LEEF Correlation Incident Logs
|
LEEF Key
|
Description
|
Value
|
|
Header (logVer)
|
LEEF format version
|
LEEF: 1.0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro
|
|
Header (pname)
|
Appliance product
|
Deep Discovery Director
|
|
Header (pver)
|
Appliance version
|
Example: 5.3.0.1212
|
|
Header (eventName)
|
Event Name
|
SUSPICIOUS_BEHAVIOUR_DETECTION
|
|
origin
|
Deep Discovery appliance the log originated
from
|
Inspector
|
|
data0
|
Correlation data 0
|
Additional attribute values
|
|
data1
|
Correlation data 1
|
Additional attribute values
|
|
data2
|
Correlation data 2
|
Additional attribute values
|
|
data3
|
Correlation data 3
|
Additional attribute values
|
|
data4
|
Correlation data 4
|
Additional attribute values
|
|
data5
|
Correlation data 5
|
Additional attribute values
|
|
data6
|
Correlation data 6
|
Additional attribute values
|
|
data7
|
Correlation data 7
|
Additional attribute values
|
|
data8
|
Correlation data 8
|
Additional attribute values
|
|
data9
|
Correlation data 9
|
Additional attribute values
|
|
deviceDirection
|
Packet direction
|
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
deviceMacAddress
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
devTime
|
Log generation time
|
Example: Mar 09 2015 17:05:21 GMT+08:00
|
|
devTimeFormat
|
Time format
|
MMM dd yyyy HH:mm:ss z
|
|
dvc
|
Appliance IP address
|
Example: 10.1.96.147
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
interestedHost
|
Interested host name
|
Example: trend.net
|
|
interestedIp
|
Interested IP
|
Example: 10.1.144.199
|
|
interestedMacAddress
|
Interested MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
interestedUser
|
Interested user name 1
|
Example: user1
|
|
interestedUser2
|
Interested user name 2
|
Example: user2
|
|
interestedUser3
|
Interested user name 3
|
Example: user3
|
|
pComp
|
Detection engine/component
|
Correlation
|
|
proto
|
Protocol
|
Example: SMTP
|
|
ptype
|
Application type
|
IDS
|
|
ruleId
|
Rule ID
|
Example: 52
|
|
ruleName
|
Rule name
|
Example: This host has responded to DNS
queries.
|
|
sev
|
Severity
|
|
|
threatName
|
Threat name
|
Example: Malicious Bot
|
|
threatType
|
Threat type
|
Example: Malware-related
|
|
userGroup
|
User group
|
Example: Default
|
Log sample:
 |
NoteWhen using the LEEF log syntax, separate event attributes
with <009> as a tab delimiter.
|
May 15 16:00:47 localhost LEEF:1.0|Trend Micro|Deep Discovery Director|5.3.0.1212|SUSPICIOUS_BEHAVIOUR_DETECTION|origin=Insp ector<009>devTimeFormat=MMM dd yyyy HH:mm:ss z<009>deviceMacAd dress=00:0C:29:A6:53:0C<009>dvchost=ddi38-143<009>pComp=Correl ation<009>dvc=10.201.156.143<009>ptype=IDS<009>deviceGUID=D2C1 D6D20FF8-4FC98F92-25EB-D7DA-AF0E<009>devTime=Mar 11 2015 22:05 :50 GMT-04:00<009>sev=2<009>interestedIp=172.16.0.100<009>inte restedHost=172.16.0.100<009>interestedMacAddress=00:0c:29:70:4 5:...36<009>ruleId=47<009>ruleName=This host has responded to DNS queries.<009>threatType=Unregistered Service<009>threatNam e=Unregistered DNS Server<009>proto=DNS Response<009>userGroup =Default<009>deviceDirection=1