CEF Virtual Analyzer Analysis Logs: File Analysis Events
|
CEF Key
|
Description
|
Value
|
|
Header (logVer)
|
CEF format version
|
CEF: 0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro
|
|
Header (pname)
|
Appliance product
|
Deep Discovery Director
|
|
Header (pver)
|
Appliance version
|
Example: 5.3.0.1212
|
|
Header (eventid)
|
Signature ID
|
200119
|
|
Header (eventName)
|
Description
|
Sample file sandbox analysis is finished
|
|
Header (severity)
|
Severity
|
3: Informational
|
|
cn1
|
Result of GRID/CSSS
|
|
|
cn1Label
|
Result of GRID/CSSS
|
GRIDIsKnownGood
|
|
cn2
|
ROZ rating
|
Example: 3: High risk
|
|
cn2Label
|
ROZ rating
|
ROZRating
|
|
cn3
|
PCAP ready
|
|
|
cn3Label
|
PCAP ready
|
PcapReady
|
|
cs1
|
Sandbox image type
|
Example: win7
|
|
cs1Label
|
Sandbox image type
|
SandboxImageType
|
|
cs2
|
Malware name
|
Example: HEUR_NAMETRICK.A
|
|
cs2Label
|
Malware name
|
MalwareName
|
|
cs3
|
Parent SHA1
|
Example: A29E4ACA70BEF4AF8CE75AF51032B6B91572AA0D
|
|
cs3Label
|
Parent SHA1
|
ParentFileSHA1
|
|
deviceExternalId
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
dvcmac
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
fileHash
|
SHA1
|
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
|
fileType
|
True file type
|
Example: RIFF bitmap file
|
|
fname
|
File name
|
Example: excel.rar
|
|
fsize
|
File size
|
Example: 131372
|
|
rt
|
Analysis time
Format: Unix time stamp (number of milliseconds since Jan
01 1970 UTC)
|
Example: 1593761104000
|
Log sample:
May 15 16:00:47 localhost CEF:0|Trend Micro|Deep Discovery Dir ector|5.3.0.1212|200119|Sample file sandbox analysis is finish ed|3|rt=1593761104000 dvc=10.64.1.131 dvchost=internalbeta.bcc .ddei dvcmac=C4:34:6B:B8:09:BC deviceExternalId=c425624a-e9db- 4f3f-8088-2726f15e6587 fname=Wonga Express Loan Promtion 3.5% Offer.doc fileHash=A46E1F56969DECC5FEAF120A2279946A2F42D619 fi leType=MS Office fsize=53760 cs1Label=SandboxImageType cs1=win 81en cn1Label=GRIDIsKnownGood cn1=-1 cn2Label=ROZRating cn2=1 cs2Label=MalwareName cs2=VAN_MALWARE.UMXX cn3Label=PcapReady c n3=1