Views:

LEEF Web Reputation Logs

LEEF Key
Description
Value 
Header (logVer)
LEEF format version
LEEF: 1.0
Header (vendor)
Appliance vendor
Trend Micro
Header (pname)
Appliance product
Deep Discovery Director
Header (pver)
Appliance version
Example: 5.3.0.1212
Header (eventName)
Event Name
WEB_THREAT_DETECTION
origin
Deep Discovery appliance the log originated from
Inspector
cccaDetection
CCCA detection
0 or 1
cccaDetectionSource
CCCA log is detected by
  • GLOBAL_INTELLIGENCE
  • VIRTUAL_ANALYZER
  • USER_DEFINED
cccaRiskLevel
CCCA Risk Level
  • 0: Unknown
  • 1: Low
  • 2: Medium
  • 3: High
deviceDirection
Packet direction
  • 0: Source is external
  • 1: Source is internal
  • 2: Unknown
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
deviceMacAddress
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
devTime
Log generation time
Example: Mar 09 2015 17:05:21 GMT+08:00
devTimeFormat
Time format
MMM dd yyyy HH:mm:ss z
dhost
Destination host name
Example: dhost1
dOSName
Destination host OS
Example: Android
dst
Destination IP address
Example: 10.1.144.199
dstGroup 
Network Group assigned to a destination host
Example: monitor1
dstMAC
Destination MAC
Example: 00:0C:29:6E:CB:F9
dstPort
Destination port
Value between 1 and 65535
dstZone
Destination zone
  • 0: Not in monitored network
  • 1: In monitored network and trusted
  • 2: In monitored network and untrusted
duser
Mail recipient
Example: duser1
dvc
Appliance IP address
Example: 10.1.96.147
dvchost
Appliance host name
Example: localhost
hostName
Host name
Example: CLIENT1
interestedIp
Interested IP
Example: 10.1.144.199
mailMsgSubject
Mail subject
Example: hello
msg
Description
Example: Dangerous URL in Web Reputation Services database - HTTP (Request)
pComp
Detection engine/component
Example: VSAPI
peerIP
Peer IP
Example: 10.1.144.199
proto
Protocol
Example: SMTP
protoGroup
Protocol group
Example: SMTP
ptype
Application type
IDS
requestClientApplication
User agent
Example: IE
riskScore
Score
Example: 49
sev
Severity
  • 2: Informational
  • 4: Low
  • 6: Medium
  • 8: High
shost
Source host name
Example: shost1
sOSName
Source host OS
Example: Android
src
Source IP address
Example: 10.1.144.199
srcGroup
Network Group assigned to a source host
Example: monitor1
srcMAC
Source MAC
Example: 00:0C:29:6E:CB:F9
srcPort
Source port
Value between 1 and 65535
srcZone
Source zone
  • 0: Not in monitored network
  • 1: In monitored network and trusted
  • 2: In monitored network and untrusted
suser
Mail sender
Example: suser1
threatType
Threat type
5
url
URL
Example: http://1.2.3.4/query?term=value
urlCat
Category
Example: Gambling
vLANId
VLANID
Value between 0 and 4095
Log sample:
Note
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab delimiter.
 
May 15 16:00:47 localhost LEEF:1.0|Trend Micro|Deep Discovery 
Director|5.3.0.1212|WEB_THREAT_DETECTION|devTimeFormat=MMM dd 
yyyy HH:mm:ss z<009>dvc=10.201.156.143<009>deviceMacAddress=00
:0C:29:A6:53:0C<009>dvchost=ddi38-143<009>deviceGUID=6B593E17A
FB7-40FBBB28-A4CE-0462-A536<009>ptype=IDS<009>devTime=Mar 09 2
015 14:06:36 GMT+08:00<009>sev=6<009>protoGroup=HTTP<009>proto
=HTTP<009>vLANId=4095<009>deviceDirection=1<009>dhost=www.free
webs.com<009>dst=216.52.115.2<009>dstPort=80<009>dstMAC=00:1b:
21:35:8b:98<009>shost=172.16.1.197<009>src=172.16.1.197<009>sr
cPort=12121<009>srcMAC=fe:ed:be:ef:5a:c6<009>hostName=www.free
webs.com<009>msg=Dangerous URL in Web Reputation Services data
base - HTTP (Request)<009>url=http://www.freewebs.com/setting3
/setting.doc<009>pComp=TMUFE<009>srcGroup=Default<009>srcZone=
1<009>dstZone=0<009>urlCat=Disease Vector<009>riskScore=49<009
>threatType=5<009>interestedIp=172.16.1.197<009>peerIp=216.52.
115.2