearest value expressible as an RTP timestamp, expressed in milliseconds. meanTTLOrHL: Number The mean TTL or Hop Limit value of data packets in the sequence number range. minJitter: Number The minimum relative transmit time between two packets in the sequence interval, expressed in milliseconds. minTTLOrHL: Number The minimum TTL or Hop Limit value of data packets in the sequence number range. ssrc: Number The SSRC of the sender. type: Number The XR block type.

The record object contains the following default properties:

The RTP class enables you to store metrics and access properties on RTP_OPEN, RTP_CLOSE, and RTP_TICK events.

RTP_CLOSE Runs when an RTP connection is closed. RTP_OPEN Runs when a new RTP connection is opened. RTP_TICK Runs periodically on RTP flows.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an RTP_TICK event. Record commits on RTP_OPEN and RTP_CLOSE events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

bytes: Number The number of bytes sent.

Access only on RTP_TICK events or an error will occur.

The call ID associated with the SIP or SCCP flow.

Access only on RTP_TICK events or an error will occur.

Access only on RTP_TICK events or an error will occur.

Access only on RTP_TICK events or an error will occur.

Access only on RTP_TICK events or an error will occur.

Access only on RTP_TICK events or an error will occur.

Access only on RTP_TICK events or an error will occur.

Access only on RTP_TICK events or an error will occur.

Access only on RTP_TICK events or an error will occur.

Access only on RTP_TICK events or an error will occur.

The record object contains the following default properties:

• bytes
• callId
• drops
• dups
• jitter
• l2Bytes
• mos
• outOfOrder
• payloadType
• payloadTypeId
• pkts
• rFactor
• ssrc
• version

Access record objects only on RTP_TICK events or an error will occur.

Access only on RTP_TICK events or an error will occur.

Skinny Client Control Protocol (SCCP) is a Cisco proprietary protocol for communicating with VoIP devices. The SCCP class enables you to store metrics and access properties on SCCP_MESSAGE events.

SCCP_MESSAGE Runs on every SCCP message processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an SCCP_MESSAGE event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

callId: String The call ID associated with the RTP flow. callInfo: Object An object containing information about the current SCCP called. The object contains the following fields: callReference: Number The unique identifier of the call. callType: Number The ID of the call type.

The record object contains the following default properties:

• msgType
• receiverBytes
• receiverL2Bytes
• receiverPkts
• receiverRTO
• receiverZeroWnd
• roundTripTime
• senderBytes
• senderL2Bytes
• senderPkts
• senderRTO
• senderZeroWnd

The SDP class enables you to access properties on SIP_REQUEST and SIP_RESPONSE events.

The SIP_REQUEST and SIP_RESPONSE events are defined in the SIP section.

mediaDescriptions: Array An array of objects that contain the following fields: attributes: Array of Strings The optional session attributes. bandwidth: Array of Strings The optional proposed bandwidth type and bandwidth to be consumed by the session or media. connectionInfo: String The connection data, including network type, address type and connection adddress. May also contain optional sub-fields, depending on the address type. description: String The session description which may contain one or more media descriptions. Each media description consists of media, port and transport protocol fields. encryptionKey: String The optional encryption method and key for the session. mediaTitle: String The title of the media stream. sessionDescription: Object An object that contains the following fields: attributes: Array of Strings The optional session attributes. bandwidth: Array of Strings The optional proposed bandwidth type and bandwidth to be consumed by the session or media. connectionInfo: String The connection data, including network type, address type and connection address. May also contain optional sub-fields, depending on the address type. email: String The optional email address. If present, this can contain multiple email addresses. encryptionKey: String The optional encryption method and key for the session. origin: String The originator of the session, including username, address of the user's host, a session identifier, and a version number. phoneNumber: String The optional phone number. If present, this can contain multiple phone numbers. sessionInfo: String The session description. sessionName: String The session name. timezoneAdjustments: String The adjustment time and offset for a scheduled session. uri: String The optional URI intended to provide more information about the session. version: String The version number. This should be 0. timeDescriptions: Array An array of objects that contain the following fields: repeatTime: String The session repeat time, including interval, active duration, and offsets from start time. time: String The start time and stop times for a session.

The SFlow class object enables you to store metrics and access properties on SFLOW_RECORD events. sFlow is a sampling technology for monitoring traffic in data networks. sFlow samples every nth packet and sends it to the collector whereas NetFlow sends data from every flow to the collector. The primary difference between sFlow and NetFlow is that sFlow is network layer independent and can sample anything.

SFLOW_RECORD Runs upon receipt of an SFlow sample exported from a flow network.

commitRecord(): void Commits a flow record object, which indicates the sFlow format, to the ExtraHop Explore appliance on an SFLOW_RECORD event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if .commitRecord is called multiple times for the same unique record.

deltaBytes: Number The number of L3 bytes in the flow packet. dscp: Number The number representing the last differentiated services code point (DSCP) value of the flow packet. dscpName: String The name associated with the DSCP value transmitted by a device in the flow. The following table displays well-known DSCP names:

The SIP class enables you to store metrics and access properties on SIP_REQUEST and SIP_RESPONSE events.

SIP_REQUEST Runs on every SIP request processed by the device. SIP_RESPONSE Runs on every SIP response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either an SIP_REQUEST or SIP_RESPONSE event.

