Views:

LEEF File Analysis Events

LEEF Key
Description
Value 
Header (logVer)
LEEF format version
LEEF: 1.0
Header (vendor)
Appliance vendor
Trend Micro
Header (pname)
Appliance product
Deep Discovery Inspector
Header (pver)
Appliance version
Example: 3.8.1181
Header (eventName)
Event Name
FILE_ANALYZED
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
deviceMacAddress
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
deviceOSName
Sandbox image type
SandboxImageType
deviceProcessHash
Parent SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
devTime
Analysis time
Example: Mar 09 2015 17:05:21 GMT+08:00
devTimeFormat
Time format
MMM dd yyyy HH:mm:ss z
dvc
Appliance IP address
Example: 10.1.144.199
dvchost
Appliance host name
Example: localhost
fileHash
File SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
fileType
True file type
Example: WIN32 EXE
fname
File name
Example: excel.rar
fsize
File size
Example: 131372
gridIsKnownGood
GRID is known good
  • 0: Bad file
  • -1: Unknown file
  • 1: Good file
malName
Virus name
Example: HEUR_NAMETRICK.A
pcapReady
PCAP ready
Example: 1
pComp
Detection source
  • Sandbox
  • UDSO (User-Defined Suspicious Objects)
rozRating
ROZ rating
  • 0: No risk
  • 1: Low risk
  • 2: Medium risk
  • 3: High risk
sev
Severity
3 (fixed value)
Log sample:
Note
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab delimiter.
 
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1181|FILE_
ANALYZED|devTime=Mar 11 2015 07:36:27 GMT-04:00<009>devTimeF
ormat=MMM dd yyyy HH:mm:ss z<009>sev=3<009>pComp=Sandbox<009
>dvc=10.201.156.143<009>dvchost=ddi38-143<009>deviceMacAddre
ss=00:0C:29:A6:53:0C<009>deviceGUID=D2C1D6D20FF8-4FC98F92-25
EB-D7DA-AF0E<009>fname=mwsoemon.exe<009>fileHash=89DE67C5220
91EE259533D9CBDDF37DDB8C8D636<009>malName=Possible_Virus<009
>fileType=WIN32 EXE<009>fsize=59392<009>deviceOSName=MAK_win
7sp1en_offices_noab_TL<009>gridIsKnownGood=-1<009>rozRating=
1<009>pcapReady=1