Trend MicroTM

Deep Discovery Inspector

6.7 Service Pack 1

Syslog Content Mapping Guide
Breakthrough Protection Against APTs and Targeted Attacks

Trend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:
http://docs.trendmicro.com
Trend Micro, the Trend Micro t-ball logo, Deep Discovery Analyzer, and Deep
Discovery Inspector are trademarks or registered trademarks of Trend Micro
Incorporated. All other product or company names may be trademarks orregistered trademarks of their owners.
Copyright © 2024. Trend Micro Incorporated. All rights reserved.
Document Part No.: APEM69899/240430
Release Date: May 2024
Protected by U.S. Patent No.: 8595840; 8925074; 7707635; 8505094

This documentation introduces the main features of the product and/or
provides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Privacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback
regarding product usage and detection information to Trend Micro. Some ofthis data is considered personal in certain jurisdictions and under certain
regulations. If you do not want Trend Micro to collect personal data, youmust ensure that you disable the related features.
The following link outlines the types of data that Deep Discovery Inspector
collects and provides detailed instructions on how to disable the specificfeatures that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend
Micro Privacy Notice:https://www.trendmicro.com/privacy

Table of Contents
Chapter 1: Introduction
Terminology ....................................................................... 1-2

Chapter 2: Revisions
Chapter 3: Syslog content mapping - CEF
CEF threat logs ................................................................... 3-2
CEF disruptive application logs ............................................ 3-7
CEF web reputation logs ...................................................... 3-9
CEF system logs ................................................................ 3-14
CEF virtual analyzer logs: file analysis events ..................... 3-15
CEF virtual analyzer logs: notable characteristics events ..... 3-17
CEF virtual analyzer logs: deny list transaction events ......... 3-19

Chapter 4: Syslog content mapping - LEEF
LEEF threat logs ................................................................. 4-2
LEEF disruptive application logs .......................................... 4-9
LEEF web reputation logs .................................................. 4-12
LEEF system logs .............................................................. 4-16
LEEF correlation incident logs ........................................... 4-17
LEEF virtual analyzer logs: file analysis events .................... 4-20
LEEF virtual analyzer logs: notable characteristics events ... 4-22
LEEF virtual analyzer logs: deny list transaction event ........ 4-24

Chapter 5: Syslog content mapping - TMEF
TMEF threat logs ................................................................ 5-2iTrend Micro Deep Discovery Inspector Syslog Guide

TMEF disruptive application logs ....................................... 5-11
TMEF web reputation logs ................................................. 5-15
TMEF system logs ............................................................. 5-20
TMEF correlated incident logs ........................................... 5-22
TMEF virtual analyzer logs: file analysis events ................... 5-24
TMEF virtual analyzer logs: notable characteristics events .. 5-26
TMEF virtual analyzer logs: deny list transaction events ...... 5-28
TMEF retro scan report logs .............................................. 5-30
TMEF retro scan detection logs .......................................... 5-31

iiPreface

Preface
Learn more about the following topics:• Documentation on page 2• Audience on page 3• Document Conventions on page 3

1Trend Micro Deep Discovery Inspector Syslog Guide

Documentation
The documentation set for Deep Discovery Inspector includes the following:
Table 1. Product Documentation
Document2

Description

Administrator's Guide

The Administrator's Guide contains detailed instructions on
how to configure and manage Deep Discovery Inspector,
and explanations on Deep Discovery Inspector concepts andfeatures.

AWS Deployment Guide

The AWS Deployment Guide contains information about
requirements and procedures for planning deployment,
deploying, and troubleshooting Deep Discovery Inspector
deployment on AWS.

Inline (LAN bypass) Network
Interface Card Installation
Guide

The Inline (LAN bypass) Network Interface Card Installation
Guide contains information about requirements andprocedures for installing an additional bypass network
interface card on supported Deep Discovery Inspector
appliances.

Installation and Deployment
Guide

The Installation and Deployment Guide contains information
about requirements and procedures for planning deployment,
installing Deep Discovery Inspector, and using thePreconfiguration Console to set initial configurations andperform system tasks.

Syslog Content Mapping
Guide

The Syslog Content Mapping Guide provides information about
log management standards and syntaxes for implementing
syslog events in Deep Discovery Inspector.

Quick Start Card

The Quick Start Card provides user-friendly instructions onconnecting Deep Discovery Inspector to your network and on
performing the initial configuration.

ReadmeThe Readme contains late-breaking product information thatis not found in the online or printed documentation. Topics
include a description of new features, known issues, andproduct release history.

Preface

Document
Online Help

Description
Web-based documentation that is accessible from the Deep
Discovery Inspector management console.
The Online Help contains explanations of Deep Discovery
Inspector components and features, as well as procedures
needed to configure Deep Discovery Inspector.

Support Portal

The Support Portal is an online database of problem-solving
and troubleshooting information. It provides the latest
information about known product issues. To access the
Support Portal, go to the following website:
https://success.trendmicro.com

View and download product documentation from the Trend Micro Online
Help Center:
https://docs.trendmicro.com/en-us/home.aspx

Audience
The Deep Discovery Inspector documentation is written for IT
administrators and security analysts. The documentation assumes that thereader has an in-depth knowledge of networking and information security,
including the following topics:• Network topologies• Database management• Antivirus and content security protection
The documentation does not assume the reader has any knowledge ofsandbox environments or threat event correlation.

Document Conventions
The documentation uses the following conventions:3Trend Micro Deep Discovery Inspector Syslog Guide

Table 2. Document Conventions
Convention

Description

UPPER CASE

Acronyms, abbreviations, and names of certain commands
and keys on the keyboard

Bold

Menus and menu commands, command buttons, tabs, andoptions

Italics

References to other documents

Monospace

Sample command lines, program code, web URLs, file names,and program output

Navigation > Path

The navigation path to reach a particular screen
For example, File > Save means, click File and then click
Save on the interface

Note

Tip

Important

WARNING!

4

Configuration notes

Recommendations or suggestions

Information regarding required or default configuration
settings and product limitations

Critical actions and configuration options

Chapter 1

Introduction
The Trend Micro™ Syslog Content Mapping Guide provides information
about log management standards and syntaxes for implementing syslog
events in Trend Micro Deep Discovery Inspector.
To enable flexible integration with third-party log management systems,
Deep Discovery Inspector supports the following syslog formats:
Log Management System
Common Event Format (CEF)
For details, see Syslog content mapping - CEF
on page 3-1
Log Event Extended Format (LEEF)
For details, see Syslog content mapping - LEEF
on page 4-1
Trend Micro Event Format (TMEF)
For details, see Syslog content mapping - TMEF
on page 5-1

Description
CEF is an open log management standard
created by HP ArcSight.
Deep Discovery Inspector uses a subset of the
CEF dictionary.
LEEF is an event format developed for IBM
Security QRadar.
Deep Discovery Inspector uses a subset of the
LEEF dictionary.
TMEF is a superset of log fields that allow athird-party syslog collector to better control
and mitigate detection events provided by
Deep Discovery Inspector.

1-1Trend Micro Deep Discovery Inspector Syslog Guide

Terminology
Term

1-2

Description

CEF

Common Event Format

LEEF

Log Event Extended Format

TMEF

Trend Micro Event Format

CCCA

Command and Control Contact Alert

Chapter 2

Revisions
There were no revisions for version 6.7 SP1.

2-1

Chapter 3

Syslog content mapping - CEF
The following tables outline syslog content mapping between Deep
Discovery Inspector log output and CEF syslog types:• CEF threat logs on page 3-2• CEF disruptive application logs on page 3-7• CEF web reputation logs on page 3-9• CEF system logs on page 3-14
• CEF virtual analyzer logs: file analysis events on page 3-15
• CEF virtual analyzer logs: notable characteristics events on page 3-17
• CEF virtual analyzer logs: deny list transaction events on page 3-19

3-1

Trend Micro Deep Discovery Inspector Syslog Guide

CEF threat logs
Table 3-1. CEF Threat Logs
CEF Key

Description

Value

Header (logVer)

CEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Event ID

Example: 8

Header (eventName)

Description

Example: Packed executable filecopied to a network administrative
share

Header (severity)

Severity• 2: Informational• 4: Low• 6: Medium• 8: High

3-2

act

The action in the event

blocked or not blocked

appProtocolExample: HTTP

c6a1

Interested IPv6

Example: 2001:0:0:1::21

c6a1LabelInterested IPv6

InterestedIPv6

c6a2

Source IPv6 address

Example: 2001:0:0:1::21

c6a2Label

Source IPv6 address

Source IPv6 Address

c6a3

Destination IPv6 address

Example: 2001:0:0:1::21

c6a3Label

Destination IPv6 address

Destination IPv6 Address

c6a4

Peer IPv6 address

Example: 2001:0:0:1::21

c6a4LabelPeer IPv6 address

PeerIPv6

Syslog content mapping - CEF

CEF Key

Description

Value

cat

Event category

Example: Filecnt

Total countExample: 1

cn1

CCCA detection

0 or 1cn1Label

CCCA detection

CCCA_Detection

cn3

Threat type

• 0: Malicious content• 1: Malicious behavior• 2: Suspicious behavior• 3: Exploit• 4: Grayware

cn3LabelThreat type

Threat Type

cs1

Mail subject

Example: hellocs1Label

Mail subject

MailSubject

cs2

Malware nameExample: HEUR_NAMETRICK.A

cs2Label

Malware name

DetectionName

cs3

Host nameExample: CLIENT1

cs3Label

Host name

HostName_Ext

cs4

File name in archive

Example: mtxlegih.dll

cs4LabelFile name in archive

FileNameInArchive

cs5

CCCA log is detected by

Example:GLOBAL_INTELLIGENCE or
VIRTUAL_ANALYZER or
USER_DEFINED

cs5Label

CCCA log is detected by

CCCA_DetectionSource

3-3Trend Micro Deep Discovery Inspector Syslog Guide

CEF Keycs6

Description
Attack Phase

Value• Intelligence Gathering• Point of Entry• Command and Control
Communication• Lateral Movement• Asset and Data Discovery• Data Exfiltration• Nil (no applicable attack phase)cs6Label

Attack Phase

pAttackPhase

destinationTranslatedAdd
ress

Peer IP

Example: 10.1.144.199

deviceDirection

Packet direction• 0: Source is external• 1: Source is internal• 2: Unknown

deviceExternalId

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

devicePayloadId

An extendable field.