The event determines which properties are committed to the record object. To view the default properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

callId: String The call ID for this message. from: String The contents of the From header. hasSDP: Boolean The value is true if this event includes SDP information. headers: Object An array-like object that enables access to SIP header names and values. Access a specific header with one of the following methods: string property: The name of the header, accessible in a dictionary-like fashion. For example:var headers = SIP.headers; session = headers["X-Session-Id"]; accept = headers.accept; numeric property: The order in which headers appear on the wire. The returned object has a name and a value property. Numeric properties are useful for iterating over all the headers and disambiguating headers with duplicate names. For example:for (i = 0; i < headers.length; i++) { hdr = headers[i]; debug("headers[" + i + "].name: " + hdr.name); debug("headers[" + i + "].value: " + hdr.value); }

Access only on SIP_RESPONSE events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on SIP_REQUEST events or an error will occur.

Access only on SIP_RESPONSE events or an error will occur.

Access only on SIP_RESPONSE events or an error will occur.

The following table displays provisional responses:

The following table displays successful responses:

The following table displays redirection responses:

The following table displays client failure responses:

The following table displays server failure responses:

The following table displays global failure responses:

The SMPP class enables you to store metrics and access properties on SMPP_REQUEST and SMPP_RESPONSE events.

SMPP_REQUEST Runs on every SMPP request processed by the device. SMPP_RESPONSE Runs on every SMPP response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on a SMPP_RESPONSE event. Record commits on SMPP_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

command: String The SMPP command ID. destination: String The destination address as specified in the SMPP_REQUEST. The value is null if this is not available for the current command type. error: String The error code corresponding to command_status. If the command status is ROK, the value is null.

Access only on SMPP_RESPONSE events or an error will occur.

Access only on SMPP_REQUEST events or an error will occur.

Access only on SMPP_RESPONSE events or an error will occur.

The record object contains the following default properties:

• clientZeroWnd
• command
• destination
• error
• reqSize
• reqTimeToLastByte
• rspSize
• rspTimeToFirstByte
• rspTimeToLastByte
• serverZeroWnd
• source
• processingTime

Access only on SMPP_RESPONSE events or an error will occur.

Access only on SMPP_RESPONSE events or an error will occur.

Access only on SMPP_RESPONSE events or an error will occur.

The SMTP class enables you to store metrics and access properties on SMTP_REQUEST and SMTP_RESPONSE events.

SMTP_REQUEST Runs on every SMTP request processed by the device. SMTP_RESPONSE Runs on every SMTP response processed by the device.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on a SMTP_RESPONSE event. Record commits on SMTP_REQUEST events are not supported.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

dataSize: Number The size of the attachment, expressed in bytes. domain: String The domain of the address the message is coming from. error: String The error code corresponding to status code.

Access only on SMTP_RESPONSE events or an error will occur.

The value of the headers property is the same when accessed on either the SMTP_REQUEST or the SMTP_RESPONSE event.

Access only on SMTP_RESPONSE events or an error will occur.

Access only on SMTP_RESPONSE events or an error will occur.

The value of the recipientList property is the same when accessed on either the SMTP_REQUEST or the SMTP_RESPONSE event.

The record object contains the following default properties:

• clientZeroWnd
• dataSize
• domain
• error
• isEncrypted
• isReqAborted
• isRspAborted
• method
• processingTime
• recipient
• recipientList
• reqBytes
• reqL2Bytes
• reqPkts
• reqRTO
• reqSize
• reqTimeToLastByte
• roundTripTime
• rspBytes
• rspL2Bytes
• rspPkts
• rspRTO
• rspSize
• rspTimeToFirstByte
• rspTimeToLastByte
• sender
• serverZeroWnd
• statusCode
• statusText

Access the record object only on SMTP_RESPONSE events or an error will occur.

Access only on SMTP_RESPONSE events or an error will occur.

Access only on SMTP_RESPONSE events or an error will occur.

Access only on SMTP_RESPONSE events or an error will occur.

Access only on SMTP_RESPONSE events or an error will occur.

Access only on SMTP_RESPONSE events or an error will occur.

Secure Socket Shell (SSH) is a network protocol that provides a secure method for remote login and other network services over an unsecured network. The SSH class object enables you to store metrics and access properties on SSH_CLOSE, SSH_OPEN and SSH_TICK events.

SSH_CLOSE Runs when the SSH connection is shut down by being closed, expired, or aborted. SSH_OPEN Runs when the SSH connection is first fully established after session information is negotiated.

If a connection closes before SSH_OPEN has run, SSH_OPEN, SSH_TICK, and SSH_CLOSE will run in immediate succession.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on either an SSH_OPEN, SSH_CLOSE, or SSH_TICK event.

The event determines which properties are committed to the record object. To view the properties committed for each event, see the record property below.

For built-in records, each unique record is committed only once, even if .commitRecord is called multiple times for the same unique record.

clientBytes: Number Upon an SSH_CLOSE event, the incremental number of application-level client bytes observed since the last SSH_TICK event. Does not specify the total number of bytes for the session. clientCipherAlgorithm: String The encryption cipher algorithm on the SSH client. clientCompressionAlgorithm: String The compression algorithm applied to data transferred over the connection by the SSH client. clientCompressionAlgorithmsClientToServer: String The compression algorithms that the SSH client supports for client to server communications. clientCompressionAlgorithmsClientToServer: String The compression algorithms that the SSH client supports for server to client communications. clientEncryptionAlgorithmsClientToServer: String The encryption algorithms that the SSH client supports for client to server communications. clientEncryptionAlgorithmsServerToClient: String The encryption algorithms that the SSH client supports for server to client communications. clientImplementation: String The SSH implementation installed on the client, such as OpenSSH or PUTTY. clientKexAlgorithms: String The SSH key exchange algorithms that the client supports. clientL2Bytes: Number The incremental number of L2 client bytes observed since the last SSH_TICK event. Does not specify the total number of bytes for the session.

