LEEF Virtual Analyzer Analysis Logs: URL Analysis Events
|
LEEF Key
|
Description
|
Value
|
||
|
Header (logVer)
|
LEEF format version
|
LEEF: 1.0
|
||
|
Header (vendor)
|
Appliance vendor
|
Trend Micro
|
||
|
Header (pname)
|
Appliance product
|
Deep Discovery Analyzer
|
||
|
Header (pver)
|
Appliance version
|
Example: 5.5.0.1191
|
||
|
Header (eventName)
|
Event Name
|
URL_ANALYZED
|
||
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
||
|
deviceMacAddress
|
Appliance MAC address
|
Example: 00:0C:29:56:B3:57
|
||
|
deviceOSName
|
Sandbox image type
|
Example: win7
|
||
|
devTime
|
Log generation time
|
Example: Jan 28 2015 02:00:36 GMT+08:00
|
||
|
devTimeFormat
|
Time format
|
MMM dd yyyy HH:mm:ss z
|
||
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
||
|
dvchost
|
Appliance host name
|
Example: localhost
|
||
|
fileHash
|
SHA1
|
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
||
|
pcapReady
|
PCAP ready
|
|
||
|
pComp
|
Detection engine / component
|
Sandbox
|
||
|
rozRating
|
ROZ rating (Virtual Analyzer internal code for analysis results)
|
|
||
|
sev
|
Severity
|
3: Informational
|
||
|
url
|
URL
|
Example: http://1.2.3.4/query?term=value
|
 |
NoteWhen using the LEEF log syntax, separate event attributes with
<009> as a tab delimiter.
|
Log sample: