Views:

LEEF Disruptive Application Logs

LEEF Key
Description
Value 
Header (logVer)
LEEF format version
LEEF: 1.0
Header (vendor)
Appliance vendor
Trend Micro
Header (pname)
Appliance product
Deep Discovery Inspector
Header (pver)
Appliance version
Example: 3.8.1181
Header (eventName)
Event Name
DISRUPTIVE_APPLICATION_DETECTION
aggregatedCnt
AggrCount
Example: 1
cnt
Total count
Example: 1
deviceDirection
Packet direction
  • 0: Source is external
  • 1: Source is internal
  • 2: Unknown
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
deviceMacAddress
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
devTime
Log generation time
Example: Mar 09 2015 17:05:21 GMT+08:00
devTimeFormat
Time format
MMM dd yyyy HH:mm:ss z
dhost
Destination host name
Example: dhost1
dOSName
Destination host OS
Example: Android
dst
Destination IP address
Example: 10.1.144.199
dstGroup 
Network Group assigned to a destination host
Example: monitor1
dstMAC
Destination MAC
Example: 00:0C:29:6E:CB:F9
dstPort
Destination port
Value between 0 and 65535
dstZone
Destination zone
  • 0: Not in monitored network
  • 1: In monitored network and trusted
  • 2: In monitored network and not trusted
dvc
Appliance IP address
Example: 10.1.144.199
dvchost
Appliance host name
Example: localhost
interestedIp
Interested IP
Example: 10.1.144.199
msg
Description
Example: Deep Discovery Inspector detected the protocol in your monitored network
pComp
Detection engine/component
Example: VSAPI
peerIP
Peer IP
Example: 10.1.144.199
proto
Protocol
Example: SMTP
protoGroup
Protocol group
Example: SMTP
ptype
Application type
IDS
sev
Severity
  • 2: Informational
  • 4: Low
  • 6: Medium
  • 8: High
shost
Source host name
Example: shost1
sOSName
Source host OS
Example: Android
src
Source IP address
Example: 10.1.144.199
srcGroup
Network Group assigned to a source host
Example: monitor1
srcMAC
Source MAC
Example: 00:0C:29:6E:CB:F9
srcPort
Source port
Value between 0 and 65535
srcZone
Source zone
  • 0: Not in monitored network
  • 1: In monitored network and trusted
  • 2: In monitored network and not trusted
threatType
Threat type
6
vLANId
VLANID
Value between 0 and 4095
Log sample:
Note
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab delimiter.
 
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1175|DISRU
PTIVE_APPLICATION_DETECTION|devTimeFormat=MMM dd yyyy HH:mm:
ss z<009>dvc=10.201.156.143<009>deviceMacAddress=00:0C:29:A6
:53:0C<009>dvchost=ddi38-143<009>deviceGUID=6B593E17AFB7-40F
BBB28-A4CE-0462-A536<009>ptype=IDS<009>devTime=Mar 09 2015 1
4:20:38 GMT+08:00<009>sev=2<009>protoGroup=STREAMING<009>pro
to=WMSP<009>vLANId=4095<009>deviceDirection=1<009>dhost=12.1
90.48.13<009>dst=12.190.48.13<009>dstPort=80<009>dstMAC=00:1
7:9a:65:f3:05<009>shost=192.168.33.2<009>src=192.168.33.2<00
9>srcPort=35125<009>srcMAC=00:16:6f:a1:3d:7a<009>msg=Deep Di
scovery Inspector detected the protocol in your monitored ne
twork.<009>pComp=CAV<009>threatType=6<009>srcGroup=Default<0
09>srcZone=1<009>dstZone=0<009>interestedIp=192.168.33.2<009
>peerIp=12.190.48.13<009>cnt=1<009>aggregatedCnt=1