CEF Detection Logs: URL Detection Logs
|
CEF Key
|
Description
|
Value
|
|
Header (logVer)
|
CEF format version
|
CEF: 0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro |
|
Header (pname)
|
Appliance product
|
Deep Discovery Email Inspector |
|
Header (pver)
|
Appliance version
|
Example: 5.1.0.1110
|
|
Header (eventid)
|
Signature ID
|
100132
|
|
Header (eventName)
|
Description
|
URL_DETECTION
|
|
Header (severity)
|
Email severity
|
|
|
cat
|
Category
|
Example: 90:02
|
|
cs1
|
Threat name
|
Example: LOW-REPUTATION-URL_MALWARE.WRS
|
|
cs1Label
|
Threat name
|
threats
|
|
cs2
|
Internal email ID
|
Example: 6965222B-13A6-C705-89D4-6251B6C41E03
|
|
cs2Label
|
Internal email ID
|
msgUuid
|
|
deviceExternalId
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
dvcmac
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
request
|
URL
|
Example: http://www.rainking.net/?utm_campaign=4-21-2014
|http://images.rainking.net/eloquaimage
|
|
rt
|
Log generation time
|
Example: Mar 09 2015 17:05:21 GMT+00:00
|
Log sample:
Jan 18 10:49:41 ddei5 CEF:0|Trend Micro|Deep Discovery Email Inspector|5.1.0.1288|100132|URL_DETECTION|6|rt=Jan 18 2023 10:49:39 GMT+00:00 cs2Label=msgUuid cs2=DA1CCCE4-F287-9205-9 939-89E26E97D9E0 dvcmac=00:50:56:98:9C:99 dvchost=ddei5.1-c7 -en-140.com request=http://wrs21.winshipway.com/ deviceExter nalId=411b541a-fa18-4bbf-8e6d-9a9c19276bf7 cs1Label=threats cs1=TSPY_KEYLOG.GC dvc=10.64.1.140 cat=74