Access only on SSH_CLOSE and SSH_TICK events or an error will occur.

Access only on SSH_CLOSE and SSH_TICK events or an error will occur.

Access only on SSH_CLOSE and SSH_TICK events or an error will occur.

Access only on SSH_OPEN, SSH_CLOSE, or SSH_TICK events or an error will occur.

Access only on SSH_CLOSE events or an error will occur.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on SSH_CLOSE and SSH_TICK events or an error will occur.

Access only on SSH_CLOSE and SSH_TICK events or an error will occur.

Access only on SSH_CLOSE and SSH_TICK events or an error will occur.

Access only on SSH_CLOSE and SSH_TICK events or an error will occur.

Access only on SSH_OPEN, SSH_CLOSE, or SSH_TICK events or an error will occur.

The SSL class enables you to store metrics and access properties on SSL_OPEN, SSL_CLOSE, SSL_ALERT, SSL_ RECORD, SSL_HEARTBEAT, and SSL_RENEGOTIATE events.

SSL_ALERT Runs when an SSL alert record is exchanged. SSL_CLOSE Runs when the SSL connection is shut down. SSL_HEARTBEAT Runs when an SSL heartbeat record is exchanged. SSL_OPEN Runs when the SSL connection is first established. SSL_PAYLOAD Runs when the decrypted SSL payload matches the criteria configured in the associated trigger.

Depending on the flow, the payload can be found in the following properties:

• Flow.payload1
• Flow.payload2
• Flow.client.payload
• Flow.server.payload
• Flow.sender.payload
• Flow.receiver.payload

Additional payload options are available when you create a trigger that runs on this event. See Advanced trigger options for more information.

addApplication(name: String): void Associates an SSL session with the named application to collect SSL metric data about the session. For example, you might call SSL.addApplication() to associate SSL certificate data in an application.

After an SSL session is associated with an application, that pairing is permanent for the lifetime of the session.

Call only on SSL_OPEN events or an error will occur.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

Call only on SSL_OPEN and SSL_RENEGOTIATE events or an error will occur.

Call only on SSL_OPEN and SSL_RENEGOTIATE events or an error will occur.

Call only on SSL_OPEN and SSL_RENEGOTIATE events or an error will occur.

Call only on SSL_OPEN and SSL_RENEGOTIATE events or an error will occur.

The following table provides a list of known SSL extensions.

The following extensions are sent out by applications to test whether servers can handle unknown extensions. For more information about these extensions, see Applying GREASE to TLS Extensibility.

• 2570
• 6682
• 10794
• 14906
• 19018
• 23130
• 27242
• 31354
• 35466
• 39578
• 43690
• 47802
• 51914
• 56026
• 60138
• 64250

alertCode: Number The numeric representation of the SSL alert. The following table displays the possible SSL alerts, which are defined in the AlertDescription data structure in RFC 2246:

If the session is opaque, the value is SSL.ALERT_CODE_UNKNOWN (null).

Access only on SSL_ALERT events or an error will occur.

Access only on SSL_ALERT events or an error will occur.

If the session is opaque, the value is SSL.ALERT_LEVEL_UNKNOWN (null).

Access only on SSL_ALERT events or an error will occur.

Access only on SSL_OPEN or SSL_RENEGOTIATE events or an error will occur.

Access only on SSL_RECORD or SSL_CLOSE events or an error will occur.

Access only on SSL_OPEN, SSL_ALERT, or SSL_RENEGOTIATE events or an error will occur.

Access only on SSL_OPEN or SSL_RENEGOTIATE events or an error will occur.

Access only on SSL_RECORD or SSL_CLOSE events or an error will occur.

Access only on SSL_RECORD or SSL_CLOSE events or an error will occur.

Access only on SSL_RECORD or SSL_CLOSE events or an error will occur.

Access only on SSL_RECORD events or an error will occur.

Access only on SSL_OPEN or SSL_RENEGOTIATE events or an error will occur.

Access only on SSL_HEARTBEAT events or an error will occur.

Access only on SSL_HEARTBEAT events or an error will occur.

Access only on SSL_OPEN or SSL_RENEGOTIATE events or an error will occur.

Access only on SSL_CLOSE events or an error will occur.

Access only on SSL_OPEN, SSL_CLOSE, SSL_ALERT, SSL_HEARTBEAT, or SSL_RENEGOTIATE events or an error will occur.

Access only on SSL_OPEN, SSL_CLOSE, SSL_ALERT, SSL_HEARTBEAT, or SSL_RENEGOTIATE events or an error will occur.

Access only on SSL_OPEN, SSL_CLOSE, SSL_ALERT, SSL_HEARTBEAT, or SSL_RENEGOTIATE events or an error will occur.

To find the private key ID in the ExtraHop Admin UI, click Capture from the System Configuration section, click SSL Decryption, and then click a certificate. The pop-up window displays all identifiers for the certificate.

The event on which the method was called determines which default properties the record object contains as displayed in the following table:

Access only on SSL_RECORD, SSL_ALERT, or SSL_HEARTBEAT events or an error will occur.

Access only on SSL_RECORD, SSL_ALERT, and SSL_HEARTBEAT events or an error will occur.

Access only on SSL_RECORD or SSL_CLOSE events or an error will occur.

Access only on SSL_OPEN or SSL_RENEGOTIATE events or an error will occur.

Access only on SSL_RECORD or SSL_CLOSE events or an error will occur.

Access only on SSL_RECORD or SSL_CLOSE events or an error will occur.

Access only on SSL_RECORD or SSL_CLOSE events or an error will occur.

Access only on SSL_RECORD or SSL_CLOSE events or an error will occur.

The TCP class enables you to access properties and retrieve metrics from TCP events and from FLOW_TICK and FLOW_TURN events.

The FLOW_TICK and FLOW_TURN events are defined in the Flow section.

TCP_CLOSE Runs when the TCP connection is shut down by being closed, expired or aborted. TCP_DESYNC Runs when packet drops that will interrupt the processing of the TCP connection are detected. TCP_OPEN Runs when the TCP connection is first fully established.

The FLOW_CLASSIFY event runs after the TCP_OPEN event to determine the L7 protocol of the TCP flow.

Depending on the Flow, the TCP payload can be found in the following properties:

• Flow.client.payload
• Flow.payload1
• Flow.payload2
• Flow.receiver.payload
• Flow.sender.payload
• Flow.server.payload

Additional payload options are available when you create a trigger that runs on this event. See Advanced trigger options for more information.

getOption(kind: Number): Object | Null Returns a TCP option object that matches the specified option kind. For a list of valid option kinds, see TCP options. Specify the TCP client or the TCP server in the syntax—for example, TCP.client.getOption(1) or TCP.server.getOption(1).

Applies only to TCP_OPEN events.

handshakeTime: Number The amount of time required to negotiate the TCP connection, expressed in milliseconds.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

This condition may be detected in any TCP event and in any impacted L7 events (for example, HTTP_REQUEST or DB_RESPONSE).

Access only on TCP_CLOSE events or an error will occur.

Access only on FLOW_TICK and FLOW_TURN events or an error will occur.

Access only on FLOW_TICK and FLOW_TURN events or an error will occur.

Access only on FLOW_TICK and FLOW_TURN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on TCP_OPEN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK and FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK or FLOW_TURN events or an error will occur.

Access only on FLOW_TICK and FLOW_TURN events or an error will occur.

Access only on FLOW_TICK and FLOW_TURN events or an error will occur.

Access only on FLOW_TICK and FLOW_TURN events or an error will occur.

All TCP Options objects have the following properties:

The following list contains the names of common TCP options and their specific properties:

The following is an example of TCP options:

The Telnet class enables you to store metrics and access properties on TELNET_MESSAGE events.

TELNET_MESSAGE Runs on a telnet command or line of data from the telnet client or server.

commitRecord(): void Commits a record object to the ExtraHop Explore appliance on an TELNET_MESSAGE event.

To view the default properties committed to the record object, see the record property below.

For built-in records, each unique record is committed only once, even if the commitRecord() method is called multiple times for the same unique record.

command: String The command type. The value is null if the event was run due to a line of data being sent.

The following values are valid:

• Abort
• Abort Output
• Are You There
• Break
• Data Mark
• DO
• DON'T
• End of File
• End of Record
• Erase Character
• Erase Line
• Go Ahead
• Interrupt Process
• NOP
• SB
• SE
• Suspend
• WILL
• WON'T

• 3270-REGIME
• AARD
• ATCP
• AUTHENTICATION
• BM
• CHARSET
• COM-PORT-OPTION
• DET
• ECHO
• ENCRYPT
• END-OF-RECORD
• ENVIRON
• EXPOPL
• EXTEND-ASCII
• FORWARD-X
• GMCP
• KERMIT
• LINEMODE
• LOGOUT
• NAOCRD
• NAOFFD
• NAOHTD
• NAOHTS
• NAOL
• NAOLFD
• NAOP
• NAOVTD
• NAOVTS
• NAWS
• NEW-ENVIRON
• OUTMRK
• PRAGMA-HEARTBEAT
• PRAGMA-LOGON
• RCTE
• RECONNECT
• REMOTE-SERIAL-PORT
• SEND-LOCATION
• SEND-URL
• SSPI-LOGON
• STATUS
• SUPDUP
• SUPDUP-OUTPUT
• SUPPRESS-GO-AHEAD
• TERMINAL-SPEED
• TERMINAL-TYPE
• TIMING-MARK
• TN3270E
• TOGGLE-FLOW-CONTROL
• TRANSMIT-BINARY
• TTYLOC
• TUID
• X-DISPLAY-LOCATION
• X.3-PAD
• XAUTH

The record object contains the following default properties:

• command
• option
• receiverBytes
• receiverL2Bytes
• recieverPkts
• receiverRTO
• receiverZeroWnd
• roundTripTime
• senderBytes
• senderL2Bytes
• senderPkts
• senderRTO
• senderZeroWnd

Turn is a class that enables you to store metrics and access properties available on FLOW_TURN events.

