LEEF System Logs
|
LEEF Key
|
Description
|
Value
|
|
Header (logVer)
|
LEEF format version
|
LEEF: 1.0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro
|
|
Header (pname)
|
Appliance product
|
Deep Discovery Inspector
|
|
Header (pver)
|
Appliance version
|
Example: 3.8.1181
|
|
Header (eventName)
|
Event Name
|
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
deviceMacAddress
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
devTime
|
Log generation time
|
Example: Mar 09 2015 17:05:21 GMT+08:00
|
|
devTimeFormat
|
Time format
|
MMM dd yyyy HH:mm:ss z
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
msg
|
Description
|
Example: The system time setting has been changed.
|
|
ptype
|
Application type
|
IDS
|
|
sev
|
Severity
|
Example: 2
|
Log sample:
 |
NoteWhen using the LEEF log syntax, separate event attributes
with <009> as a tab delimiter.
|
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1175|SYSTE M_EVENT|dvc=10.201.156.143<009>deviceMacAddress=00:0C:29:A6: 53:0C<009>dvchost=ddi38-143<009>deviceGUID=6B593E17AFB7-40FB BB28-A4CE-0462-A536<009>ptype=IDS<009>devTimeFormat=MMM dd y yyy HH:mm:ss z<009>sev=2<009>msg=The system time setting has been changed.<009>devTime=Mar 09 2015 16:46:08 GMT+08:00