Views:

LEEF Virtual Analyzer Analysis Logs: File Analysis Events

LEEF Key
Description
Value 
Header (logVer)
LEEF format version
LEEF: 1.0
Header (vendor)
Appliance vendor
Trend Micro
Header (pname)
Appliance product
Deep Discovery Analyzer
Header (pver)
Appliance version
Example: 5.5.0.1191
Header (eventName)
Event Name
FILE_ANALYZED
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
deviceMacAddress
Appliance MAC address
Example: 00:0C:29:56:B3:57
deviceProcessHash
Parent SHA1
Example: A29E4ACA70BEF4AF8CE75AF51032B6B91572AA0D
devTime
Log generation time
Example: Jan 28 2015 02:00:36 GMT+08:00
devTimeFormat
Time format
MMM dd yyyy HH:mm:ss z
dvc
Appliance IP address
Example: 10.1.144.199
dvchost
Appliance host name
Example: localhost
fileHash
SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
fileType
True file type
Example: RIFF bitmap file
fname
File name
Example: excel.rar
fsize
File size
Example: 131372
gridIsKnownGood
Result of GRID/CSSS
  • -1: GRID is unknown
  • 0: GRID is not known good
  • 1: GRID is known good
malName
Malware name
Example: HEUR_NAMETRICK.A
pcapReady
PCAP ready
  • 0: PCAP is not ready
  • 1: PCAP is ready
pComp
Detection engine / component
Sandbox
rozRating
ROZ rating (Virtual Analyzer internal code for analysis results)
  • -1: Unsupported file type in ROZ
  • 0: No risk found
  • 1: Low risk
  • 2: Medium risk
  • 3: High risk
Note
Note
Negative values always indicate errors.
sev
Severity
3: Informational
Note
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab delimiter.
Log sample: