Views:

TMEF File Analysis Events

TMEF Key
Description
Value 
Header (logVer)
TMEF format version
CEF: 0
Header (vendor)
Appliance vendor
Trend Micro
Header (pname)
Appliance product
Deep Discovery Inspector
Header (pver)
Appliance version
Example: 3.8.1181
Header (eventid)
Signature ID
200119
Header (eventName)
Event Name
FILE_ANALYZED
Header (severity)
Severity
3 (fixed value)
cn1
GRID is known good
  • 0: Bad file
  • -1: Unknown file
  • 1: Good file
cn1Label
GRID is known good
GRIDIsKnownGood
cn2
ROZ rating
  • 0: No risk
  • 1: Low risk
  • 2: Medium risk
  • 3: High risk
cn2Label
ROZ rating
ROZRating
cn3
PCAP ready
0 or 1
cn3Label
PCAP ready
PcapReady
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
deviceMacAddress
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
deviseOSName
Sandbox image type
Example: win7
deviceProcessHash
Parent SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
dvc
Appliance IP address
Example: 10.1.144.199
dvchost
Appliance host name
Example: localhost
fileHash
File SHA1
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
fileType
True file type
Example: 1638400
fname
File name
Example: excel.rar
fsize
File size
Example: 131372
malName
Malware name
Example: SWF_Lfm.926
pComp
Detection source
  • Sandbox
  • UDSO (User-Defined Suspicious Objects)
rt
Analysis time
Example: Mar 09 2015 17:05:21 GMT+08:00
Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|200119|F
ILE_ANALYZED|3|rt=Mar 11 2015 07:38:04 GMT-04:00 pComp=Sandb
ox dvc=10.201.156.143 dvchost=ddi38-143 deviceMacAddress=00:
0C:29:A6:53:0C deviceGUID=D2C1D6D20FF8-4FC98F92-25EB-D7DA-AF
0E fname=multiple_mask.swf fileHash=643DBF968EF3BECD9A73CF1D
CF44006BC46E15F7 malName=SWF_Lfm.926 fileType=Macromedia Fla
sh fsize=9400 deviceOSName=MAK_win7sp1en_offices_noab_TL cn2
Label=ROZRating cn2=3 cn1Label=GRIDIsKnownGood cn1=-1 cn3Lab
el=PcapReady cn3=1