Views:

TMEF Virtual Analyzer Analysis Logs: File Analysis Events

TMEF Key
Description
Value 
Header (timestamp)
Local time in the format: "Mmm dd hh:mm:ss"
Example: Dec 5 05:26:45
Header (host)
Hostname without the domain information
Example: internalAP1
Header (logVer)
TMEF format version
CEF: 0
Header (vendor)
Appliance vendor
 Trend Micro
Header (pname)
Appliance product
 Deep Discovery Email Inspector
Header (pver)
Appliance version
Example: 5.1.0.1110
Header (eventid)
Signature ID
200119
Header (eventName)
Description
FILE_ANALYZED
Header (severity)
Severity
3
cn1
Result of GRID/CSSS
  • 0: GRID is not known good
  • 1: GRID is known good
cn1Label
Result of GRID/CSSS
GRIDIsKnownGood
cn2
ROZ rating
Example: 3: High risk
cn2Label
ROZ rating
ROZRating
cn3
PCAP ready
  • 0: PCAP is not ready
  • 1: PCAP is ready
cn3Label
PCAP ready
 PcapReady
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
deviceMacAddress
Appliance MAC address
Example: 00:0C:29:56:B3:57
deviceOSName
Sandbox image type
Example: win7
deviceProcessHash
Parent SHA1
Example: A29E4ACA70BEF4AF8CE75AF51032B6B91572AA0D
dvc
Appliance IP address
Example: 10.1.144.199
dvchost
Appliance host name
Example: localhost
fileHash
SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
fileType
True file type
Example: RIFF bitmap file
fname
File name
Example: excel.rar
fsize
File size
Example: 131372
malName
Malware name
Example: HEUR_NAMETRICK.A
pComp
Detection engine / component
Sandbox
rt
Analysis time
Example: Mar 09 2015 17:05:21 GMT+00:00
Log sample:
May 15 16:00:47 localhost CEF:0|Trend Micro|Deep Discovery Ema
il Inspector|2.5.1.1161|200119|FILE_ANALYZED|3|rt=Apr 13 2015 
08:58:20 GMT+00:00 pComp=Sandbox dvc=10.64.1.131 dvchost=inter
nalbeta.bcc.ddei deviceMacAddress=C4:34:6B:B8:09:BC deviceGUID
=034eb532-9318-40d9-b27b-d9feba7c269e fname=JNSA CSIRT-example
.pdf fileHash=E07B349245FCDDB31CBF5A52012807E955D2EB7A malName
=VAN_MALWARE.UMXX fileType=Adobe Portable Document Format(PDF)
 fsize=875029 deviceOSName=win81en cn1Label=GRIDIsKnownGood cn
1=-1 cn2Label=ROZRating cn2=3 cn3Label=PcapReady cn3=1