Examples:Format: {threat_type}:{log_id}:{with pcap file
captured}{:extensions}*

3-4• With pcap file captured:
2:10245:P• Without pcap file captured:
2:10245:

dhost

Destination host nameExample: dhost1

dmac

Destination MAC

Example: 00:0C:29:6E:CB:F9

dpt

Destination port

Value between 0 and 65535

dst

Destination IP address

Example: 10.1.144.199

duser

Mail recipient

Example: duser1

dvc

Appliance IP address

Example: 10.1.144.199

Syslog content mapping - CEF

CEF Key

Description

Value

dvchostAppliance host nameExample: localhost

dvcmacAppliance MAC address

Example: 00:0C:29:6E:CB:F9

fileHash

SHA1

Example:1EDD5B38DE47295457670
88C5CAB395E4197C8F3

filePath

File path

Example: SHARE\\

fileType

Real file type

Example: 1638400

flexNumber1

vLANIdExample: 4095

flexNumber1LabelvLANIdvLANIdfname

File nameExample: excel.rar

fsize

File size

Example: 131372

oldFileHash

Mail attachment SHA1

Example:1EDD5B38DE47295457670
88C5CAB395E4197C8F3

oldFileName

Mail attachment file nameExample: excel.rar

oldFileSize

Mail attachment file size

Example: 150000

oldFileType

Mail attachment file type

Example: 1638400

requestClientApplication

User agent

Example: IE

requestURL

Example: http://1.2.3.4/query?
term=valuert

Log generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

shost

Source host nameExample: shost1

smac

Source MAC

Example: 00:0C:29:6E:CB:F9

sourceTranslatedAddress

Interested IP

Example: 10.1.144.199

src

Source IP address

Example: 10.1.144.199

spt

Source port

Value between 0 and 65535

3-5

Trend Micro Deep Discovery Inspector Syslog Guide

CEF Key

Description

Value

suid

User nameExample: User1

suser

Mail sender

Example: suser1

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|5.0.1329|0|
Eicar_test_file- HTTP (Response)|8|dvc=172.22.9.32
dvcmac=00:50:56:AD:03:BD
dvchost=localhost deviceExternalId=E9A3FA4339164738984C-A4BF-84A0-D603
rt=Jun 22 2017 09:42:47 GMT+08:00 app=HTTP
deviceDirection=1
dhost=172.22.9.5 dst=172.22.9.5 dpt=57908
dmac=00:50:56:82:e7:a9
shost=172.22.9.54 src=172.22.9.54 spt=80
smac=00:50:56:82:c6:ae
cs3Label=HostName_Ext cs3=172.22.9.54 cs2Label=
DetectionName
cs2=Eicar_test_file fname=eicarcom2.zip fileType=
262340608
fsize=308 requestClientApplication=Wget/1.12 (linux-gnu)
act=not blocked cn3Label=Threat Type cn3=0
destinationTranslatedAddress=172.22.9.5
fileHash=BEC1B52D350D721C7E22A6D4BB0A92909893A3AE
cs4Label=FileNameInArchive cs4=eicar.com
sourceTranslatedAddress=172.22.9.54
cnt=1 cat=Malware cs6Label=pAttackPhase cs6=Pointof Entry flexNumber1Label=vLANId flexNumber1=4095
request=http://172.22.9.54/eicarcom2.zip
devicePayloadId=0:143:P

3-6

Syslog content mapping - CEF

CEF disruptive application logs
Table 3-2. CEF Disruptive Application Logs
CEF Key

Description

Value

Header (logVer)

CEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

100120

Header (eventName)

Description

Deep Discovery Inspector detected
this protocol in your monitored
network.

Header (severity)

Severity• 2: Informational• 4: Low• 6: Medium• 8: Highapp

ProtocolExample: HTTP

c6a1

Interested IPv6

Example: 2001:0:0:1::21

c6a1LabelInterested IPv6

InterestedIPv6

c6a2

Source IPv6 address

Example: 2001:0:0:1::21

c6a2Label

Source IPv6 address

Source IPv6 Address

c6a3

Destination IPv6 address

Example: 2001:0:0:1::21

c6a3Label

Destination IPv6 address

Destination IPv6 Address

c6a4

Peer IPv6 address

Example: 2001:0:0:1::21

c6a4LabelPeer IPv6 address

PeerIPv6

cnt

Total countExample: 1

3-7

Trend Micro Deep Discovery Inspector Syslog Guide

CEF Key

Description

Value

cn3

Threat type6

cn3LabelThreat type

ThreatTypedestinationTranslatedAdd
ress

Peer IP

Example: 10.1.144.199

deviceDirection

Packet direction• 0: Source is external• 1: Source is internal• 2: Unknown

deviceExternalId

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

devicePayloadId

An extendable field.

Examples:Format: {threat_type}:{log_id}:{with pcap file
captured}{:extensions}*

3-8• With pcap file captured:
2:10245:P• Without pcap file captured:
2:10245:

dhost

Destination host nameExample: dhost1

dmac

Destination MAC

Example: 00:0C:29:6E:CB:F9

dpt

Destination port

Value between 0 and 65535

dst

Destination IP address

Example: 10.1.144.199

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

dvcmacAppliance MAC address

Example: 00:0C:29:6E:CB:F9

flexNumber1

vLANIdExample: 4095

flexNumber1LabelvLANIdvLANIdrt

Log generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

shost

Source host nameExample: shost1

Syslog content mapping - CEF

CEF Key

Description

Value

smac

Source MAC

Example: 00:0C:29:6E:CB:F9

sourceTranslatedAddress

Interested IP

Example: 10.1.144.199

spt

Source port

Value between 0 and 65535

src

Source IP address

Example: 10.1.144.199

Log Sample:
CEF:0|Trend Micro|Deep Discovery Inspector|5.0.1329|
100120|DeepDiscovery Inspector detected the protocol in yourmonitored network.|2|dvc=172.22.9.32 dvcmac=
00:50:56:AD:03:BD
dvchost=localhost deviceExternalId=E9A3FA4339164738984C-A4BF-84A0-D603
rt=Jun 22 2017 10:06:24 GMT+08:00 app=eDonkey
deviceDirection=1 dhost=10.1.100.223 dst=10.1.100.223
dpt=4662 dmac=00:0c:29:a7:72:74 shost=10.1.117.231
src=10.1.117.231 spt=39933 smac=00:30:da:2d:47:32
cn3Label=Threat Type cn3=6 sourceTranslatedAddress=
10.1.117.231
destinationTranslatedAddress=10.1.100.223 cnt=1
flexNumber1Label=vLANId flexNumber1=4095
devicePayloadId=6:11:P

CEF web reputation logs
Table 3-3. CEF Web Reputation Logs
CEF Key

Description

Value

Header (logVer)

CEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

3-9

Trend Micro Deep Discovery Inspector Syslog Guide

CEF Key

Description

Value

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

100101Header (eventName)

Description

Example: Dangerous URL in Web
Reputation Services database HTTP (Request)

Header (severity)

Severity• 2: Informational• 4: Low• 6: Medium• 8: High

3-10

app

ProtocolExample: HTTP

c6a1

Interested IPv6

Example: 2001:0:0:1::21

c6a1LabelInterested IPv6

InterestedIPv6

c6a2

Source IPv6 address

Example: 2001:0:0:1::21

c6a2Label

Source IPv6 address

Source IPv6 Address

c6a3

Destination IPv6 address

Example: 2001:0:0:1::21

c6a3Label

Destination IPv6 address

Destination IPv6 Address

c6a4

Peer IPv6 address

Example: 2001:0:0:1::21

c6a4LabelPeer IPv6 address

PeerIPv6

cn1

CCCA detection

0 or 1cn1Label

CCCA detection

CCCA_Detection

cn2

Score

Example: 49

cn2Label

Score

WRSScorecn3

Threat type

Example: 5

Syslog content mapping - CEF

CEF Key

Description

Valuecn3LabelThreat type

Threat Type

cs1

Mail subject

Example: hellocs1Label

Mail subject

MailSubject

cs2

Category

Example: Gamblingcs2LabelCategory

URLCategorycs3

Host nameExample: CLIENT1

cs3Label

Host name

HostName_Ext

cs4

Attack Phase• Intelligence Gathering• Point of Entry• Command and Control
Communication• Lateral Movement• Asset and Data Discovery• Data Exfiltration• Nil (no applicable attack phase)cs4Label

Attack Phase

pAttackPhase

destinationTranslatedAdd
ress

Peer IP

Example: 10.1.144.199

deviceDirection

Packet direction• 0: Source is external• 1: Source is internal• 2: Unknown

deviceExternalId

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

3-11

Trend Micro Deep Discovery Inspector Syslog Guide

CEF Key

Description

devicePayloadId

An extendable field.
Format: {threat_type}:{log_id}:{with pcap file
captured}{:extensions}*

3-12

Value
Examples:• With pcap file captured:
2:10245:P• Without pcap file captured:
2:10245:

dhost

Destination host nameExample: dhost1

dmac

Destination MAC

Example: 00:0C:29:6E:CB:F9

dpt

Destination port

Value between 0 and 65535

dst

Destination IP address

Example: 10.1.144.199

duser

Mail recipient

Example: duser1

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

dvcmacAppliance MAC address

Example: 00:0C:29:6E:CB:F9

flexNumber1

vLANIdExample: 4095

flexNumber1LabelvLANIdvLANIdrequestURL

Example: http://1.2.3.4/query?
term=value

requestClientApplication

User agent

Example: IE

rt

Log generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

shost

Source host nameExample: shost1

smac

Source MAC

Example: 00:0C:29:6E:CB:F9

sourceTranslatedAddress

Interested IP

Example: 10.1.144.199

spt

Source port

Value between 0 and 65535

src

Source IP address

Example: 10.1.144.199

Syslog content mapping - CEF

CEF Keysuser

Description
Mail sender

Value
Example: suser1

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|5.0.1329|100101|Ransomware
URL in Web Reputation Services database - HTTP
(Request)|8|dvc=172.22.9.32 dvcmac=00:50:56:AD:03:BD
dvchost=localhost deviceExternalId=E9A3FA433916-4738984
C-A4BF-84A0-D603
rt=Jun 22 2017 10:00:17 GMT+08:00 cs3Label=HostName_Ext
cs3=ca95-1.winshipway.com cn2Label=WRSScore cn2=49
cn3Label=Threat Type cn3=5 dmac=00:16:c8:65:98:d5
shost=172.22.9.5 src=172.22.9.5 spt=41757
smac=00:50:56:82:e7:a9sourceTranslatedAddress=172.22.9.5
cn1Label=CCCA_Detection
cn1=1 request=http://ca95-1.winshipway.com/
requestClientApplication=Wget/1.12(linux-gnu) app=HTTP deviceDirection=1
dhost=150.70.162.115
dst=150.70.162.115 dpt=80 cs2Label=URLCategory
cs2=Ransomware destinationTranslatedAddress=
150.70.162.115
cs4Label=pAttackPhase cs4=Command and Control
Communication flexNumber1Label=vLANId flexNumber1=4095
request=http://ca95-1.winshipway.com/
devicePayloadId=5:17:

