CEF Deny List Transaction Events
|
CEF Key
|
Description
|
Value
|
|
Header (logVer)
|
CEF format version
|
CEF: 0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro
|
|
Header (pname)
|
Appliance product
|
Deep Discovery Director
|
|
Header (pver)
|
Appliance version
|
Example: 5.3.0.1212
|
|
Header (eventid)
|
Signature ID
|
200120
|
|
Header (eventName)
|
Description
|
Deny List updated
|
|
Header (severity)
|
Severity
|
3 (fixed value)
|
|
act
|
The action in the event
|
|
|
cs1
|
Type
|
|
|
cs1Label
|
Type
|
type
|
|
cs2
|
Risk level
|
|
|
cs2Label
|
Risk level
|
RiskLevel
|
|
deviceExternalId
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
dhost
|
Destination host name
|
Example: dhost1
|
|
dpt
|
Destination port
|
Value between 1 and 65535
|
|
dst
|
Destination IP address
|
Example: 10.1.144.199
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
dvcmac
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
end
|
Report end time
Format: Unix time stamp (number of milliseconds since Jan 01 1970 UTC)
|
Example: 1593761104300
|
|
fileHash
|
SHA1
|
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
|
request
|
URL
|
Example: http://1.2.3.4/query?term=value
|
|
rt
|
Analysis time
Format: Unix time stamp (number of milliseconds since Jan
01 1970 UTC)
|
Example: 1593761104000
|
Log sample:
May 15 16:00:47 localhost CEF:0|Trend Micro|Deep Discovery Dir ector|5.3.0.1212|200120|Deny List updated|3|rt=1593761104000 d vc=192.168.156.239 dvchost=ddd3-239 dvcmac=00:0c:30:05:a0:8b d eviceExternalId=FA68DBC5-D354-444C-A834-60352F1A4027 cs1Label= type cs1=Deny List Domain end=1593761104300 act=Add dhost=mt6x .ejvu50k.6x.org cs2Label=RiskLevel cs2=Medium