The FLOW_TURN event is defined in the Flow section.

clientBytes: Number The size of the request that the client transferred, expressed in bytes. clientTransferTime: Number The client transfer time, expressed in milliseconds. processingTime: Number The time elapsed between when the client transfers the request to the server and when the server begins to transfer the response back to the client, expressed in milliseconds. reqSize: Number The size of the request payload, expressed in bytes. reqTransferTime: Number The request transfer time, expressed in milliseconds. If the request is contained in a single packet, the transfer time is zero. If the request spans multiple packets, the value is the amount of time between detection of the first request packet and detection of the last packet by the ExtraHop system. A high value might indicate a large request or a network delay. The value is NaN if there is no valid measurement, or if the timing is invalid. rspSize: Number The size of the response payload, expressed in bytes. rspTransferTime: Number The response transfer time, expressed in milliseconds. If the response is contained in a single packet, the transfer time is zero. If the response spans multiple packets, the value is the amount of time between detection of the first response packet and detection of the last packet by the ExtraHop system. A high value might indicate a large response or a network delay. The value is NaN if there is no valid measurement, or if the timing is invalid. serverBytes: Number The size of the response that the server transferred, expressed in bytes. serverTransferTime: Number The server transfer time, expressed in milliseconds. sourceDevice: Device The source device object. See the Device class for more information. thinkTime: Number The time elapsed between the server having transferred the response to the client and the client transferring a new request to the server, expressed in milliseconds. The value is NaN if there is no valid measurement.

The UDP class enables you to access properties and retrieve metrics from UDP events and from FLOW_TICK and FLOW_TURN events.

The FLOW_TICK and FLOW_TURN events are defined in the Flow section.

UDP_PAYLOAD Runs when the payload matches the criteria configured in the associated trigger.

Depending on the Flow, the UDP payload can be found in the following properties:

• Flow.client.payload
• Flow.payload1
• Flow.payload2
• Flow.receiver.payload
• Flow.sender.payload
• Flow.server.payload

Additional payload options are available when you create a trigger that runs on this event. See Advanced trigger options for more information.

The WebSocket class enables you to access properties on WebSocket activity.

WEBSOCKET_OPEN Runs when a successful handshake has been observed. WEBSOCKET_CLOSE Runs when both close frames are observed, or when the underlying TCP connection is closed. WEBSOCKET_MESSAGE Runs when all frames of a text or binary message have been observed.

clientBytes: Number The total number of bytes sent by the client during the WebSockets session.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_CLOSE events or an error will occur.

Access only on WEBSOCKET_OPEN events or an error will occur.

Access only on WEBSOCKET_CLOSE events or an error will occur.

Access only on WEBSOCKET_CLOSE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_OPEN events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

Access only on WEBSOCKET_MESSAGE events or an error will occur.

The value is NO_STATUS_RECVD (1005) if the initial close frame does not include a status code. The value is NaN if connection was terminated abnormally.

Access only on WEBSOCKET_CLOSE events or an error will occur.

Access only on WEBSOCKET_OPEN events or an error will occur.

The Trigger API classes in this section enable you to send data to a third-party syslog, database, or server through an open data stream (ODS) you have configured in the ExtraHop Admin UI.

The Remote.HTTP class enables you to submit HTTP request data to an HTTP open data stream (ODS) target and provides access to HTTP REST API endpoints.

You must first configure an HTTP ODS target from the ExtraHop Admin UI, which requires unlimited privileges. For configuration information, see the Open Data Streams section in the ExtraHop Admin UI Guide.

delete Submits an HTTP REST delete request to a configured HTTP open data stream. Syntax: Remote.HTTP("name").delete({path: "path", [headers: headers], [payload: "payload"]}) Remote.HTTP.delete({path: "path", [headers: headers], [payload: "payload"]}) Parameters: name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. options: Object The options object has the following properties: path: String The string specifying the request path. headers: Object The optional object specifying the request headers. The following headers are restricted and will result in an error if specified:

Headers configured in a trigger take precedence over an entry in the Additional HTTP Header field, which is located in the Open Data Streams configuration window in the Admin UI. For example, if the Additional HTTP Header field specifies Content-Type: text/plain, but a trigger script on the same ODS target specifies Content-Type: application/json, then Content-Type: application/json is included in the HTTP request.

You can compress the outgoing HTTP requests with the Content- Encoding header.

The following values are supported for this compression header:

Headers configured in a trigger take precedence over an entry in the Additional HTTP Header field, which is located in the Open Data Streams configuration window in the Admin UI. For example, if the Additional HTTP Header field specifies Content-Type: text/plain, but a trigger script on the same ODS target specifies Content-Type: application/json, then Content-Type: application/json is included in the HTTP request.

You can compress the outgoing HTTP requests with the Content- Encoding header.

The following values are supported for this compression header:

Headers configured in a trigger take precedence over an entry in the Additional HTTP Header field, which is located in the Open Data Streams configuration window in the Admin UI. For example, if the Additional HTTP Header field specifies Content-Type: text/plain, but a trigger script on the same ODS target specifies Content-Type: application/json, then Content-Type: application/json is included in the HTTP request.

You can compress the outgoing HTTP requests with the Content- Encoding header.

