Views:

LEEF Detection Logs: Attachment Detection Logs

LEEF Key
Description
Value 
Header (logVer)
LEEF format version
LEEF: 1.0
Header (vendor)
Appliance vendor
 Trend Micro
Header (pname)
Appliance product
 Deep Discovery Email Inspector
Header (pver)
Appliance version
Example: 5.1.0.1110
Header (eventName)
Event Name
ATTACHMENT_DETECTION
act
The action in the event
Examples:
  • analyzed
  • cleaned up
  • deleted
  • delivered directly
  • encrypted
  • file sanitized
  • passed
  • quarantined
  • recipient changed
  • stamped
  • stripped
  • subjectsTagged
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
devTime
Log generation time
Example: Jan 28 2015 02:00:36 GMT+00:00
devTimeFormat
Time format
MMM dd yyyy HH:mm:ss z
duser
Email recipients
Example: user1@domain2.com;test@163.com
dvc
Appliance IP address
Example: 10.1.144.199
dvchost
Appliance host name
Example: localhost
dvcmac
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
emailSeverity
Email severity
  • 2: Unavailable
  • 4: Low
  • 6: Medium
  • 8: High
emailThreats
Names of threats in the email
Example: VAN_MALWARE.UMXX|FRAUD_PHISHING.WRS
emailThreatType
Threat type
  • 1: Targeted malware
  • 2: Malware
  • 3: Malicious URL
  • 4: Suspicious file
  • 5: Suspicious URL
  • 6: Spam/Graymail
  • 7: Phishing
  • 8: Content violation
  • 9: DLP incident
fileHash
SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
fileType
True file type
Example: RIFF bitmap file
fname
File name
Example: excel.rar
fsize
File size
Example: 131372
mailMsgSubject
Email subject
Example: hello
messageId
Email ID
Example: <20150414032514.494EF1E9A365@internalbeta.bcc.ddei>
msgSize
Email Size
Example: 30841
msgUuid
Internal email ID
Example: 6965222B-13A6-C705-89D4-6251B6C41E03
sev
Severity
  • 2: Unavailable
  • 4: Low
  • 6: Medium
  • 8: High
src
Source IP address
Example: 10.1.144.199
suser
Email sender
Example: user2@domain.com
threatName
Names of threats in the email
Example: VAN_MALWARE.UMXX|FRAUD_PHISHING.WRS
Note
Note
When using the LEEF log syntax, separate event attributes with \0x09 as a tab delimiter.
Log sample:
May 15 16:00:47 localhost LEEF:1.0|Trend Micro|Deep Discovery 
Email Inspector|2.5.1.1161|ATTACHMENT_DETECTION|sev=8\0x09msgU
uid=6C4A91D7-1396-1405-94C5-D955018F938E\0x09fileHash=2EF0B334
EFDE7F1BA16011158E25555C2B9D7BC5\0x09emailSeverity=8\0x09suser
=www-data@contato30.danetmail.net\0x09dvchost=internalbeta.bcc
.ddei\0x09emailThreatType=4\0x09duser=spam@support.trendmicro.
com\0x09messageId=<20150413072949.E8C0D1E9A363@internalbeta.bc
c.ddei>\0x09src=69.162.64.30\0x09deviceGUID=034eb532-9318-40d9
-b27b-d9feba7c269e\0x09mailMsgSubject=Orcamento Total - 563600
5\0x09msgSize=397113\0x09fileType=Directory\0x09dvc=10.64.1.13
1\0x09devTime=Apr 13 2015 15:45:58 GMT+00:00\0x09fname=Orcamen
to%20Total.zip\0x09act=passed\0x09dvcmac=C4:34:6B:B8:09:BC\0x0
9devTimeFormat=MMM dd yyyy HH:mm:ss z\0x09threatName=VAN_BACKD
OOR.UMXX\0x09emailThreats=VAN_BACKDOOR.UMXX