CEF Detection Logs: Attachment Detection Logs
|
CEF Key
|
Description
|
Value
|
|
Header (logVer)
|
CEF format version
|
CEF: 0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro |
|
Header (pname)
|
Appliance product
|
Deep Discovery Email Inspector |
|
Header (pver)
|
Appliance version
|
Example: 5.1.0.1110
|
|
Header (eventid)
|
Signature ID
|
100131
|
|
Header (eventName)
|
Description
|
ATTACHMENT_DETECTION
|
|
Header (severity)
|
Severity
|
|
|
cs1
|
Threat name
|
Example:VAN_BOT.UMXX
|
|
cs1Label
|
Threat name
|
threats
|
|
cs2
|
Internal email ID
|
Example: 6965222B-13A6-C705-89D4-6251B6C41E03
|
|
cs2Label
|
Internal email ID
|
msgUuid
|
|
deviceExternalId
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
dvcmac
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
fileHash
|
SHA1
|
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
|
fileType
|
True file type
|
Example: RIFF bitmap file
|
|
fname
|
File name
|
Example: excel.rar
|
|
fsize
|
File size
|
Example: 131372
|
|
rt
|
Log generation time
|
Example: Mar 09 2015 17:05:21 GMT+00:00
|
Log sample:
May 15 16:00:47 localhost CEF:0|Trend Micro|Deep Discovery Email Inspector|2.5.1.1139|100131|ATTACHMENT_DETECTION|6|rt =Mar 23 2015 14:04:46 GMT+00:00 fileHash=E49395FEACC12A5613 E7BA6C69AC5E42EDFDA42D fsize=17681 fileType=MIME Base64 dvc host=internalbeta.bcc.ddei dvc=10.64.1.131 deviceExternalId =c425624a-e9db-4f3f-8088-2726f15e6587 cs2Label=msgUuid cs2= E89A23BE-11F5-2505-BCEE-21027D078154 fname=3C761B45-626D-4E 75-B4782FD0E5E8369C.eml dvcmac=C4:34:6B:B8:09:BC cs1Label=t hreats cs1=TROJ_UP.258A1A7D