The following values are supported for this compression header:

• Connection
• Authorization
• Proxy-Connection
• Content-Length
• X-Forwarded-For
• Transfer-Encoding

Headers configured in a trigger take precedence over an entry in the Additional HTTP Header field, which is located in the Open Data Streams configuration window in the Admin UI. For example, if the Additional HTTP Header field specifies Content-Type: text/plain, but a trigger script on the same ODS target specifies Content-Type: application/json, then Content-Type: application/json is included in the HTTP request.

You can compress the outgoing HTTP requests with the Content- Encoding header.

The following values are supported for this compression header:

• Connection
• Authorization
• Proxy-Connection
• Content-Length
• X-Forwarded-For
• Transfer-Encoding

Headers configured in a trigger take precedence over an entry in the Additional HTTP Header field, which is located in the Open Data Streams configuration window in the Admin UI. For example, if the Additional HTTP Header field specifies Content-Type: text/plain, but a trigger script on the same ODS target specifies Content-Type: application/json, then Content-Type: application/json is included in the HTTP request.

You can compress the outgoing HTTP requests with the Content- Encoding header.

The following values are supported for this compression header:

• GET
• HEAD
• POST
• PUT
• DELETE
• TRACE
• OPTIONS
• CONNECT
• PATCH

• Connection
• Authorization
• Proxy-Connection
• Content-Length
• X-Forwarded-For
• Transfer-Encoding

Headers configured in a trigger take precedence over an entry in the Additional HTTP Header field, which is located in the Open Data Streams configuration window in the Admin UI. For example, if the Additional HTTP Header field specifies Content-Type: text/plain, but a trigger script on the same ODS target specifies Content-Type: application/json, then Content-Type: application/json is included in the HTTP request.

You can compress the outgoing HTTP requests with the Content- Encoding header.

The following values are supported for this compression header:

The following helper methods are available for common HTTP methods.

• Remote.HTTP.delete
• Remote.HTTP.get
• Remote.HTTP.patch
• Remote.HTTP.post
• Remote.HTTP.put

HTTP GET The following example will issue an HTTP GET request to the HTTP configuration called "my_destination" and a path that is the URI, including query string variables, that you want the request to be sent to.Remote.HTTP("my_destination").get( { path: "/?example=example1&example2=my_data" } ); HTTP POST The following example will issue an HTTP POST request to the HTTP configuration called "my_destination", the path that is the URI you want the request to be sent to and a payload. The payload can be data similar to what an HTTP client would send, a JSON blob, XML, or whatever else you want to send.Remote.HTTP("my_destination").post( { path: "/", payload: "data I want to send" } ); Custom HTTP Headers The following example defines a Javascript object with keys to represent the header names and their corresponding values and provide that in a call as the value for the headers key.var my_json = { example: "my_data", example1: 42, example2: false }; var headers = { "Content-Type": "application/json" }; Remote.HTTP("my_destination").post( { path: "/", headers: headers, payload: JSON.stringify(my_json) });

The Remote.Kafka class enables you to submit message data to a Kafka server through a Kafka open data stream (ODS).

You must first configure a Kafka ODS target from the ExtraHop Admin UI, which requires unlimited privileges. For configuration information, see the Open Data Streams section in the ExtraHop Admin UI Guide.

send Sends an array of messages to a single topic with an option to indicate which Kafka partition the messages will be sent to. Syntax: Remote.Kafka.send({"topic": "topic", "messages":[messages], ["partition": partition]}) Remote.Kafka("name").send({"topic": "topic", "messages":[messages], ["partition": partition]}) Parameters: name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. topic: String A string corresponding to the topic associated with the Kafka send method. The topic string has the following restrictions:

• The string length must be between 1 and 249 characters.
• The string supports only alphanumeric characters and the following symbols: "-", "_", or ".".
• The string cannot be "." or "..".

• The string length must be between 1 and 249 characters.
• The string supports only alphanumeric characters and the following symbols: "-", "_", or ".".
• The string cannot be "." or "..".

The Remote.MongoDB class enables you to insert, remove, and update MongoDB document collections through a MongoDB open data stream (ODS).

You must first configure a MongoDB ODS target from the ExtraHop Admin UI, which requires unlimited privileges. For configuration information, see the Open Data Streams section in the ExtraHop Admin UI Guide.