3-13

Trend Micro Deep Discovery Inspector Syslog Guide

CEF system logs
Table 3-4. CEF System Logs
CEF Key

Description

Value

Header (logVer)

CEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID• 300102• 300999

Header (eventName)

Description

Header (severity)

Severity

Example: The system time setting
has been changed.
• 2: Informational• 4: Warning• 6: Severe
Example: 2

c6a2

Source IPv6 address

Example: 2001:0:0:1::21

c6a2Label

Source IPv6 address

Source IPv6 Address

deviceExternalId

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

duser

Action by

Example: admin

dvcAppliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

dvcmacAppliance MAC address

Example: 00:0C:29:6E:CB:F9

outcome

Outcome• Success• Failure
Example: Success

3-14

Syslog content mapping - CEF

CEF Key

Description

Value

rt

Log generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

src

User IP address

Example: 10.1.1.1

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1175|300999|T
he system time setting has been changed.|2|dvc=10.201.156.14
3 dvcmac=00:0C:29:A6:53:0C dvchost=ddi38-143 deviceExternalI
d=6B593E17AFB7-40FBBB28-A4CE-0462-A536 rt=Mar 09 2015 16:46:
08 GMT+08:00

CEF virtual analyzer logs: file analysis events
Table 3-5. CEF File Analysis Events
CEF Key

Description

Value

Header (logVer)

CEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

200119Header (eventName)

Description

Sample file sandbox analysis isfinished.

Header (severity)

Severity

3 (fixed value)cn1

GRID is known good

• 0: Bad file• -1: Unknown file• 1: Good filecn1Label

GRID is known good

GRIDIsKnownGood

3-15

Trend Micro Deep Discovery Inspector Syslog Guide

CEF Keycn2

Description
ROZ rating

Value• 0: No risk
• 1: Low risk
• 2: Medium risk
• 3: High risk

3-16

cn2Label

ROZ rating

ROZRating

cn3

PcapReadyExample: 0

cn3Label

PcapReady

PcapReadycs1

Sandbox image type

Example: win7

cs1Label

Sandbox image typeSandboxImageTypecs2

Virus nameExample: HEUR_NAMETRICK.A

cs2Label

Virus name

MalwareName

cs3

Parent SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

cs3Label

Parent SHA1ParentFileSHA1

deviceExternalId

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

dvcmacAppliance MAC address

Example: 00:0C:29:6E:CB:F9

fileHash

SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

fileType

True file type

Example: WIN32 EXE

fname

File nameExample: excel.rar

Syslog content mapping - CEF

CEF Key

Description

Value

fsize

File size

Example: 131372

rtAnalysis time

Example: Mar 09 2015 17:05:21
GMT+08:00

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|200119|S
ample file sandbox analysis is finished|3| rt=Mar 11 2015 06:51:46 GMT-04:00 dvc=10.201.156.143 dvchost=ddi38-143 dvcmac=00:0C:29:A6:53:0C deviceExternalId=D2C1D6D20FF8-4FC98F92-25
EB-D7DA-AF0E fname=Tomb Raider.rar fileHash=1E4677A1EF1FBAD1
1F8D06A9DAD8103C2CE861A9 fileType=RAR fsize=131372 cs1Label=
SandboxImageType cs1=MAK_win7sp1en_offices_noab_TL cn2Label=
ROZRating cn2=1 cn1Label=GRIDIsKnownGood cn1=-1 cs2Label=Mal
wareName cs2=HEUR_NAMETRICK.A cn3Label=PcapReady cn3=0

CEF virtual analyzer logs: notable characteristics
eventsTable 3-6. CEF Notable Characteristics Events
CEF Key

Description

Value

Header (logVer)

CEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

200127Header (eventName)

Description

Notable Characteristics of theanalyzed sample

Header (severity)

Severity

6 (fixed value)

3-17

Trend Micro Deep Discovery Inspector Syslog Guide

CEF Key

Description

Value

cs1

Violated policy nameExample: Suspicious network or
messaging activity

cs1LabelViolated policy name

PolicyCategorycs2

Analysis violated event

Example: Uses spoofed version
informationcs2LabelAnalysis violated event

PolicyName

deviceExternalId

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

dvcmacAppliance MAC address

Example: 00:0C:29:6E:CB:F9

fileHash

SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

fileType

True file type

Example: WIN32 EXE

fname

File nameExample: excel.rar

fsize

File size

Example: 131372

msg

Details

Example: The file has no company
information.

rtAnalysis time

Example: Mar 09 2015 17:05:21
GMT+08:00

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|200127|N
otable Characteristics of the analyzed sample|6|rt=Mar 11 20
15 05:00:26 GMT-04:00 dvc=10.201.156.143 dvchost=ddi38-143 d
vcmac=00:0C:29:A6:53:0C deviceExternalId=D2C1D6D20FF8-4FC98F
92-25EB-D7DA-AF0E fname=DTAS_WIN32_07 fileHash=672B1A8ADB412

3-18

Syslog content mapping - CEF

C272CCA21A214732C447B650349 fileType=WIN32 EXE fsize=290304
cs1Label=PolicyCategory cs1=Deception, social engineering ms
g=The file has no company information. cs2Label=PolicyName c
s2=Uses spoofed version information

CEF virtual analyzer logs: deny list transaction
eventsTable 3-7. CEF Deny List Transaction Events
CEF Key

Description

Value

Header (logVer)

CEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

200120

Header (eventName)

Description

Deny List updated

Header (severity)

Severity

3 (fixed value)act

The action in the event

Add or Remove

cs1

Type

• Deny List IP/Port• Deny List URL• Deny List File SHA1
• Deny List Domain

cs1Label

Type

cs2

Risk level

type
• Low
• Medium• High• Confirmed malware

3-19

Trend Micro Deep Discovery Inspector Syslog Guide

CEF Key

Description

Valuecs2Label

Risk level

RiskLevel

deviceExternalId

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

dhost

Destination host nameExample: iplasticalsex.ru

dpt

Destination port

Value between 0 and 65535

dst

Destination IP address

Example: 10.1.144.199

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

dvcmacAppliance MAC address

Example: 00:0C:29:6E:CB:F9

end

Report end time

Example: Mar 09 2015 17:05:21
GMT+08:00

fileHash

SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

requestURL

Example: http://1.2.3.4/query?
term=value

rtAnalysis time

Example: Mar 09 2015 17:05:21
GMT+08:00

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|200120|D
eny List updated|3|rt=Mar 11 2015 07:15:45 GMT-04:00 dvc=10.
201.156.143 dvchost=ddi38-143 dvcmac=00:0C:29:A6:53:0C devic
eExternalId=D2C1D6D20FF8-4FC98F92-25EB-D7DA-AF0E cs1Label=ty
pe cs1=Deny List Domain end=Apr 10 2015 07:15:35 GMT-04:00 act=Add dhost=plasticalsex.ru cs2Label=RiskLevel cs2=Medium

3-20Chapter 4

Syslog content mapping - LEEF
The following tables outline syslog content mapping between Deep
Discovery Inspector log output and LEEF syslog types:• LEEF threat logs on page 4-2• LEEF disruptive application logs on page 4-9• LEEF web reputation logs on page 4-12
• LEEF system logs on page 4-16
• LEEF correlation incident logs on page 4-17
• LEEF virtual analyzer logs: file analysis events on page 4-20
• LEEF virtual analyzer logs: notable characteristics events on page 4-22
Note
In LEEF log syntax, separate event attributes with a tab delimiter, <009>.

4-1

Trend Micro Deep Discovery Inspector Syslog Guide

LEEF threat logs
Table 4-1. LEEF Threat Logs
LEEF Key

Description

Value

Header (logVer)

LEEF format version

LEEF: 1.0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventName)

Event Name

• MALWARE_DETECTION• MALWARE_OUTBREAK_DETECTION• SECURITY_RISK_DETECTIONact

The action in the event

blocked or not blocked

aggregatedCnt

Aggregated countExample: 1

aptRelated

Indicates an APT-related
event

0 or 1

botCommand

BOT command

Example: COMMIT

botUrl

BOT URL

Example: trend.com

cccaDestination

CCCA address

Example: 10.1.144.199

cccaDestinationFormat

CCCA type• IP_DOMAIN• IP_DOMAIN_PORT• URL• EMAIL

cccaDetection

CCCA detection

cccaDetectionSource

CCCA log is detected by

0 or 1• GLOBAL_INTELLIGENCE• VIRTUAL_ANALYZER• USER_DEFINED

4-2

Syslog content mapping - LEEF

LEEF Key
cccaRiskLevel

Description
CCCA Risk Level

Value• 0: Unknown• 1: Low• 2: Medium• 3: HighchannelName

Channel nameExample: IRCChannel1

chatUserName

Nickname

Example: IRCUser1

cnt

Total countExample: 1

compressedFileName

File name in archive

Example: mtxlegih.dll

detectionType

Detection type

• 0: Known detection• 1: Unknown detection• 2: OPS detection

deviceDirection

Packet direction• 0: Source is external• 1: Source is internal• 2: Unknown

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

deviceRiskConfidenceLevelConfidence level• 1: High• 2: Medium• 3: Low• 0: UndefineddevTimeLog generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

devTimeFormat

Time format

MMM dd yyyy HH:mm:ss z

dhost

Destination host nameExample: dhost1

4-3

Trend Micro Deep Discovery Inspector Syslog Guide

LEEF Key

Description

Value

dOSName

Destination host OS

Example: Android

dst

Destination IP address

Example: 10.1.144.199

dstGroup

Network Group assigned
to a destination host

Example: monitor1

dstMAC

Destination MAC

Example: 00:0C:29:6E:CB:F9

dstPortDestination port

Value between 0 and 65535

dstZoneDestination zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network anduntrusted

