Victim

Properties

• id (integer): Unique event identifier.

• timestamp (string, format: date-time)

  Examples:

  "2018-11-13T20:20:39+00:00"

• user (['string', 'null'], format: uri-reference): Optional resource of user who triggered the event.

  Examples:

  "/users/123"

• event_type (string): Must be one of: ["victim"].

• event (string): Must be one of: ["begin", "end"].

• victim_id (integer)

• victim_resource (string, format: uri-reference)

  Examples:

  "/victims/78765"

• ip_addr (string): The IPv4 or IPv6 address of the victim. Added in rWeb 9.6.

• parent_zone (string, format: uri-reference)

  Examples:

  "/zones/123"

• attack_type (integer)

• attack_type_name (string): English description of attack type.

• attack_subtype (array)

  • Items (object)
    • type (integer, required): Attack subtype identifier.
    • name (string, required): English description of subtype.

• current_mode (string): Zone mitigation mode for this attack type at the time this event was generated. Must be one of: ["auto", "monitor", "force_on", "off"].

• starttime (string, format: date-time)

• endtime (['string', 'null'], format: date-time): End time of attack or null if attack is ongoing.

• numattackpackets (integer)

• numdroppedpackets (integer)

• numattackbits (integer)

• numdroppedbits (integer)

• current_pps (integer): Attack packets per second rate estimate at time of event generation.

• current_bps (integer): Attack bits per second rate estimate at time of event generation.

• max_pps (integer): Peak attack packet rate per 30 seconds over lifetime of this victim.

• max_bps (integer): Peak attack bit rate per 30 seconds over lifetime of this victim.

Examples

{
    "id": 1,
    "timestamp": "2018-11-13T20:20:39+00:00",
    "user": "/users/100",
    "event_type": "victim",
    "event": "begin",
    "victim_id": 78765,
    "victim_resource": "/victims/78765",
    "ip_addr": "198.51.100.36",
    "parent_zone": "/zones/123",
    "attack_type": 5,
    "attack_type_name": "AT5 RST FIN FLOOD",
    "attack_subtype": [
        {
            "type": 1,
            "name": "ST1 FIN flood attack"
        }
    ],
    "current_mode": "auto",
    "starttime": "2024-03-07T21:37:41Z",
    "endtime": null,
    "numattackpackets": 1,
    "numdroppedpackets": 1,
    "numattackbits": 512,
    "numdroppedbits": 512,
    "current_pps": 1,
    "current_bps": 200,
    "max_pps": 2,
    "max_bps": 400
}