Views:

CEF File Analysis Events

CEF Key
Description
Value 
Header (logVer)
CEF format version
CEF: 0
Header (vendor)
Appliance vendor
Trend Micro
Header (pname)
Appliance product
Deep Discovery Inspector
Header (pver)
Appliance version
Example: 3.8.1181
Header (eventid)
Signature ID
200119
Header (eventName)
Description
Sample file sandbox analysis is finished.
Header (severity)
Severity
3 (fixed value)
cn1
GRID is known good
  • 0: Bad file
  • -1: Unknown file
  • 1: Good file
cn1Label
GRID is known good
GRIDIsKnownGood
cn2
ROZ rating
  • 0: No risk
  • 1: Low risk
  • 2: Medium risk
  • 3: High risk
cn2Label
ROZ rating
ROZRating
cn3
PcapReady
Example: 0
cn3Label
PcapReady
PcapReady
cs1
Sandbox image type
Example: win7
cs1Label
Sandbox image type
SandboxImageType
cs2
Virus name
Example: HEUR_NAMETRICK.A
cs2Label
Virus name
MalwareName
cs3
Parent SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
cs3Label
Parent SHA1
ParentFileSHA1
deviceExternalId
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
dvc
Appliance IP address
Example: 10.1.144.199
dvchost
Appliance host name
Example: localhost
dvcmac
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
fileHash
SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
fileType
True file type
Example: WIN32 EXE
fname
File name
Example: excel.rar
fsize
File size
Example: 131372
rt
Analysis time
Example: Mar 09 2015 17:05:21 GMT+08:00
Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|200119|S
ample file sandbox analysis is finished|3| rt=Mar 11 2015 06
:51:46 GMT-04:00 dvc=10.201.156.143 dvchost=ddi38-143 dvcmac
=00:0C:29:A6:53:0C deviceExternalId=D2C1D6D20FF8-4FC98F92-25
EB-D7DA-AF0E fname=Tomb Raider.rar fileHash=1E4677A1EF1FBAD1
1F8D06A9DAD8103C2CE861A9 fileType=RAR fsize=131372 cs1Label=
SandboxImageType cs1=MAK_win7sp1en_offices_noab_TL cn2Label=
ROZRating cn2=1 cn1Label=GRIDIsKnownGood cn1=-1 cs2Label=Mal
wareName cs2=HEUR_NAMETRICK.A cn3Label=PcapReady cn3=0