4-4

duser

Mail recipient

Example: duser1

dUser1

Destination user name 1

Example: admin

dUser1LoginTime

Destination user log ontime 1

Example: Mar 09 2015 17:05:21
GMT+08:00

dUser2

Destination user name 2

Example: admin

dUser2LoginTime

Destination user log ontime 2

Example: Mar 09 2015 17:05:21
GMT+08:00

dUser3

Destination user name 3

Example: admin

dUser3LoginTime

Destination user log ontime 3

Example: Mar 09 2015 17:05:21
GMT+08:00

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

evtCatEvent category

Example: Suspicious Traffic

evtSubCat

Event subcategory

Example: EmailSyslog content mapping - LEEF

LEEF Key

Description

Value

fileHash

SHA1

Example:1EDD5B38DE47295457670
88C5CAB395E4197C8F3

filePath

File path

Example: SHARE\\

fileType

Real file type

Example: 1638400

fnameFile nameExample: excel.rar

fsize

File size

Example: 131372

hackerGroup

Hacker group

Example: Comment Crew

hackingCampaign

Hacking campaign

Example:Aurora

hostName

Host nameExample: CLIENT1

interestedIp

Interested IP

Example: 10.1.144.199

mailMsgSubject

Mail subject

Example: hello

malFamily

Malware family

Example:DuqumalNameMalware nameExample: HEUR_NAMETRICK.A

malType

Malware type

Example: MALWARE

mitigationTaskId

Event task ID for
mitigation

Example:dc036acb-9a2e-4939-8244dedbda9ec4ba

msg

Description

Example: HEUR_NAMETRICK.A SMTP (Email)oldFileHash

Mail attachment SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

oldFileName

Mail attachment file nameExample: excel.rar

oldFileSize

Mail attachment file size

Example: 150000

oldFileType

Mail attachment file type

Example: 1638400

4-5

Trend Micro Deep Discovery Inspector Syslog Guide

LEEF Key
pAttackPhase

Description
Primary attack phase

Value• Intelligence Gathering• Point of Entry• Command and Control
Communication• Lateral Movement• Asset and Data Discovery• Data Exfiltration• Nil (no applicable attack phase)

pComp

Detection engine/component

Example: VSAPI

peerIP

Peer IP

Example: 10.1.144.199

proto

ProtocolExample: SMTP

protoGroup

Protocol group

Example: SMTP

ptype

Application type

IDS

requestClientApplication

User agent

Example: IE

riskType

Potential risk

• 0: Known risk
• 1: Potential risk

ruleIdRule ID

Example: 52sAttackPhase

Secondary attack phase

Example: Point of Entry

sev

Severity• 2: Informational• 4: Low• 6: Medium• 8: High

4-6

shost

Source host nameExample: shost1sOSName

Source host OS

Example: Android

Syslog content mapping - LEEF

LEEF Key

Description

Value

src

Source IP address

Example: 10.1.144.199

srcGroup

Network Group assigned
to a source host

Example: monitor1

srcMAC

Source MAC

Example: 00:0C:29:6E:CB:F9

srcPortSource port

Value between 0 and 65535

srcZoneSource zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network anduntrusted

suid

User nameExample: User1

suser

Mail sender

Example: suser1

sUser1

Source user name 1

Example: adminsUser1LoginTime

Source user log on time 1

Example: Mar 09 2015 17:05:21
GMT+08:00

sUser2

Source user name 2

Example: adminsUser2LoginTime

Source user log on time 2

Example: Mar 09 2015 17:05:21
GMT+08:00

sUser3

Source user name 3

Example: adminsUser3LoginTime

Source user log on time 3

Example: Mar 09 2015 17:05:21
GMT+08:00

threatType

Threat type

• 0: Malicious content• 1: Malicious behavior• 2: Suspicious behavior• 3: Exploit• 4: Grayware

4-7

Trend Micro Deep Discovery Inspector Syslog Guide

LEEF Key

Description

Value

url

URL

Example: http://1.2.3.4/query?
term=value

vLANIdVLANID

Value between 0 and 4095

Log sample:
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab
delimiter.
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1175|SECUR
ITY_RISK_DETECTION|devTimeFormat=MMM dd yyyy HH:mm:ss z<009>
ptype=IDS<009>dvc=10.201.156.143<009>deviceMacAddress=00:0C:
29:A6:53:0C<009>dvchost=ddi38-143<009>deviceGUID=6B593E17AFB
7-40FBBB28-A4CE-0462-A536<009>devTime=Mar 09 2015 11:58:24 G
MT+08:00<009>sev=6<009>protoGroup=HTTP<009>proto=HTTP<009>vL
ANId=4095<009>deviceDirection=1<009>dhost=www.freewebs.com<009>dst=216.52.115.2<009>dstPort=80<009>dstMAC=00:1b:21:35:8b:98<009>shost=172.16.1.197<009>src=172.16.1.197<009>srcPort=
12121<009>srcMAC=fe:ed:be:ef:5a:c6<009>malType=MALWARE<009>s
AttackPhase=Point of Entry<009>fname=setting.doc<009>fileType=0<009>fsize=0<009>ruleId=20<009>msg=HEUR_NAMETRIC
K.A - SMTP (Email)<009>deviceRiskConfidenceLevel=2<009>url=http://www.freewebs.com/setting3/setting.doc<009>pComp=CAV<009>riskType=1<009>
srcGroup=Default<009>srcZone=1<009>dstZone=0<009>detectionType=1<009>act=not blocked<009>threatType=1<009>interes
tedIp=172.16.1.197<009>peerIp=216.52.115.2<009>hostName=www.
freewebs.com<009>cnt=1<009>aggregatedCnt=1<009>cccaDestinati
onFormat=URL<009>cccaDetectionSource=GLOBAL_INTELLIGENCE<009>cccaRiskLevel=2<009>cccaDestination=http://www.freewebs.com/setting3/setting.doc<009>cccaDetection=1<009>evtCat=Callbac

4-8

Syslog content mapping - LEEF

k evtSubCat=Bot<009>pAttackPhase=Command and Control Communi
cationLEEF disruptive application logs
Table 4-2. LEEF Disruptive Application Logs
LEEF Key

Description

Value

Header (logVer)

LEEF format version

LEEF: 1.0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventName)

Event NameDISRUPTIVE_APPLICATION_DETECT
ION

aggregatedCnt

AggrCount

Example: 1

cnt

Total countExample: 1

deviceDirection

Packet direction• 0: Source is external• 1: Source is internal• 2: Unknown

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

devTimeLog generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

devTimeFormat

Time format

MMM dd yyyy HH:mm:ss z

dhost

Destination host nameExample: dhost1dOSName

Destination host OS

Example: Android

dst

Destination IP address

Example: 10.1.144.199

4-9

Trend Micro Deep Discovery Inspector Syslog Guide

LEEF Key

Description

Value

dstGroup

Network Group assigned
to a destination host

Example: monitor1

dstMAC

Destination MAC

Example: 00:0C:29:6E:CB:F9

dstPortDestination port

Value between 0 and 65535

dstZoneDestination zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network andnot trusted

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhostinterestedIp

Interested IP

Example: 10.1.144.199

msg

Description

Example: Deep Discovery Inspector
detected the protocol in yourmonitored network

pComp

Detection engine/component

Example: VSAPI

peerIP

Peer IP

Example: 10.1.144.199

proto

ProtocolExample: SMTP

protoGroup

Protocol group

Example: SMTP

ptype

Application type

IDS

sev

Severity• 2: Informational• 4: Low• 6: Medium• 8: High

shost

4-10

Source host nameExample: shost1

Syslog content mapping - LEEF

LEEF Key

Description

Value

sOSName

Source host OS

Example: Android

src

Source IP address

Example: 10.1.144.199

srcGroup

Network Group assigned
to a source host

Example: monitor1

srcMAC

Source MAC

Example: 00:0C:29:6E:CB:F9

srcPortSource port

Value between 0 and 65535

srcZoneSource zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network andnot trusted

threatType

Threat type6

vLANIdVLANID

Value between 0 and 4095

Log sample:
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab
delimiter.
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1175|DISRUPTIVE_APPLICATION_DETECTION|devTimeFormat=MMM dd yyyy HH:mm:
ss z<009>dvc=10.201.156.143<009>deviceMacAddress=00:0C:29:A6:53:0C<009>dvchost=ddi38-143<009>deviceGUID=6B593E17AFB7-40F
BBB28-A4CE-0462-A536<009>ptype=IDS<009>devTime=Mar 09 2015 1
4:20:38 GMT+08:00<009>sev=2<009>protoGroup=STREAMING<009>pro
to=WMSP<009>vLANId=4095<009>deviceDirection=1<009>dhost=12.1
90.48.13<009>dst=12.190.48.13<009>dstPort=80<009>dstMAC=00:1
7:9a:65:f3:05<009>shost=192.168.33.2<009>src=192.168.33.2<00

4-11

Trend Micro Deep Discovery Inspector Syslog Guide

9>srcPort=35125<009>srcMAC=00:16:6f:a1:3d:7a<009>msg=Deep Di
scovery Inspector detected the protocol in your monitored ne
twork.<009>pComp=CAV<009>threatType=6<009>srcGroup=Default<009>srcZone=1<009>dstZone=0<009>interestedIp=192.168.33.2<009>peerIp=12.190.48.13<009>cnt=1<009>aggregatedCnt=1

LEEF web reputation logs
Table 4-3. LEEF Web Reputation Logs
LEEF Key

Description

Value

Header (logVer)

LEEF format version

LEEF: 1.0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventName)

Event Name

WEB_THREAT_DETECTION

cccaDetection

CCCA detection

0 or 1

cccaDetectionSource

CCCA log is detected by• GLOBAL_INTELLIGENCE• VIRTUAL_ANALYZER• USER_DEFINED

cccaRiskLevel

CCCA Risk Level• 0: Unknown• 1: Low• 2: Medium• 3: HighdeviceDirection

Packet direction• 0: Source is external• 1: Source is internal• 2: Unknown

deviceGUID

4-12

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

Syslog content mapping - LEEF

LEEF Key

Description

Value

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

devTimeLog generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

devTimeFormat

Time format

MMM dd yyyy HH:mm:ss z

dhost

Destination host nameExample: dhost1dOSName

Destination host OS

Example: Android

dst

Destination IP address

Example: 10.1.144.199

dstGroup

Network Group assigned
to a destination host

Example: monitor1

dstMAC

Destination MAC

Example: 00:0C:29:6E:CB:F9

dstPortDestination port

Value between 0 and 65535

dstZoneDestination zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network andnot trusted

duser

Mail recipient

Example: duser1

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

hostName

Host nameExample: CLIENT1

interestedIp

Interested IP

Example: 10.1.144.199

mailMsgSubject

Mail subject

Example: hello

msg

Description

Example: Dangerous URL in Web
Reputation Services database HTTP (Request)

4-13

Trend Micro Deep Discovery Inspector Syslog Guide

LEEF Key

Description

Value

pComp

Detection engine/component

Example: VSAPI

peerIP

Peer IP

Example: 10.1.144.199

proto

ProtocolExample: SMTP

protoGroup

Protocol group

Example: SMTP

ptype

Application type

IDS

requestClientApplication

User agent

Example: IE

riskScore

Score

Example: 49

sev

Severity• 2: Informational• 4: Low• 6: Medium• 8: Highshost

Source host nameExample: shost1sOSName

Source host OS

Example: Android

src

Source IP address

Example: 10.1.144.199

srcGroup

Network Group assigned
to a source host

Example: monitor1

srcMAC

Source MAC

Example: 00:0C:29:6E:CB:F9

srcPortSource port

Value between 0 and 65535

srcZoneSource zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network andnot trusted

suser

4-14

Mail sender

Example: suser1

Syslog content mapping - LEEF

LEEF Key

Description

Value

threatType

Threat type

5

url

URL

Example: http://1.2.3.4/query?
term=value

urlCatCategory

Example: GamblingvLANIdVLANID

Value between 0 and 4095

Log sample:
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab
delimiter.
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1175|WEB_T
HREAT_DETECTION|devTimeFormat=MMM dd yyyy HH:mm:ss z<009>dvc=10.201.156.143<009>deviceMacAddress=00:0C:29:A6:53:0C<009>dvchost=ddi38-143<009>deviceGUID=6B593E17AFB7-40FBBB28-A4CE-0
462-A536<009>ptype=IDS<009>devTime=Mar 09 2015 14:06:36 GMT+
08:00<009>sev=6<009>protoGroup=HTTP<009>proto=HTTP<009>vLANI
d=4095<009>deviceDirection=1<009>dhost=www.freewebs.com<009>
dst=216.52.115.2<009>dstPort=80<009>dstMAC=00:1b:21:35:8b:98<009>shost=172.16.1.197<009>src=172.16.1.197<009>srcPort=121
21<009>srcMAC=fe:ed:be:ef:5a:c6<009>hostName=www.freewebs.com<009>msg=Dangerous URL in Web Reputation Services
database - HTTP (Request)<009>url=http://www.freewebs.com/setting3/setting.doc<009>
pComp=TMUFE<009>srcGroup=Default<009>
srcZone=1<009>dstZone=0<009>urlCat=
Disease Vector<009>riskScore=49<009>threatTy
pe=5<009>interestedIp=172.16.1.197<009>
peerIp=216.52.115.2

4-15

Trend Micro Deep Discovery Inspector Syslog Guide

LEEF system logs
Table 4-4. LEEF System Logs
LEEF Key

Description

Value

Header (logVer)

LEEF format version

LEEF: 1.0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventName)

Event Name

• PRODUCT_UPDATE• SYSTEM_EVENT

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

devTimeLog generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

devTimeFormat

Time format

MMM dd yyyy HH:mm:ss z

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

msg

Description

Example: The system time setting
has been changed.

ptype

Application type

IDS

sev

Severity• 2: Informational• 4: Warning• 6: Severe
Example: 2

Log sample:

4-16

Syslog content mapping - LEEF

Note
When using the LEEF log syntax, separate event attributes with <009> as a tab
delimiter.
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1175|SYSTE
M_EVENT|dvc=10.201.156.143<009>deviceMacAddress=00:0C:29:A6:
53:0C<009>dvchost=ddi38-143<009>deviceGUID=6B593E17AFB7-40FB
BB28-A4CE-0462-A536<009>ptype=IDS<009>devTimeFormat=MMM dd yyyy HH:mm:ss z<009>sev=2<009>msg=The system time setting has
been changed.<009>devTime=Mar 09 2015 16:46:08 GMT+08:00

LEEF correlation incident logs
Table 4-5. LEEF Correlation Incident Logs
LEEF Key

Description

Value

Header (logVer)

LEEF format version

LEEF: 1.0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventName)

Event NameSUSPICIOUS_BEHAVIOUR_DETECTI
ON

data0

Correlation data 0

Additional attribute values

data1

Correlation data 1

Additional attribute values

data2

Correlation data 2

Additional attribute values

data3

Correlation data 3

Additional attribute values

data4

Correlation data 4

Additional attribute values

data5

Correlation data 5

Additional attribute values

data6

Correlation data 6

Additional attribute values

4-17Trend Micro Deep Discovery Inspector Syslog Guide

LEEF Key

Description

Value

data7

Correlation data 7

Additional attribute values

data8

Correlation data 8

Additional attribute values

data9

Correlation data 9

Additional attribute values

deviceDirection

Packet direction• 0: Source is external• 1: Source is internal• 2: Unknown

4-18

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

devTimeLog generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

devTimeFormat

Time format

MMM dd yyyy HH:mm:ss z

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhostinterestedHost

Interested host nameExample: trend.net

interestedIp

Interested IP

Example: 10.1.144.199

interestedMacAddress

Interested MAC address

Example: 00:0C:29:6E:CB:F9interestedUser

Interested user name 1

Example: user1

interestedUser2

Interested user name 2

Example: user2

interestedUser3

Interested user name 3

Example: user3

pComp

Detection engine/component

Correlation

proto

ProtocolExample: SMTP

ptype

Application type

IDS

Syslog content mapping - LEEF

LEEF Key

Description

Value

ruleIdRule ID

Example: 52

ruleName

Rule nameExample: This host has responded
to DNS queries.

sev

Severity• 2: Informational• 4: Low• 6: Medium• 8: HighthreatName

Threat nameExample: Malicious Bot

threatType

Threat type

Example: Malware-relateduserGroup

User group

Example: Default

Log sample:
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab
delimiter.
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1181|SUSPICIOUS_BEHAVIOUR_DETECTION|devTimeFormat=MMM dd yyyy HH:mm:ss
z<009>deviceMacAddress=00:0C:29:A6:53:0C<009>dvchost=ddi38143<009>pComp=Correlation<009>dvc=10.201.156.143<009>ptype=I
DS<009>deviceGUID=D2C1D6D20FF8-4FC98F92-25EB-D7DA-AF0E<009>d
evTime=Mar 11 2015 22:05:50 GMT-04:00<009>sev=2<009>interest
edIp=172.16.0.100<009>interestedHost=172.16.0.100<009>intere
stedMacAddress=00:0c:29:70:45:...36<009>ruleId=47<009>ruleNa
me=This host has responded to DNS queries.<009>threatType=Un
registered Service<009>threatName=Unregistered DNS Server<009>proto=DNS Response<009>userGroup=Default<009>deviceDirecti
on=1

4-19

Trend Micro Deep Discovery Inspector Syslog Guide

LEEF virtual analyzer logs: file analysis events
Table 4-6. LEEF File Analysis Events
LEEF Key

4-20

Description

Value

Header (logVer)

LEEF format version

LEEF: 1.0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventName)

Event Name

FILE_ANALYZED

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

deviceOSName

Sandbox image typeSandboxImageTypedeviceProcessHash

Parent SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

devTimeAnalysis time

Example: Mar 09 2015 17:05:21
GMT+08:00

devTimeFormat

Time format

MMM dd yyyy HH:mm:ss z

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

fileHash

File SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

fileType

True file type

Example: WIN32 EXE

fname

File nameExample: excel.rar

fsize

File size

Example: 131372

Syslog content mapping - LEEF

LEEF Key

Description

gridIsKnownGood

GRID is known goodValue
• 0: Bad file• -1: Unknown file• 1: Good filemalName

Virus nameExample: HEUR_NAMETRICK.A

pcapReady

PCAP readyExample: 1

pComp

Detection source• Sandbox• UDSO (User-Defined Suspicious
Objects)

rozRating

ROZ rating• 0: No risk
• 1: Low risk
• 2: Medium risk
• 3: High risk

sev

Severity

3 (fixed value)

Log sample:
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab
delimiter.
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1181|FILE_ANALYZED|devTime=Mar 11 2015 07:36:27 GMT-04:00<009>devTimeF
ormat=MMM dd yyyy HH:mm:ss z<009>sev=3<009>pComp=Sandbox<009>dvc=10.201.156.143<009>dvchost=ddi38-143<009>deviceMacAddre
ss=00:0C:29:A6:53:0C<009>deviceGUID=D2C1D6D20FF8-4FC98F92-25
EB-D7DA-AF0E<009>fname=mwsoemon.exe<009>fileHash=89DE67C5220
91EE259533D9CBDDF37DDB8C8D636<009>malName=Possible_Virus<009>fileType=WIN32 EXE<009>fsize=59392<009>deviceOSName=MAK_win

4-21

Trend Micro Deep Discovery Inspector Syslog Guide

7sp1en_offices_noab_TL<009>gridIsKnownGood=-1<009>rozRating=1<009>pcapReady=1

LEEF virtual analyzer logs: notable characteristics
eventsTable 4-7. LEEF Notable Characteristics Events
LEEF Key

4-22

Description

Value

Header (logVer)

LEEF format version

LEEF: 1.0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventName)

