Views:

LEEF Web Reputation Logs

LEEF Key
Description
Value 
Header (logVer)
LEEF format version
LEEF: 1.0
Header (vendor)
Appliance vendor
Trend Micro
Header (pname)
Appliance product
Deep Discovery Inspector
Header (pver)
Appliance version
Example: 3.8.1181
Header (eventName)
Event Name
WEB_THREAT_DETECTION
cccaDetection
CCCA detection
0 or 1
cccaDetectionSource
CCCA log is detected by
  • GLOBAL_INTELLIGENCE
  • VIRTUAL_ANALYZER
  • USER_DEFINED
cccaRiskLevel
CCCA Risk Level
  • 0: Unknown
  • 1: Low
  • 2: Medium
  • 3: High
deviceDirection
Packet direction
  • 0: Source is external
  • 1: Source is internal
  • 2: Unknown
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
deviceMacAddress
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
devTime
Log generation time
Example: Mar 09 2015 17:05:21 GMT+08:00
devTimeFormat
Time format
MMM dd yyyy HH:mm:ss z
dhost
Destination host name
Example: dhost1
dOSName
Destination host OS
Example: Android
dst
Destination IP address
Example: 10.1.144.199
dstGroup 
Network Group assigned to a destination host
Example: monitor1
dstMAC
Destination MAC
Example: 00:0C:29:6E:CB:F9
dstPort
Destination port
Value between 0 and 65535
dstZone
Destination zone
  • 0: Not in monitored network
  • 1: In monitored network and trusted
  • 2: In monitored network and not trusted
duser
Mail recipient
Example: duser1
dvc
Appliance IP address
Example: 10.1.144.199
dvchost
Appliance host name
Example: localhost
hostName
Host name
Example: CLIENT1
interestedIp
Interested IP
Example: 10.1.144.199
mailMsgSubject
Mail subject
Example: hello
msg
Description
Example: Dangerous URL in Web Reputation Services database - HTTP (Request)
pComp
Detection engine/component
Example: VSAPI
peerIP
Peer IP
Example: 10.1.144.199
proto
Protocol
Example: SMTP
protoGroup
Protocol group
Example: SMTP
ptype
Application type
IDS
requestClientApplication
User agent
Example: IE
riskScore
Score
Example: 49
sev
Severity
  • 2: Informational
  • 4: Low
  • 6: Medium
  • 8: High
shost
Source host name
Example: shost1
sOSName
Source host OS
Example: Android
src
Source IP address
Example: 10.1.144.199
srcGroup
Network Group assigned to a source host
Example: monitor1
srcMAC
Source MAC
Example: 00:0C:29:6E:CB:F9
srcPort
Source port
Value between 0 and 65535
srcZone
Source zone
  • 0: Not in monitored network
  • 1: In monitored network and trusted
  • 2: In monitored network and not trusted
suser
Mail sender
Example: suser1
threatType
Threat type
5
url
URL
Example: http://1.2.3.4/query?term=value
urlCat
Category
Example: Gambling
vLANId
VLANID
Value between 0 and 4095
Log sample:
Note
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab delimiter.
 
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1175|WEB_T
HREAT_DETECTION|devTimeFormat=MMM dd yyyy HH:mm:ss z<009>dvc
=10.201.156.143<009>deviceMacAddress=00:0C:29:A6:53:0C<009>d
vchost=ddi38-143<009>deviceGUID=6B593E17AFB7-40FBBB28-A4CE-0
462-A536<009>ptype=IDS<009>devTime=Mar 09 2015 14:06:36 GMT+
08:00<009>sev=6<009>protoGroup=HTTP<009>proto=HTTP<009>vLANI
d=4095<009>deviceDirection=1<009>dhost=www.freewebs.com<009>
dst=216.52.115.2<009>dstPort=80<009>dstMAC=00:1b:21:35:8b:98
<009>shost=172.16.1.197<009>src=172.16.1.197<009>srcPort=121
21<009>srcMAC=fe:ed:be:ef:5a:c6<009>hostName=www.freewebs.co
m<009>msg=Dangerous URL in Web Reputation Services 
database - HTTP (Request)<009>url=http:
//www.freewebs.com/setting3/setting.doc<009>
pComp=TMUFE<009>srcGroup=Default<009>
srcZone=1<009>dstZone=0<009>urlCat=
Disease Vector<009>riskScore=49<009>threatTy
pe=5<009>interestedIp=172.16.1.197<009>
peerIp=216.52.115.2