CEF Device Access Control Logs

Header (logVer)

CEF format version

CEF:0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)

Appliance product

Apex Central

Header (pver)

Appliance version

2019

Header (eventid)

Event ID

700107

Header (eventName)

Log name

Device Access Control

Header (severity)

Severity

3

rt

The log generation time in UTC

Example: "Feb 14 2017 11:14:08 GMT+00:00"

cs1Label

Corresponding label for the "cs1" field

"Product Entity/Endpoint"

cs1

Server host name

Example: "Sample_Host"

shost

Source host name

Example: "shost1"

dvchost

Target host name

Example: "localhost"

cn1Label

Corresponding label for the "cn1" field

"Product"

cn1

Product ID

Example: "Apex One"

For more information, see Product ID Mapping Table.

sproc

Target process

Example: "C:\Windows\explorer.exe"

fname

File name

Example: "F:\Autorun.inf"

cn2Label

Corresponding label for the "cn2" field

"Device Type"

cn2

Device type

Example: "0"

• 0: USB storage device

• 1: Non-storage USB

• 2: CD/DVD

• 3: Floppy disks

• 4: Network driver

cn3Label

Corresponding label for the "cn3" field

"Permission"

cn3

Permission

Example: "3"

• 0: Modify

• 1: Read and execute

• 2: Read

• 3: List device content only

• 4: Block

deviceFacility

Product

Example: "Apex One"