LEEF Notable Characteristics Events
|
LEEF Key
|
Description
|
Value
|
|
Header (logVer)
|
LEEF format version
|
LEEF: 1.0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro
|
|
Header (pname)
|
Appliance product
|
Deep Discovery Inspector
|
|
Header (pver)
|
Appliance version
|
Example: 3.8.1181
|
|
Header (eventName)
|
Event Name
|
NOTABLE_CHARACTERISTICS
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
deviceMacAddress
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
deviceOSName
|
Sandbox image type
|
Example: win7
|
|
devTime
|
Analysis time
|
Example: Mar 09 2015 17:05:21 GMT+08:00
|
|
devTimeFormat
|
Time format
|
MMM dd yyyy HH:mm:ss z
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
fileHash
|
File SHA1
|
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
|
fileType
|
True file type
|
Example: WIN32 EXE
|
|
fname
|
File name
|
Example: excel.rar
|
|
fsize
|
File size
|
Example: 131372
|
|
msg
|
Details
|
Example: www.chapisteriadaniel.com
|
|
pComp
|
Detection source
|
Sandbox
|
|
ruleCategory
|
Violated policy name
|
Example: Internet Explorer Setting Modification
|
|
ruleName
|
Analysis violated event
|
Example: Modified important registry items
|
|
sev
|
Severity
|
6 (fixed value)
|
Log sample:
 |
NoteWhen using the LEEF log syntax, separate event attributes
with <009> as a tab delimiter.
|
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1181|NOTAB LE_CHARACTERISTICS|devTime=Mar 11 2015 05:00:26 GMT-04:00<00 9>devTimeFormat=MMM dd yyyy HH:mm:ss z<009>sev=6<009>pComp=S andbox<009>dvc=10.201.156.143<009>dvchost=ddi38-143<009>devi ceMacAddress=00:0C:29:A6:53:0C<009>deviceGUID=D2C1D6D20FF8-4 FC98F92-25EB-D7DA-AF0E<009>fname=DTAS_WIN32_07<009>fileHash= 672B1A8ADB412C272CCA21A214732C447B650349<009>fileType=WIN32 EXE<009>fsize=290304<009>ruleCategory=Suspicious network or messaging activity<009>ruleName=Queries DNS server<009>msg=0 12webpages.com<009>deviceOSName=MAK_win7sp1en_offices_noab_T L