CEF Virtual Analyzer Analysis Logs: URL Analysis Events
|
CEF Key
|
Description
|
Value
|
|
Header (timestamp)
|
Local time in the format: "Mmm dd
hh:mm:ss"
|
Example: Dec 5 05:26:45
|
|
Header (host)
|
Hostname without the domain information
|
Example: internalAP1
|
|
Header (logVer)
|
CEF format version
|
CEF: 0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro |
|
Header (pname)
|
Appliance product
|
Deep Discovery Email Inspector |
|
Header (pver)
|
Appliance version
|
Example: 5.1.0.1110
|
|
Header (eventid)
|
Signature ID
|
200126
|
|
Header (eventName)
|
Description
|
URL sandbox analysis is finished
|
|
Header (severity)
|
Severity
|
3
|
|
cn2
|
ROZ rating
|
Example: 3: High risk
|
|
cn2Label
|
ROZ rating
|
ROZRating
|
|
cn3
|
PCAP ready
|
|
|
cn3Label
|
PCAP ready
|
PcapReady |
|
cs1
|
Sandbox image type
|
Example: win7
|
|
cs1Label
|
Sandbox image type
|
SandboxImageType
|
|
deviceExternalId
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
dvcmac
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
fileHash
|
SHA1
|
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
|
request
|
URL
|
Example: http://www.rainking.net/?utm_campaign=4-21-2014
|http://images.rainking.net/eloquaimage
|
|
rt
|
Analysis time
|
Example: Mar 09 2015 17:05:21 GMT+00:00
|
Log sample:
May 15 16:00:47 localhost CEF:0|Trend Micro|Deep Discovery Email Inspector|2.5.1.1139|200126|URL sandbox analysis is finished|3|rt=Mar 23 2015 16:32:15 GMT+00:00 dvc=10.64.1.1 31 dvchost=internalbeta.bcc.ddei dvcmac=C4:34:6B:B8:09:BC deviceExternalId=c425624a-e9db-4f3f-8088-2726f15e6587 requ est=http://paypal-world.ga/home/? fileHash=5EA358C987D1FDE 34957B9A36AF38321C5F37D8B cs1Label=SandboxImageType cs1=wi n81en cn2Label=ROZRating cn2=3 cn3Label=PcapReady cn3=1