Views:

TMEF Virtual Analyzer Analysis Logs: File Analysis Events

TMEF Key
Description
Value 
Header (logVer)
TMEF format version
CEF: 0
Header (vendor)
Appliance vendor
Trend Micro
Header (pname)
Appliance product
Deep Discovery Analyzer
Header (pver)
Appliance version
Example: 5.5.0.1191
Header (eventid)
Signature ID
200119
Header (eventName)
Description
FILE_ANALYZED
Header (severity)
Severity
3: Informational
cn1
Result of GRID/CSSS
  • -1: GRID is unknown
  • 0: GRID is not known good
  • 1: GRID is known good
cn1Label
Result of GRID/CSSS
GRIDIsKnownGood
cn2
ROZ rating (Virtual Analyzer internal code for analysis results)
  • -1: Unsupported file type in ROZ
  • 0: No risk found
  • 1: Low risk
  • 2: Medium risk
  • 3: High risk
Note
Note
Negative values always indicate errors.
cn2Label
ROZ rating (Virtual Analyzer internal code for analysis results)
ROZRating
cn3
PCAP ready
  • 0: PCAP is not ready
  • 1: PCAP is ready
cn3Label
PCAP ready
 PcapReady
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
deviceMacAddress
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
deviceOSName
Sandbox image type
Example: win7
deviceProcessHash
Parent SHA1
Example: A29E4ACA70BEF4AF8CE75AF51032B6B91572AA0D
dvc
Appliance IP address
Example: 10.1.144.199
dvchost
Appliance host name
Example: localhost
fileHash
SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
fileType
True file type
Example: RIFF bitmap file
fname
File name
Example: excel.rar
fsize
File size
Example: 131372
malName
Malware name
Example: HEUR_NAMETRICK.A
pComp
Detection engine / component
Sandbox
rt
Analysis time
Example: Mar 09 2015 17:05:21 GMT+08:00
Log sample: