|
CEF Key
|
Description
|
Value
|
|
Header (logVer)
|
CEF format version
|
CEF:0
|
|
Header (vendor)
|
Appliance vendor
|
TrendAI™
|
|
Header (pname)
|
Appliance product
|
Apex Central
|
|
Header (pver)
|
Appliance version
|
2019
|
|
Header (eventid)
|
Event ID
|
700107
|
|
Header (eventName)
|
Log name
|
Device Access Control
|
|
Header (severity)
|
Severity
|
3
|
|
rt
|
Event trigger time in UTC
|
Example:
Mar 22 2018 08:23:23 GMT+00:00 |
|
cs1Label
|
Corresponding label for the
cs1field |
Product Entity/Endpoint |
|
cs1
|
Server host name
|
Example:
Sample_Host |
|
shost
|
Source host name
|
Example:
shost1 |
|
duser
|
User name
|
Example:
testserver\\administrator |
|
dvchost
|
Target host name
|
Example:
localhost |
|
cn1Label
|
Corresponding label for the
cn1field |
Product |
|
cn1
|
Product ID
|
Example:
Apex One For more information, see Product ID Mapping Table.
|
|
sproc
|
Target process
|
Example:
C:\\Windows\\explorer.exe |
|
fname
|
File name
|
Example:
F:\\Autorun.inf |
|
cn2Label
|
Corresponding label for the
cn2field |
Device_Type |
|
cn2
|
Device type
|
Example:
0
|
|
cn3Label
|
Corresponding label for the
cn3field |
Permission |
|
cn3
|
Permission
|
Example:
3
|
|
deviceFacility
|
Product
|
Example:
Apex One |
|
deviceNtDomain
|
Active Directory domain
|
Example: APEXTMCM
|
|
dntdom
|
Apex One domain hierarchy
|
Example: OSCEDomain1
|
|
TMCMLogDetectedHost
|
Endpoint name where the log event occurred
|
Example: MachineHostName
|
|
TMCMLogDetectedIP
|
IP address where the log event occurred
|
Example: 10.1.2.3
|
|
ApexCentralHost
|
Apex Central host name
|
Example: TW-CHRIS-W2019
|
|
devicePayloadId
|
Unique message GUID
|
Example: 1C00290C0360-9CDE11EB-D4B8-F51F-C697
|
|
TMCMdevicePlatform
|
Endpoint operating system
|
Example: Windows 7 6.1 (Build 7601) Service Pack 1
|
Log sample:
CEF:0|TrendAI™|Apex Central|2019|700107|Device Access C
ontrol|3|rt=Aug 16 2017 04:49:15 GMT+00:00 cs1Label=Product_
Entity/Endpoint cs1=Sample_Host shost=shost1 dvchost=localho
st cn1Label=Product cn1=15 sproc=C:\\Windows\\explorer.exe f
name=F:\\Autorun.inf cn2Label=Device_Type cn2=0 cn3Label=Per
mission cn3=3 deviceFacility=Apex One deviceNtDomain=APEXTMC
M dntdom=OSCEDomain1 TMCMLogDetectedHost=shost1 TMCMLogDetec
tedIP=10.0.76.40 ApexCentralHost=TW-CHRIS-W2019 devicePayloa
dId=1C00290C0360-9CDE11EB-D4B8-F51F-C697 TMCMdevicePlatform
=Windows 7 6.1 (Build 7601) Service Pack 1