Event NameNOTABLE_CHARACTERISTICS

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

deviceOSName

Sandbox image type

Example: win7

devTimeAnalysis time

Example: Mar 09 2015 17:05:21
GMT+08:00

devTimeFormat

Time format

MMM dd yyyy HH:mm:ss z

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

fileHash

File SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

fileType

True file type

Example: WIN32 EXE

fname

File nameExample: excel.rar

fsize

File size

Example: 131372

Syslog content mapping - LEEF

LEEF Key

Description

Value

msg

Details

Example:www.chapisteriadaniel.com

pComp

Detection source

Sandbox

ruleCategory

Violated policy nameExample: Internet Explorer Setting
Modification

ruleName

Analysis violated event

Example: Modified importantregistry items

sev

Severity

6 (fixed value)

Log sample:
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab
delimiter.
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1181|NOTAB
LE_CHARACTERISTICS|devTime=Mar 11 2015 05:00:26 GMT-04:00<00
9>devTimeFormat=MMM dd yyyy HH:mm:ss z<009>sev=6<009>pComp=S
andbox<009>dvc=10.201.156.143<009>dvchost=ddi38-143<009>devi
ceMacAddress=00:0C:29:A6:53:0C<009>deviceGUID=D2C1D6D20FF8-4
FC98F92-25EB-D7DA-AF0E<009>fname=DTAS_WIN32_07<009>fileHash=
672B1A8ADB412C272CCA21A214732C447B650349<009>fileType=WIN32
EXE<009>fsize=290304<009>ruleCategory=Suspicious network or
messaging activity<009>ruleName=Queries DNS server<009>msg=012webpages.com<009>deviceOSName=MAK_win7sp1en_offices_noab_TL4-23

Trend Micro Deep Discovery Inspector Syslog Guide

LEEF virtual analyzer logs: deny list transaction
event
Table 4-8. LEEF Deny List Transaction Events
LEEF Key

Description

Value

Header (logVer)

LEEF format version

LEEF: 1.0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventName)

Event NameDENYLIST_CHANGE

act

The action in the event• Add• RemovedeviceExternalRiskType

Risk level• Low• Medium• High• Confirmed malware

4-24

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

devTimeAnalysis time

Example: Mar 09 2015 17:05:21
GMT+08:00

devTimeFormat

Time format

MMM dd yyyy HH:mm:ss z

dhost

Destination host nameExample: insta-find.com

dpt

Remote port

Value between 0 and 65535

dst

Remote IP

Example: 10.1.144.199

dvc

Appliance IP address

Example: 10.1.144.199

Syslog content mapping - LEEF

LEEF Key

Description

Value

dvchostAppliance host nameExample: localhost

end

Report end time

Example: Mar 09 2015 17:05:21
GMT+08:00

fileHash

File SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

pComp

Detection source

Sandboxsev

Severity

3 (fixed value)

type

Deny List type

• Deny List IP/Port• Deny List URL• Deny List File SHA1
• Deny List Domain

url

URL

Example: http://1.2.3.4/

Log sample:
Note
When using the LEEF log syntax, separate event attributes with <009> as a tab
delimiter.
LEEF:1.0|Trend Micro|Deep Discovery Inspector|3.8.1181|DENYL
IST_CHANGE|devTime=Mar 11 2015 05:00:42 GMT-04:00<009>devTim
eFormat=MMM dd yyyy HH:mm:ss z<009>sev=3<009>pComp=Sandbox<009>dvc=10.201.156.143<009>dvchost=ddi38-143<009>deviceMacAdd
ress=00:0C:29:A6:53:0C<009>deviceGUID=D2C1D6D20FF8-4FC98F9225EB-D7DA-AF0E<009>end=Apr 10 2015 05:00:26 GMT-04:00<009>ac
t=Add<009>dhost=ourdatatransfers.com<009>deviceExternalRiskT
ype=High<009>type=Deny List Domain

4-25Chapter 5

Syslog content mapping - TMEF
The following tables outline syslog content mapping between Deep
Discovery Inspector log output and TMEF syslog types:• TMEF threat logs on page 5-2• TMEF disruptive application logs on page 5-11
• TMEF web reputation logs on page 5-15
• TMEF system logs on page 5-20
• TMEF correlated incident logs on page 5-22
• TMEF virtual analyzer logs: file analysis events on page 5-24
• TMEF virtual analyzer logs: notable characteristics events on page 5-26
• TMEF virtual analyzer logs: deny list transaction events on page 5-28

5-1

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF threat logs
Table 5-1. TMEF Threat Logs
TMEF Key

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Event ID

• 100100• 100118• 100119

Header (eventName)

Event Name

• MALWARE_DETECTION• MALWARE_OUTBREAK_DETECTION• SECURITY_RISK_DETECTION

Header (severity)

Severity• 2: Informational• 4: Low• 6: Medium• 8: High

5-2

act

The action in the event

blocked or not blocked

appProtocolExample: HTTP

appGroup

Protocol group

Example: HTTP

compressedFileHash

Compressed file SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3compressedFileName

File name in archive

Example: mtxlegih.dll

compressedFileTypeCompressed file type

Example: 0Syslog content mapping - TMEF

TMEF Key

Description

Value

cnt

Total countExample: 1

cn1

CCCA detection

0 or 1cn1Label

CCCA detection

CCCA_Detection

cn2

Indicates an APT-related
event

0 or 1cn2Label

Indicates an APT-related
event

APT Related

cn3

Potential risk

• 0: Known risk
• 1: Potential risk

cn3LabelPotential risk

Deep Discovery_PotentialRisk

cn4

Threat type

• 0: Malicious content• 1: Malicious behavior• 2: Suspicious behavior• 3: Exploit• 4: Grayware

cn4LabelThreat type

Deep Discovery_ThreatType

cn5

Aggregated countExample: 1

cn5LabelAggregated countAggregatedCnt

cn6

CCCA Risk Level• 0: Unknown• 1: Low• 2: Medium• 3: High

cn6Label

CCCA Risk Level

cn7

Heuristic flag

CCCA_RiskLevel• 0: Non-heuristic detection• 1: Heuristic detection

5-3Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

Valuecn7LabelHeuristic flag

HeurFlagcs1

Channel nameExample: IRCChannel1

cs1Label

Channel name

IRCChannelName

cs2

Nickname

Example: IRCUser1

cs2Label

Nickname

IRCUserName

cs3

Host nameExample: CLIENT1

cs3Label

Host name

HostName_Ext

cs4

Network Group assigned
to a source host

Example: monitor1

cs4Label

Network Group assigned
to a source host

Deep Discovery_SrcGroup

cs5

Source zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network anduntrusted

cs5Label

Source zone

Deep Discovery_SrcZone

cs6

Detection type

• 0: Known detection• 1: Unknown detection• 2: OPS detection

5-4

cs6Label

Detection type

Deep Discovery_DetectionTypecs7

BOT command

Example: COMMIT

cs7Label

BOT command

BOT_CMD

cs8

BOT url

Example: trend.com

cs8Label

BOT url

BOT_URL

Syslog content mapping - TMEF

TMEF Key

Description

Value

cs9

Network Group assigned
to a destination host

Example: monitor1

cs9Label

Network Group assigned
to a destination host

Deep Discovery_DstGroup

cs10

Destination zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network anduntrusted

cs10Label

Destination zone

cs11

CCCA log is detected by

Deep Discovery_DstZone• GLOBAL_INTELLIGENCE• VIRTUAL_ANALYZER• USER_DEFINED• RELEVANCE_RULE

cs11Label

CCCA log is detected by

CCCA_DetectionSource

cs12

CCCA address

Example: 10.1.144.199

cs12Label

CCCA address

CCCA_Destination

cs13

CCCA type• IP_DOMAIN• IP_DOMAIN_PORT• URL• EMAIL

cs13Label

CCCA typedeviceDirection

Packet direction

CCCA_DestinationFormat• 0: Source is external• 1: Source is internal• 2: Unknown

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

5-5

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

Value

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

devicePayloadId

An extendable field.

Examples:deviceRiskConfidenceLevelFormat: {threat_type}:{log_id}:{with pcap file
captured}{:extensions}*• With pcap file captured:
2:10245:P

Confidence level• 1: High• Without pcap file captured:
2:10245:• 2: Medium• 3: Low• 0: Undefined

5-6

dhost

Destination host nameExample: dhost1

dmac

Destination MAC

Example: 00:0C:29:6E:CB:F9dOSName

Destination host OS

Example: Android

dpt

Destination port

Value between 0 and 65535

dst

Destination IP address

Example: 10.1.144.199

duser

Mail recipient

Example: duser1

dUser1

Destination user name 1

Example: admin

dUser1LoginTime

Destination user log ontime 1

Example: Mar 09 2015 17:05:21
GMT+08:00

dUser2

Destination user name 2

Example: admin

dUser2LoginTime

Destination user log ontime 2

Example: Mar 09 2015 17:05:21
GMT+08:00

dUser3

Destination user name 3

Example: admin

dUser3LoginTime

Destination user log ontime 3

Example: Mar 09 2015 17:05:21
GMT+08:00

dvc

Appliance IP address

Example: 10.1.144.199

Syslog content mapping - TMEF

TMEF Key

Description

Value

dvchostAppliance host nameExample: localhost

evtCatEvent category

Example: Suspicious Traffic

evtSubCat

Event sub category

Example: EmailexternalId

Log ID

Example: 11

fileHash

SHA1

Example:1EDD5B38DE47295457670
88C5CAB395E4197C8F3

filePath

File path

Example: SHARE\\

fileType

Real file type

Example: 1638400

fnameFile nameExample: excel.rar

fsize

File size

Example: 131372

hackerGroup

Hacker group

Example: Comment Crew

hackingCampaign

Hacking campaign

Example: Aurora

hostSeverity

Host Severity

Example: 4interestedIp

Interested IP

Example: 10.1.144.199

mailMsgSubject

Mail subject

Example: hello

malFamily

Malware family

Example: DuqumalNameMalware nameExample: HEUR_NAMETRICK.A

malType

Malware type

Example: MALWARE

messageId

Message ID

Example:<20090130042416.7060505@jovenci
tasvirgenes.com.ar>

mitigationTaskId

Event task ID for
mitigation

Example:dc036acb-9a2e-4939-8244dedbda9ec4ba

5-7

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

Value

oldFileHash

Mail attachment SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

oldFileName

Mail attachment file nameExample: excel.rar

oldFileSize

Mail attachment file size

Example: 150000

oldFileType

Mail attachment file type

Example: 1638400

pAttackPhase

Primary attack phase• Intelligence Gathering• Point of Entry• Command and Control
Communication• Lateral Movement• Asset and Data Discovery• Data Exfiltration• Nil (no applicable attack phase)

