LEEF Deny List Transaction Events
|
LEEF Key
|
Description
|
Value
|
|
Header (logVer)
|
LEEF format version
|
LEEF: 1.0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro
|
|
Header (pname)
|
Appliance product
|
Deep Discovery Director
|
|
Header (pver)
|
Appliance version
|
Example: 5.3.0.1212
|
|
Header (eventName)
|
Event Name
|
DENYLIST_CHANGE
|
|
act
|
The action in the event
|
|
|
deviceExternalRiskType
|
Risk level
|
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
deviceMacAddress
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
devTime
|
Analysis time
|
Example: Mar 09 2015 17:05:21 GMT+08:00
|
|
devTimeFormat
|
Time format
|
MMM dd yyyy HH:mm:ss z
|
|
dhost
|
Destination host name
|
Example: insta-find.com
|
|
dpt
|
Remote port
|
Value between 1 and 65535
|
|
dst
|
Remote IP
|
Example: 10.1.144.199
|
|
dvc
|
Appliance IP address
|
Example: 10.1.96.147
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
end
|
Report end time
|
Example: Mar 09 2015 17:05:21 GMT+08:00
|
|
fileHash
|
SHA1
|
Example:1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
|
pComp
|
Detection source
|
|
|
sev
|
Severity
|
3 (fixed value)
|
|
type
|
Deny List type
|
|
|
url
|
URL
|
Example: http://1.2.3.4/
|
Log sample:
 |
NoteWhen using the LEEF log syntax, separate event attributes
with <009> as a tab delimiter.
|
May 15 16:00:47 localhost LEEF:1.0|Trend Micro|Deep Discovery Director|5.3.0.1212|DENYLIST_CHANGE|devTime=Apr 01 2019 18:26: 11 GMT+08:00<009>devTimeFormat=MMM dd yyyy HH:mm:ss z<009>sev= 3<009>dvc=10.1.96.147<009>dvchost=DDD-IB-int<009>deviceMacAddr ess=00:50:56:A3:CE:81<009>deviceGUID=C4BD2B76-6C3D-416E-AB0C-6 FA204D00FBC<009>end=Jan 19 2038 11:14:07 GMT+08:00<009>act=Add <009>type=Deny List File SHA1<009>fileHash=BF378BF908A802DEADF A9CB9FA0C02955C904F08<009>deviceExternalRiskType=High<009>pCom p=Sandbox