insert Inserts a document or array of documents into a collection, and handles both add and modify operations. Syntax: Remote.MongoDB.insert("db.collection", document); Remote.MongoDB("name").insert("db.collection", document); Parameters: name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. collection: String The name of a group of MongoDB documents. document: Object The JSON-formatted document to insert into the collection. Return Values: Returns true if the request is queued, otherwise returns false. Examples: Remote.MongoDB.insert('sessions.sess_www', { 'session_id': "100", 'path': "/index.html", 'host': "www.extrahop.com", 'status': "500", 'src_ip': "10.10.1.120", 'dst_ip': "10.10.1.100" } ); var x = Remote.MongoDB.insert('test.tbc', {example: 1}); if (x) { Network.metricAddCount('perf_trigger_success', 1); } else { Network.metricAddCount('perf_trigger_error', 1); }Refer to http://docs.mongodb.org/manual/reference/method/db.collection.insert/#db.collection.insert for more information. remove Removes documents from a collection. Syntax: Remote.MongoDB.remove("db.collection", document, [justOnce]); Remote.MongoDB("name").remove("db.collection", document, [justOnce]); Parameters: collection: String The name of a group of MongoDB documents. document: Object The JSON-formatted document to remove from the collection. justOnce: Boolean An optional boolean parameter that limits the removal to just one document. Set to true to limit the deletion. The default value is false. name: String The name of the host specified when you configured the open data stream in the ExtraHop Admin UI. If no host was specified, the value is the default host. Return Values: Returns true if the request is queued, otherwise returns false. Examples: var x = Remote.MongoDB.remove('test.tbc', {qty: 100000}, false); if (x) { Network.metricAddCount('perf_trigger_success', 1); } else { Network.metricAddCount('perf_trigger_error', 1); }Refer to http://docs.mongodb.org/manual/reference/method/db.collection.remove/#db.collection.remove for more information. update Modifies an existing document or documents in a collection. Syntax: Remote.MongoDB.update("db.collection", document, update, [{"upsert":true, "multi":true}]); Remote.MongoDB("name").update("db.collection", document, update, [{"upsert":true, "multi":true}]); Parameters: collection: String The name of a group of MongoDB documents. document: Object The JSON-formatted document that specifies which documents to update or insert, if upsert option is set to true. update: Object The JSON-formatted document that specifies how to update the specified documents. name: String The name of the host specified when you configured the open data stream in the ExtraHop Admin UI. If no host was specified, the value is the default host. options: Optional flags that indicate the following additional update options: upsert: Boolean An optional boolean parameter that creates a new document when no document matches the query data. Set to true to create a new document. The default value is false. multi: Boolean An optional boolean parameter that updates all documents that match the query data. Set to true to update multiple documents. The default value is false, which updates only the first document returned. Return Values: The value is true if the request is queued, otherwise returns FALSE. Examples: var x = Remote.MongoDB.update('test.tbc', {_id: 1}, {$set: {example:2}}, {'upsert':true, 'multi':false} ); if (x) { Network.metricAddCount('perf_trigger_success', 1); } else { Network.metricAddCount('perf_trigger_error', 1); }Refer to http://docs.mongodb.org/manual/reference/method/db.collection.update/#db.collection.update for more information.

• Example: Parse syslog over TCP with universal payload analysis

The Remote.Raw class enables you to submit raw data to a Raw open data stream (ODS) target through a TCP or UDP port.

You must first configure a raw ODS target from the ExtraHop Admin UI, which requires unlimited privileges. For configuration information, see the Open Data Streams section in the ExtraHop Admin UI Guide.

Send Sends raw data to a Raw open data stream (ODS) target through a TCP or UDP port. Syntax: Remote.Raw.send("data") Remote.Raw("name").send("data") Parameters: name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. data: String The JavaScript string representing the bytes to send. Return Values: None Examples Remote.Raw.send("data over the wire"); Remote.Raw("my-target").send("extra data for my-target");

The Remote.Syslog class enables you to create remote syslog messages and send message data to a Syslog open data stream (ODS).

You must first configure a syslog ODS target from the ExtraHop Admin UI, which requires unlimited privileges. For configuration information, see the Open Data Streams section in the ExtraHop Admin UI Guide.

emerg(message:String):void Sends a message to the remote syslog server with an emergency severity level. Syntax: Remote.Syslog.emerg("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Remote.Syslog("name").emerg("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Parameters name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. alert(message:String):void Sends a message to the remote syslog server with an alert severity level. Syntax: Remote.Syslog.alert("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Remote.Syslog("name").alert("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Parameters name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. crit(message:String):void Sends a message to the remote syslog server with a critical severity level. Syntax: Remote.Syslog.crit("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Remote.Syslog("name").crit("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Parameters name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. error(message:String):void Sends a message to the remote syslog server with an error severity level. Syntax: Remote.Syslog.error("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Remote.Syslog("name").error("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Parameters name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. warn(message:String):void Sends a message to the remote syslog server with a warning severity level. Syntax: Remote.Syslog.warn("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Remote.Syslog("name").warn("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Parameters name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. notice(message:String):void Sends a message to the remote syslog server with a notice severity level. Syntax: Remote.Syslog.notice("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Remote.Syslog("name").notice("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Parameters name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. info(message:String):void Sends a message to the remote syslog server with an info severity level. Syntax: Remote.Syslog.info("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Remote.Syslog("name").info("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Parameters name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default. debug(message:String):void Sends a message to the remote syslog server with a debug severity level. Syntax: Remote.Syslog.debug("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Remote.Syslog("name").debug("eh_event=web uri=" + HTTP.uri + " req_size=" + HTTP.reqSize + " rsp_size=" + HTTP.rspSize + " processingTime=" + HTTP.processingTime); Parameters name: String The name of the ODS target that requests are sent to. If this field is not specified, the name is set to default.

By default, the message sent to the remote server is limited to 1024 bytes, including the message header and trailer (if necessary). The message header always includes the priority and timestamp, which together are up to 30 bytes.

If you have unlimited privileges, you can increase the default message size in the ExtraHop Admin UI. Click Running Config from the Appliance Settings section, and then click Edit config. Go to the "remote" section, and under the ODS target name, such as "rsyslog", add "message_length_max" as shown in the example below. The "message_length_max" setting applies only to the message passed to the Remote.Syslog APIs; the message header does not count against the maximum.

The default timestamp format for rsyslog messages is UTC. You can change the timestamp to local time when you configure the open data stream in the ExtraHop Admin UI.