5-8

pComp

Detection engine/component

Example: VSAPI

peerIP

Peer IP

Example: 10.1.144.199

ptype

Application type

IDS

reasonReasonExample: ["Protocol: 4"]

requestURL

Example: http://1.2.3.4/query?
term=value

requestClientApplication

User agent

Example: IE

rt

Log generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

ruleIdRule ID

Example: 52

Syslog content mapping - TMEF

TMEF Key

Description

ruleName

DescriptionsAttackPhase

Secondary attack phase

Value
Example: Email message sent
through an unregistered SMTP
server• Intelligence Gathering• Point of Entry• Command and Control
Communication• Lateral Movement• Asset and Data Discovery• Data Exfiltration• Nil (no applicable attack phase)shost

Source host nameExample: shost1

smac

Source MAC

Example: 00:0C:29:6E:CB:F9

sOSName

Source host OS

Example: Android

spt

Source port

Value between 0 and 65535

src

Source IP address

Example: 10.1.144.199

suidUser nameExample: User1

suser

Mail sender

Example: suser1

sUser1

Source user name 1

Example: adminsUser1LoginTime

Source user log on time1

Example: Mar 09 2015 17:05:21
GMT+08:00

sUser2

Source user name 2

Example: adminsUser2LoginTime

Source user log on time 2

Example: Mar 09 2015 17:05:21
GMT+08:00

sUser3

Source user name 3

Example: admin

5-9Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

ValuesUser3LoginTime

Source user log on time 3

Example: Mar 09 2015 17:05:21
GMT+08:00

vLANIdVLANID

Value between 0 and 4095

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|
5.0.1329|100100|
MALWARE_DETECTION|8| ptype=IDS dvc=172.22.9.32
deviceMacAddress=00:50:56:AD:03:BD dvchost=localhost
deviceGUID=E9A3FA433916-4738984C-A4BF-84A0-D603
rt=Jun 22 2017 09:42:47 GMT+08:00 appGroup=HTTP
app=HTTP vLANId=4095 deviceDirection=1 dhost=172.22.9.5
dst=172.22.9.5 dpt=57908 dmac=00:50:56:82:e7:a9
shost=172.22.9.54 src=172.22.9.54 spt=80
smac=00:50:56:82:c6:ae
cs3Label=HostName_Ext cs3=172.22.9.54
malName=Eicar_test_file
malType=Virus fname=eicarcom2.zip fileType=262340608
fsize=308 ruleId=0 ruleName=Eicar_test_file HTTP (Response) deviceRiskConfidenceLevel=0 cn3Label=Deep
Discovery_PotentialRisk cn3=0 cs4Label=Deep
Discovery_SrcGroup
cs4=Default cs5Label=Deep Discovery_SrcZone cs5=1
cs9Label=Deep Discovery_DstGroup cs9=Default
cs10Label=Deep
Discovery_DstZone cs10=1 cs6Label=Deep
Discovery_DetectionTypecs6=0 request=http://172.22.9.54/eicarcom2.ziprequestClientApplication=Wget/1.12 (linux-gnu)
pComp=VSAPI act=not blocked cn4Label=Deep
Discovery_ThreatType
cn4=0 peerIp=172.22.9.5

5-10

Syslog content mapping - TMEF

fileHash=BEC1B52D350D721C7E22A6D4BB0A92909893A3AE
compressedFileName=eicar.com interestedIp=172.22.9.54
cnt=1 dOSName=Linux cn5Label=AggregatedCount
cn5=1 evtCat=Malware evtSubCat=Trojan cn2Label=APT
Related cn2=0 pAttackPhase=Point of Entry externalId=143
cn7Label=HeurFlag cn7=0 compressedFileType=327680
compressedFileHash=3395856CE81F2B7382DEE72602F
798B642F14140 hostSeverity=8 reason=["Malware:
Eicar_test_file"] devicePayloadId=0:143:P

TMEF disruptive application logs
Table 5-2. TMEF Disruptive Application Logs
TMEF Key

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

100120

Header (eventName)

Event NameDISRUPTIVE_APPLICATION_DETECTION

Header (severity)

Severity• 2: Informational• 4: Low• 6: Medium• 8: Highapp

ProtocolExample: HTTP

appGroup

Protocol group

Example: HTTP

cnt

Total countExample: 1

5-11

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

Value

cn4

Threat type6

cn4LabelThreat type

Deep Discovery_ThreatType

cn5

Aggregated countExample: 1

cn5LabelAggregated countAggregatedCnt

cs4

Network Group assigned
to a source host

Example: monitor1

cs4Label

Network Group assigned
to a source host

Deep Discovery_SrcGroup

cs5

Source zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network andnot trusted

cs5Label

Source zone

Deep Discovery_SrcZone

cs9

Network Group assigned
to a destination host

Example: monitor1

cs9Label

Network Group assigned
to a destination host

Deep Discovery_DstGroup

cs10

Destination zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network andnot trusted

cs10Label

Destination zone

Deep Discovery_DstZone

deviceDirection

Packet direction• 0: Source is external• 1: Source is internal• 2: Unknown

5-12

Syslog content mapping - TMEF

TMEF Key

Description

Value

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

devicePayloadId

An extendable field.

Examples:Format: {threat_type}:{log_id}:{with pcap file
captured}{:extensions}*• With pcap file captured:
2:10245:P• Without pcap file captured:
2:10245:

dhost

Destination host nameExample: dhost1

dmac

Destination MAC

Example: 00:0C:29:6E:CB:F9dOSName

Destination host OS

Example: Android

dpt

Destination port

Value between 0 and 65535

dst

Destination IP address

Example: 10.1.144.199

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

externalId

Log ID

Example: 11

interestedIp

Interested IP

Example: 10.1.144.199

msg

Description

Example: Deep Discovery Inspector
detected the protocol in yourmonitored network.

pComp

Detection engine/component

Example: VSAPI

peerIP

Peer IP

Example: 10.1.144.199

ptype

Application type

IDS

rt

Log generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

5-13

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

Value

shost

Source host nameExample: shost1

smac

Source MAC

Example: 00:0C:29:6E:CB:F9

sOSName

Source host OS

Example: Android

spt

Source port

Value between 0 and 65535

src

Source IP address

Example: 10.1.144.199

vLANIdVLANID

Value between 0 and 4095

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|5.0.1329|
100120|DISRUPTIVE_APPLICATION_DETECTION|2|dvc=172.22.9.32
deviceMacAddress=00:50:56:AD:03:BD dvchost=localhost
deviceGUID=E9A3FA433916-4738984C-A4BF-84A0-D603
ptype=IDS rt=Jun 22 2017 10:06:24 GMT+08:00 appGroup=P2P
app=eDonkey vLANId=4095 deviceDirection=1
dhost=10.1.100.223
dst=10.1.100.223 dpt=4662 dmac=00:0c:29:a7:72:74
shost=10.1.117.231 src=10.1.117.231 spt=39933
smac=00:30:da:2d:47:32 cn5Label=AggregatedCount
cn5=1 msg=Deep Discovery Inspector detected theprotocol in your monitored network. cn4Label=Deep
Discovery_ThreatType cn4=6 cs4Label=Deep
Discovery_SrcGroup
cs4=Default cs5Label=Deep Discovery_SrcZone cs5=1
cs9Label=Deep Discovery_DstGroup cs9=Default
cs10Label=Deep
Discovery_DstZone cs10=1 interestedIp=10.1.117.231
peerIp=10.1.100.223 pComp=CAV cnt=1 externalId=11
devicePayloadId=6:11:

5-14

Syslog content mapping - TMEF

TMEF web reputation logs
Table 5-3. TMEF Web Reputation Logs
TMEF Key

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

100101Header (eventName)

Event Name

WEB_THREAT_DETECTION

Header (severity)

Severity• 2: Informational• 4: Low• 6: Medium• 8: Highapp

ProtocolExample: HTTP

appGroup

Protocol group

Example: HTTP

cn1

CCCA detection

0 or 1cn1Label

CCCA detection

CCCA_Detection

cn2

Score

Example: 49

cn2Label

Score

Score

cn4

Threat type5

cn4LabelThreat type

Deep Discovery_ThreatType

cn6

CCCA Risk Level• 0: Unknown• 1: Low• 2: Medium• 3: High

5-15

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

Valuecn6Label

CCCA Risk Level

CCCA_RiskLevel

cs3

Host nameExample: CLIENT1

cs3Label

Host name

HostName_Ext

cs4

Network Group assigned
to a source host

Example: monitor1

cs4Label

Network Group assigned
to a source host

Deep Discovery_SrcGroup

cs5

Source zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network andnot trusted

cs5Label

Source zone

Deep Discovery_SrcZone

cs9

Network Group assigned
to a destination host

Example: monitor1

cs9Label

Network Group assigned
to a destination host

Deep Discovery_DstGroup

cs10

Destination zone

• 0: Not in monitored network• 1: In monitored network andtrusted• 2: In monitored network andnot trusted

cs10Label

Destination zone

cs11

CCCA log is detected by

Deep Discovery_DstZone• GLOBAL_INTELLIGENCE• VIRTUAL_ANALYZER• USER_DEFINED• RELEVANCE_RULE

5-16

Syslog content mapping - TMEF

TMEF Key

Description

Value

cs11Label

CCCA log is detected by

CCCA_DetectionSource

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

devicePayloadId

An extendable field.

