LEEF Virtual Analyzer Analysis Logs: File Analysis
|
LEEF Key
|
Description
|
Value
|
|
Header (timestamp)
|
Local time in the format: "Mmm dd
hh:mm:ss"
|
Example: Dec 5 05:26:45
|
|
Header (host)
|
Hostname without the domain information
|
Example: internalAP1
|
|
Header (logVer)
|
LEEF format version
|
LEEF: 1.0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro |
|
Header (pname)
|
Appliance product
|
Deep Discovery Email Inspector |
|
Header (pver)
|
Appliance version
|
Example: 5.1.0.1110
|
|
Header (eventName)
|
Event Name
|
FILE_ANALYZED
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
deviceMacAddress
|
Appliance MAC address
|
Example: 00:0C:29:56:B3:57
|
|
deviceOSName
|
Sandbox image type
|
Example: win7
|
|
deviceProcessHash
|
Parent SHA1
|
Example: A29E4ACA70BEF4AF8CE75AF51032B6B91572AA0D
|
|
devTime
|
Log generation time
|
Example: Jan 28 2015 02:00:36 GMT+00:00
|
|
devTimeFormat
|
Time format
|
MMM dd yyyy HH:mm:ss z
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
fileHash
|
SHA1
|
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
|
fileType
|
True file type
|
Example: RIFF bitmap file
|
|
fname
|
File name
|
Example: excel.rar
|
|
fsize
|
File size
|
Example: 131372
|
|
gridIsKnownGood
|
Result of GRID/CSSS
|
|
|
malName
|
Malware name
|
Example: HEUR_NAMETRICK.A
|
|
pcapReady
|
PCAP ready
|
|
|
pComp
|
Detection engine / component
|
Sandbox
|
|
rozRating
|
ROZ rating
|
Example: 3: High risk
|
|
sev
|
Severity
|
3
|
 |
NoteWhen using the LEEF log syntax, separate event attributes with \0x09 as
a tab delimiter.
|
Log sample:
May 15 16:00:47 localhost LEEF:1.0|Trend Micro|Deep Discovery Email Inspector|2.5.1.1161|FILE_ANALYZED|devTime=Apr 13 2015 07:45:54 GMT+00:00\0x09devTimeFormat=MMM dd yyyy HH:mm:ss z\0x 09sev=3\0x09pComp=Sandbox\0x09dvc=10.64.1.131\0x09dvchost=inte rnalbeta.bcc.ddei\0x09deviceMacAddress=C4:34:6B:B8:09:BC\0x09d eviceGUID=034eb532-9318-40d9-b27b-d9feba7c269e\0x09fname=Or\x8 7amento Total.cpl\0x09fileHash=2EF0B334EFDE7F1BA16011158E25555 C2B9D7BC5\0x09deviceProcessHash=61DD815ABF2D1FFC58F261392DAFF4 F11B59D79C\0x09malName=VAN_BACKDOOR.UMXX\0x09fileType=Win32 DL L\0x09fsize=482816\0x09deviceOSName=win81en\0x09gridIsKnownGoo d=-1\0x09rozRating=3\0x09pcapReady=1