Network configuration

2readings

0conditions

1themes fed

Livestatus

Default routes, the host DNS domain and the machine proxy settings.

Topic id: network_config.

Full inventory every hour. Supported changes are reported when the agent observes them.

Fields

Default routes by adapter, the host DNS domain and legacy resolvers, and the machine's default WinHTTP proxy.

Field	Type	Unit	Meaning
sparklogs.data.network_config.default_routes	object_array		Default routes in the current compartment: adapter, family, next_hop, route metric, native protocol_code and origin_code, ordered by those, and their decodes protocol (unlisted codes read unknown) and origin (manual, well_known, dhcp, router_advertisement, 6to4). Neither tells a DHCP gateway from a static one: both read netmgmt and manual. No claim about which route wins or reaches anything.
sparklogs.data.network_config.default_routes[].adapter	string		In each default_routes entry.
sparklogs.data.network_config.default_routes[].family	string		In each default_routes entry.
sparklogs.data.network_config.default_routes[].next_hop	string		In each default_routes entry.
sparklogs.data.network_config.default_routes[].metric	integer		In each default_routes entry.
sparklogs.data.network_config.default_routes[].protocol_code	integer		In each default_routes entry.
sparklogs.data.network_config.default_routes[].protocol	string		In each default_routes entry.
sparklogs.data.network_config.default_routes[].origin_code	integer		In each default_routes entry.
sparklogs.data.network_config.default_routes[].origin	string		In each default_routes entry.
sparklogs.data.network_config.default_routes_truncated	bool		Whether default_routes was cut to its cap.
sparklogs.data.network_config.dns_domain	string		Host DNS domain from GetNetworkParams; not a complete suffix search list.
sparklogs.data.network_config.legacy_ipv4_dns_servers	string_array		IPv4 DNS servers from GetNetworkParams in native order; not complete resolver policy.
sparklogs.data.network_config.legacy_ipv4_dns_servers_truncated	bool		Whether legacy_ipv4_dns_servers was cut to its cap.
sparklogs.data.network_config.dns_search_list	string_array		The machine DNS suffix search list (registry Tcpip\Parameters SearchList), lowercased; [] when none is set. Absent when the read failed or the value has another type.
sparklogs.data.network_config.dns_search_list_truncated	bool		Whether dns_search_list was cut to its cap.
sparklogs.data.network_config.dns_search_list_policy	string_array		The DNS suffix search list Group Policy sets (registry Policies\Microsoft\Windows NT\DNSClient SearchList), lowercased; [] when the policy sets none. Reported beside dns_search_list with no precedence inferred.
sparklogs.data.network_config.dns_search_list_policy_truncated	bool		Whether dns_search_list_policy was cut to its cap.
sparklogs.data.network_config.winhttp_default_proxy_access_type_code	integer		Machine default static WinHTTP access type; not PAC, user or session posture.
sparklogs.data.network_config.winhttp_default_proxy_access_type	string		Decoded access type: default_proxy, no_proxy, named_proxy, automatic_proxy or unknown.
sparklogs.data.network_config.winhttp_default_proxy_endpoints	object_array		Static proxy list in native order: request_protocol, transport, host, port; absent when the list failed the safe grammar.
sparklogs.data.network_config.winhttp_default_proxy_endpoints[].request_protocol	string		In each winhttp_default_proxy_endpoints entry.
sparklogs.data.network_config.winhttp_default_proxy_endpoints[].transport	string		In each winhttp_default_proxy_endpoints entry.
sparklogs.data.network_config.winhttp_default_proxy_endpoints[].host	string		In each winhttp_default_proxy_endpoints entry.
sparklogs.data.network_config.winhttp_default_proxy_endpoints[].port	integer		In each winhttp_default_proxy_endpoints entry.
sparklogs.data.network_config.winhttp_default_proxy_endpoints_truncated	bool		Whether winhttp_default_proxy_endpoints was cut to its cap.
sparklogs.data.network_config.winhttp_default_proxy_bypass	string_array		Static bypass list in native order; absent when the list failed the safe grammar.
sparklogs.data.network_config.winhttp_default_proxy_bypass_truncated	bool		Whether winhttp_default_proxy_bypass was cut to its cap.

Changes

This topic reports what the host looks like, so its news is what CHANGED between two reports. Each change below is a named fact you can ask about across the fleet.

Change	What it means
winhttp_proxy_changed	WinHTTP proxy changed
primary_dns_suffix_changed	Primary DNS suffix changed

Example

Inventory (every hour)

1 default route; "Ethernet" via "192.0.2.1"; WinHTTP proxy named_proxy.

sparklogs.data.network_config.default_routes: [{"adapter": "network_adapter:0006008004000000", "family": "ipv4", "metric": 0, "next_hop": "192.0.2.1", "origin": "manual", "origin_code": 0, "protocol": "netmgmt", "protocol_code": 3}]
sparklogs.data.network_config.dns_domain: example.com
sparklogs.data.network_config.legacy_ipv4_dns_servers: ["192.0.2.53"]
sparklogs.data.network_config.winhttp_default_proxy_access_type_code: 3
sparklogs.data.network_config.winhttp_default_proxy_bypass: ["<local>", "*.example.com"]
sparklogs.data.network_config.winhttp_default_proxy_endpoints: [{"host": "proxy.example.com", "port": 443, "request_protocol": "https", "transport": "https"}]

SparkLogs: CONTEXT, Info, network_config: INVENTORY: 1 default route; "Ethernet" via "192.0.2.1"; WinHTTP proxy named_proxy.

Signal details

winhttp_proxy_changed

The machine's default WinHTTP proxy changed.

Example

WinHTTP proxy changed. added_winhttp_default_proxy_endpoints="proxy.example.com port 8443" removed_winhttp_default_proxy_endpoints="proxy.example.com port 443".

SparkLogs: winhttp_proxy_changed, Notice, network_config: winhttp_proxy_changed: NOTABLE: WinHTTP proxy changed. added_winhttp_default_proxy_endpoints="proxy.example.com port 8443" removed_winhttp_default_proxy_endpoints="proxy.example.com port 443".

primary_dns_suffix_changed

The machine's primary DNS suffix changed.