TMEF Virtual Analyzer Analysis Logs: Notable Characteristics Events
|
TMEF Key
|
Description
|
Value
|
|
Header (timestamp)
|
Local time in the format: "Mmm dd
hh:mm:ss"
|
Example: Dec 5 05:26:45
|
|
Header (host)
|
Hostname without the domain information
|
Example: internalAP1
|
|
Header (logVer)
|
TMEF format version
|
CEF: 0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro |
|
Header (pname)
|
Appliance product
|
Deep Discovery Email Inspector |
|
Header (pver)
|
Appliance version
|
Example: 5.1.0.1110
|
|
Header (eventid)
|
Signature ID
|
200127
|
|
Header (eventName)
|
Description
|
NOTABLE_CHARACTERISITICS
|
|
Header (severity)
|
Severity
|
6
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
deviceMacAddress
|
Appliance MAC address
|
Example: 00:0C:29:56:B3:57
|
|
deviceOSName
|
Sandbox image type
|
Example: win7
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
fileHash
|
SHA1
|
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
|
fileType
|
True file type
|
Example: RIFF bitmap file
|
|
fname
|
File name
|
Example: excel.rar
|
|
fsize
|
File size
|
Example: 131372
|
|
msg
|
Details
|
Example: s1.bdstatic.com
|
|
pComp
|
Detection engine / component
|
Sandbox
|
|
rt
|
Analysis time
|
Example: Mar 09 2015 17:05:21 GMT+00:00
|
|
ruleCategory
|
Violated policy name
|
Example: Internet Explorer Setting Modification
|
|
ruleName
|
Violated event analysis
|
Example: Modified important registry items
|
Log sample:
May 15 16:00:47 localhost CEF:0|Trend Micro|Deep Discovery Ema il Inspector|2.5.1.1161|200127|NOTABLE_CHARACTERISTICS|6|rt=Ap r 13 2015 08:24:46 GMT+00:00 pComp=Sandbox dvc=10.64.1.131 dvc host=internalbeta.bcc.ddei deviceMacAddress=C4:34:6B:B8:09:BC deviceGUID=034eb532-9318-40d9-b27b-d9feba7c269e fname=http://w ww.castelir.it/take/Small-9422.html fileHash=6389250B8468C4644 3FD775F6EB744D6105B8DF3 fileType=URL fsize=0 ruleCategory=Susp icious network or messaging activity ruleName=Queries DNS serv er msg=s1.bdstatic.com deviceOSName=xpsp3en