LEEF Disruptive Application Logs
|
LEEF Key
|
Description
|
Value
|
|
Header (logVer)
|
LEEF format version
|
LEEF: 1.0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro
|
|
Header (pname)
|
Appliance product
|
Deep Discovery Director
|
|
Header (pver)
|
Appliance version
|
Example: 5.3.0.1212
|
|
Header (eventName)
|
Event Name
|
DISRUPTIVE_APPLICATION_DETECTION
|
|
origin
|
Deep Discovery appliance the log originated
from
|
Inspector
|
|
aggregatedCnt
|
Aggregated count
|
Example: 1
|
|
cnt
|
Total count
|
Example: 1
|
|
deviceDirection
|
Packet direction
|
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
deviceMacAddress
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
devTime
|
Log generation time
|
Example: Mar 09 2015 17:05:21 GMT+08:00
|
|
devTimeFormat
|
Time format
|
MMM dd yyyy HH:mm:ss z
|
|
dhost
|
Destination host name
|
Example: dhost1
|
|
dOSName
|
Destination host OS
|
Example: Android
|
|
dst
|
Destination IP address
|
Example: 10.1.144.199
|
|
dstGroup
|
Network Group assigned to a destination host
|
Example: monitor1
|
|
dstMAC
|
Destination MAC
|
Example: 00:0C:29:6E:CB:F9
|
|
dstPort
|
Destination port
|
Value between 1 and 65535
|
|
dstZone
|
Destination zone
|
|
|
dvc
|
Appliance IP address
|
Example: 10.1.96.147
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
interestedIp
|
Interested IP
|
Example: 10.1.144.199
|
|
msg
|
Description
|
Example: HEUR_NAMETRICK.A - SMTP (Email)
|
|
pComp
|
Detection engine/component
|
Example: VSAPI
|
|
peerIP
|
Peer IP
|
Example: 10.1.144.199
|
|
proto
|
Protocol
|
Example: SMTP
|
|
protoGroup
|
Protocol group
|
Example: SMTP
|
|
ptype
|
Application type
|
IDS
|
|
sev
|
Severity
|
|
|
shost
|
Source host name
|
Example: shost1
|
|
sOSName
|
Source host OS
|
Example: Android
|
|
src
|
Source IP address
|
Example: 10.1.144.199
|
|
srcGroup
|
Network Group assigned to a source host
|
Example: monitor1
|
|
srcMAC
|
Source MAC
|
Example: 00:0C:29:6E:CB:F9
|
|
srcPort
|
Source port
|
Value between 1 and 65535
|
|
srcZone
|
Source zone
|
|
|
threatType
|
Threat type
|
6
|
|
vLANId
|
VLANID
|
Value between 0 and 4095
|
Log sample:
 |
NoteWhen using the LEEF log syntax, separate event attributes
with <009> as a tab delimiter.
|
May 15 16:00:47 localhost LEEF:1.0|Trend Micro|Deep Discovery Director|5.3.0.1212|DISRUPTIVE_APPLICATION_DETECTION|origin=In spector<009>devTimeFormat=MMM dd yyyy HH:mm:ss z<009>dvc=10.20 1.156.143<009>deviceMacAddress=00:0C:29:A6:53:0C<009>dvchost=d di38-143<009>deviceGUID=6B593E17AFB7-40FBBB28-A4CE-0462-A536<0 09>ptype=IDS<009>devTime=Mar 09 2015 14:20:38 GMT+08:00<009>se v=2<009>protoGroup=STREAMING<009>proto=WMSP<009>vLANId=4095<00 9>deviceDirection=1<009>dhost=12.190.48.13<009>dst=12.190.48.1 3<009>dstPort=80<009>dstMAC=00:17:9a:65:f3:05<009>shost=192.16 8.33.2<009>src=192.168.33.2<009>srcPort=35125<009>srcMAC=00:16 :6f:a1:3d:7a<009>msg=Deep Discovery Inspector detected the pro tocol in your monitored network.<009>pComp=CAV<009>threatType= 6<009>srcGroup=Default<009>srcZone=1<009>dstZone=0<009>interes tedIp=192.168.33.2<009>peerIp=12.190.48.13<009>cnt=1<009>aggre gatedCnt=1