Skip to content

Commit 1fa9ca7

Browse files
authored
Update network-normalization-schema.md
1 parent 3c05c1e commit 1fa9ca7

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

articles/sentinel/network-normalization-schema.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ Fields that appear in the table below are common to all ASIM schemas. Any guidel
149149
| **SessionId** | Alias | String | Alias to [NetworkSessionId](#networksessionid). |
150150
| **TcpFlagsAck** | Optional | Boolean | The TCP ACK Flag reported. The acknowledgment flag is used to acknowledge the successful receipt of a packet. As we can see from the diagram above, the receiver sends an ACK as well as a SYN in the second step of the three way handshake process to tell the sender that it received its initial packet. |
151151
| **TcpFlagsFin** | Optional | Boolean | The TCP FIN Flag reported. The finished flag means there is no more data from the sender. Therefore, it is used in the last packet sent from the sender. |
152-
| **TcpFlagsSyn** | Optional | Boolean | The TCP SYN Flag reported. The synchronisation flag is used as a first step in establishing a three way handshake between two hosts. Only the first packet from both the sender and receiver should have this flag set. |
152+
| **TcpFlagsSyn** | Optional | Boolean | The TCP SYN Flag reported. The synchronization flag is used as a first step in establishing a three way handshake between two hosts. Only the first packet from both the sender and receiver should have this flag set. |
153153
| **TcpFlagsUrg** | Optional | Boolean | The TCP URG Flag reported. The urgent flag is used to notify the receiver to process the urgent packets before processing all other packets. The receiver will be notified when all known urgent data has been received. See [RFC 6093](https://tools.ietf.org/html/rfc6093) for more details. |
154154
| **TcpFlagsPsh** | Optional | Boolean | The TCP PSH Flag reported. The push flag is somewhat similar to the URG flag and tells the receiver to process these packets as they are received instead of buffering them. |
155155
| **TcpFlagsRst** | Optional | Boolean | The TCP RST Flag reported. The reset flag gets sent from the receiver to the sender when a packet is sent to a particular host that was not expecting it. |
@@ -353,4 +353,4 @@ For more information, see:
353353
- [Advanced Security Information Model (ASIM) overview](normalization.md)
354354
- [Advanced Security Information Model (ASIM) schemas](normalization-about-schemas.md)
355355
- [Advanced Security Information Model (ASIM) parsers](normalization-parsers-overview.md)
356-
- [Advanced Security Information Model (ASIM) content](normalization-content.md)
356+
- [Advanced Security Information Model (ASIM) content](normalization-content.md)

0 commit comments

Comments
 (0)