The Remote class enables you to send data to a third-party syslog, database, or server through an open data stream (ODS) and access responses returned by HTTP ODS targets.

REMOTE_RESPONSE Runs when the ExtraHop appliance receives a response from an HTTP ODS target.

response: Object An object that contains information from the HTTP response returned by the ODS target. The response object has the following properties: statusCode: Number The status code returned by the ODS target. body: Buffer The body of the HTTP response sent by the ODS target. headers: Object An object that contains the headers of the HTTP response sent by the ODS target. If the response contains multiple headers with the same name, the value for the header is an array. For example, if Set-Cookie is specified multiple times in the response, you can access the first cookie by specifying Remote.response.headers["Set-Cookie"][0]. context: Object | String | Number | Boolean | null The context information specified in the Remote.HTTP context parameter when the ODS request was sent. For more information see Remote.HTTP.

The Trigger API classes in this section enable you to access datastore, or bridge, metrics.

The AlertRecord class enables you to access alert information on ALERT_RECORD_COMMIT events.

ALERT_RECORD_COMMIT Runs when an alert occurs. Provides access to information about the alert.

Additional datastore options are available when you create a trigger that runs on this event. See Advanced trigger options for more information.

description: String The description of the alert as it appears in the ExtraHop Web UI. id: String The ID of the alert record. For example, extrahop.device.alert. A list of IDs can be supplied as a hint to the ALERT_RECORD_COMMIT event. name: String The name of the alert. object: Object The object the alert applies to. For device, application, capture, flow interface, or flow network alerts, this property will contain a Device, Application, Network, FlowInterface, or FlowNetwork object, respectively. time: Number The time that the alert record will be published with. severityName: String The name of the alert severity level. The following severity levels are supported:

The dataset class enables you to access raw dataset values and provides an interface for computing percentiles.

percentile(...): Array | Number Accepts a list of percentiles (either as an array or as multiple arguments) to compute and returns the computed percentile values for the dataset. If passed a single numeric argument, a number is returned. Otherwise an array is returned. The arguments must be in ascending order with no duplicates. Floating point values, such as 99.99, are allowed.

entries: Array An array of objects with frequency and value attributes. This is analogous to a frequency table where there is a set of values and the number of times each value was observed.

The MetricCycle class represents an interval during which metrics are published. The MetricCycle class is valid on METRIC_CYCLE_BEGIN, METRIC_CYCLE_END, and METRIC_RECORD_COMMIT events.

The METRIC_RECORD_COMMIT event is defined in the MetricRecord section.

METRIC_CYCLE_BEGIN Runs when a metric interval begins.

Additional datastore options are available when you create a trigger that runs on either of these events. See Advanced trigger options for more information.

id: String A string representing the metric cycle. Possible values are: interval: Object An object containing from and until properties, expressed in milliseconds since the epoch. store: Object An object that retains information across all the METRIC_RECORD_COMMIT events that occur during a metric cycle, that is, from the METRIC_CYCLE_BEGIN event to the METRIC_CYCLE_END event. This object is analogous to the Flow.store object. The store object is shared among triggers for METRIC_* events. It is cleared at the end of a metric cycle.

• Example: Add metrics to the metric cycle store

The MetricRecord class enables you to access to the current set of metrics on METRIC_RECORD_COMMIT events.

METRIC_RECORD_COMMIT Runs when a metric record is committed to the datastore and provides access to various metric properties.

Additional datastore options are available when you create a trigger that runs on this event. See Advanced trigger options for more information.

fields: Object An object containing metric values. The properties are the field names and the values can be numbers, Topnset, Dataset or Sampleset. id: String The metric type, such as extrahop.device.http_server. object: Object The object the metric applies to. For device, application, or VLAN alerts, this property contains a Device object, an Application object, or a VLAN instance, respectively. For capture metrics, such as extrahop.capture.net, the property contains a Network object. time: Number The publish time of the metric record.

The Sampleset class enables you to retrieve summary data about metrics.

count: Number The number of samples in the sampleset. mean: Number The average value of the samples. sigma: Number The standard deviation. sum: Number The sum of the samples. sum2: Number The sum of the squares of the samples.

The Topnset class represents a collection of metrics grouped by a key such as a URI or a client IP address.

For custom metrics, keys in the topnset corresponds to the keys passed into metricAddDetail*() methods. Key values can be a number, string, Dataset, Sampleset, or another topnset.

entries: Array An array of the topnset entries. The array contains at most N objects with key and value properties where N is currently set to 1000.

Keys in the entries array adhere to the following structure, or key pattern:

• int
• string
• device_id
• ipaddr
• addr_pair
• ether

• For int, string, and device_id keys, the value is a number, string, and device ID, respectively.
• For ipaddr keys, the value is an object containing the following properties:
  • addr
  • proto
  • port
  • device_id
  • origin
• For addr_pair keys, the value is an object containing the following properties:
  • addr1
  • addr2
  • port1
  • port2
  • proto
• For ether keys, the value is an object containing the following properties:

The API elements listed in this section have been deprecated. Each element includes an alternative and the version in which the element was deprecated.

If your trigger script contains a deprecated element, the syntax validator in the trigger editor lets you know which element is deprecated and suggests a replacement element, if available. You cannot save the trigger until you fix your code or you disable syntax validation. For better trigger performance, replace deprecated elements.