Examples:Format: {threat_type}:{log_id}:{with pcap file
captured}{:extensions}*• With pcap file captured:
2:10245:P• Without pcap file captured:
2:10245:

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

deviceDirection

Packet direction• 0: Source is external• 1: Source is internal• 2: Unknown

dhost

Destination host nameExample: 'dhost1

dmac

Destination MAC

Example: 00:0C:29:6E:CB:F9dOSName

Destination host OS

Example: Android

dpt

Destination port

Value between 0 and 65535

dst

Destination IP address

Example: 10.1.144.199

duser

Mail recipient

Example: duser1

externalId

Log ID

Example: 11

hostSeverity

Host Severity

Example: 4interestedIp

Interested IP

Example: 10.1.144.199

mailMsgSubject

Mail subject

Example: hello

5-17

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

msg

Description

pAttackPhase

Primary attack phase

Value
Example: C&C Server URL in Web
Reputation Services database HTTP (Request)• Intelligence Gathering• Point of Entry• Command and Control
Communication• Lateral Movement• Asset and Data Discovery• Data Exfiltration• Nil (no applicable attack phase)

5-18

pComp

Detection engine/component

Example: VSAPI

peerIpPeer IP

Example: 10.1.144.199

ptype

Application type

IDS

reasonReasonExample: ["Protocol: 4"]

requestURL

Example: http://1.2.3.4/query?
term=value

requestClientApplication

User agent

Example: IE

rt

Log generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

sAttackPhase

Secondary attack phase

Example: Point of Entry

shost

Source host nameExample: shost1

smac

Source MAC

Example: 00:0C:29:6E:CB:F9

sOSName

Source host OS

Example: Android

spt

Source port

Value between 0 and 65535

Syslog content mapping - TMEF

TMEF Key

Description

Value

src

Source IP address

Example: 10.1.144.199

suser

Mail sender

Example: suser1

urlCat

URL category

Example: C&C Server

vLANIdVLANID

Value between 0 and 4095

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|5.0.1329|
100101|WEB_THREAT_DETECTION|8|dvc=172.22.9.32
deviceMacAddress=00:50:56:AD:03:BD dvchost=localhost
deviceGUID=E9A3FA433916-4738984C-A4BF-84A0-D603
ptype=IDS rt=Jun 22 2017 10:00:17 GMT+08:00
cs3Label=HostName_Ext
cs3=ca95-1.winshipway.com cs4Label=Deep
Discovery_SrcGroup
cs4=Default cs5Label=Deep Discovery_SrcZone cs5=1
cs10Label=Deep Discovery_DstZone cs10=0 cn2Label=Score
cn2=49 cn4Label=Deep Discovery_ThreatType cn4=5
dmac=00:16:c8:65:98:d5 shost=172.22.9.5 src=172.22.9.5
spt=41757 smac=00:50:56:82:e7:a9 interestedIp=172.22.9.5
cn1Label=CCCA_Detection cn1=1 msg=Ransomware URL
in Web Reputation Services database - HTTP (Request)
request=http://ca95-1.winshipway.com/
requestClientApplication=Wget/1.12(linux-gnu) pComp=TMUFE appGroup=HTTP app=HTTP
vLANId=4095 deviceDirection=1 dhost=150.70.162.115
dst=150.70.162.115 dpt=80 urlCat=Ransomware
peerIp=150.70.162.115
sOSName=Linux cn6Label=CCCA_RiskLevel cn6=3
cs11Label=CCCA_DetectionSource
cs11=RELEVANCE_RULE externalId=17 hostSeverity=8

5-19

Trend Micro Deep Discovery Inspector Syslog Guide

reason=["URL: http://ca95-1.winshipway.com/"]pAttackPhase=Command and Control Communication
devicePayloadId=5:17:P

TMEF system logs
Table 5-4. TMEF System Logs
TMEF Key

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID• 300102• 300999

Header (eventName)

Event Name

• PRODUCT_UPDATE• SYSTEM_EVENT• PRODUCT_UPDATEHeader (severity)

Severity• 2: Informational• 4: Warning• 6: Severe
Example: 2

5-20

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

duser

Action by

Example: admin

dvcAppliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhostSyslog content mapping - TMEF

TMEF Key

Description

Value

engTypeEngine nameExample: Advanced Threat Scan
Engine for Deep Discovery (Linux,
64-bit)engVerEngine version

Example: 10.300.1040

msg

Description

Example: The web console timeout
setting has been changed.

outcome

Outcome• Success• Failure
Example: SuccesspatType

Pattern nameExample: Deep Discovery Malware
Pattern

patVerPattern version

Example: 14.271.92

ptype

Application type

IDS

rt

Log generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

src

User IP address

Example: 10.1.1.1

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.85.1156|300999|SYSTEM_EVENT|2|ptype=IDS
dvc=172.22.9.12 deviceMacAddress=00:50:56:
AD:CC:EE dvchost=localhostdeviceGUID=
DBD38FFC70B4-41C792BE-D671-0040-8B1D
rt=Mar 10 2017 17:03:31 GMT+08:00
msg=The threat detection setting
has been changed. duser=admin
outcome=Success src=172.17.0.250

5-21Trend Micro Deep Discovery Inspector Syslog Guide

TMEF correlated incident logs
Table 5-5. Correlation Incident Logs
TMEF Key

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

100127Header (eventName)

Event NameSUSPICIOUS_BEHAVIOUR_DETECTIONHeader (severity)

Severity• 2: Informational• 4: Low• 6: Medium• 8: High

5-22

app

ProtocolExample: HTTP

cs1

Interested group

Example: Default

cs1LabelInterested group

DD_InterestedGroup

cs2

Malware server address

Example: 10.1.144.199

cs2Label

Malware server address

Malware_Server_IP_Address

cs3

Number of downloaded
malware files

Example: 1

cs3LabelNumber of downloaded
malware files

Number_of_Malware_Files_Downlo
aded

cs10

Malware nameExample: HEUR_NAMETRICK.A

cs10Label

Malware name

Malware_NameSyslog content mapping - TMEF

TMEF KeydeviceDirection

Description
Packet direction

Value• 0: Source is external• 1: Source is internal• 2: Unknown

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhostinterestedHost

Interested host

Example: trend.net

interestedIp

Interested IP

Example: 10.1.144.199

interestedMacAddress

Interested MAC

Example: 00:0C:29:6E:CB:F9interestedUser

Interested user 1

Example: user1

interestedUser2

Interested user 2

Example: user2

interestedUser3

Interested user 3

Example: user3

pComp

Detection engine/component

Correlation

peerHost

Peer host

Example: 10.1.144.199

peerIpPeer IP

Example: 10.1.144.199

ptype

Application type

IDS

rt

Log generation time

Example: Mar 09 2015 17:05:21
GMT+08:00

ruleIdRule ID

Example: 52

ruleName

Description

Example: Email message sent
through an unregistered SMTP
server5-23

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

Value

threatName

Threat nameExample: Malware File Downloaded

threatType

Threat type

Example: Malware-related

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|100127|S
USPICIOUS_BEHAVIOUR_DETECTION|2|dvc=10.201.156.143 deviceMac
Address=00:0C:29:A6:53:0C dvchost=ddi38-143 pComp=Correlatio
n ptype=IDS deviceGUID=D2C1D6D20FF8-4FC98F92-25EB-D7DA-AF0E
rt=Mar 11 2015 22:05:50 GMT-04:00 deviceDirection=1 interest
edIp=172.16.0.100 interestedHost=172.16.0.100 interestedMacA
ddress=00:0c:29:70:45:36 ruleId=47 ruleName=This host has responded to DNS queries. threatType=Unregistered Service thre
atName=Unregistered DNS Server app=DNS Response cs1Label=DD_
InterestedGroup cs1=Default peerHost=172.16.1.141 peerIp=172.16.1.141

TMEF virtual analyzer logs: file analysis events
Table 5-6. TMEF File Analysis Events
TMEF Key

5-24

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

200119Header (eventName)

Event Name

FILE_ANALYZEDHeader (severity)

Severity

3 (fixed value)Syslog content mapping - TMEF

TMEF Key
cn1

Description
GRID is known goodValue
• 0: Bad file• -1: Unknown file• 1: Good filecn1Label

GRID is known goodcn2

ROZ rating

GRIDIsKnownGood• 0: No risk
• 1: Low risk
• 2: Medium risk
• 3: High risk

cn2Label

ROZ rating

ROZRatingcn3

PCAP ready0 or 1cn3Label

PCAP ready

PcapReadydeviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

deviseOSName

Sandbox image type

Example: win7

deviceProcessHash

Parent SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

fileHash

File SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

fileType

True file type

Example: 1638400

fnameFile nameExample: excel.rar

fsize

File size

Example: 131372

5-25

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

malNameMalware namepComp

Detection source

Value
Example: SWF_Lfm.926• Sandbox• UDSO (User-Defined Suspicious
Objects)rt

Analysis time

Example: Mar 09 2015 17:05:21
GMT+08:00

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|200119|F
ILE_ANALYZED|3|rt=Mar 11 2015 07:38:04 GMT-04:00 pComp=Sandb
ox dvc=10.201.156.143 dvchost=ddi38-143 deviceMacAddress=00:
0C:29:A6:53:0C deviceGUID=D2C1D6D20FF8-4FC98F92-25EB-D7DA-AF
0E fname=multiple_mask.swf fileHash=643DBF968EF3BECD9A73CF1D
CF44006BC46E15F7 malName=SWF_Lfm.926 fileType=Macromedia Fla
sh fsize=9400 deviceOSName=MAK_win7sp1en_offices_noab_TL cn2
Label=ROZRating cn2=3 cn1Label=GRIDIsKnownGood cn1=-1 cn3Lab
el=PcapReady cn3=1

TMEF virtual analyzer logs: notable characteristics
eventsTable 5-7. TMEF Notable Characteristics Events
TMEF Key

5-26

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

200127

Syslog content mapping - TMEF

TMEF Key

Description

Value

Header (eventName)

Event NameNOTABLE_CHARACTERISTICS

Header (severity)

Severity

6 (fixed value)

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

deviceOSName

Sandbox image type

Example: win7

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

fileHash

File SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

fileType

True file type

Example: 1638400

fnameFile nameExample: excel.rar

fsize

File size

Example: 131372

msg

Details

Example:www.chapisteriadaniel.com

pComp

Detection source

SandboxrtAnalysis time

Example: Mar 09 2015 17:05:21
GMT+08:00

ruleCategory

Violated policy nameExample: Internet Explorer Setting
Modification

ruleName

Analysis violated event

Example: Modified importantregistry items

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|200127|N
OTABLE_CHARACTERISTICS|6|rt=Mar 11 2015 05:00:26 GMT-04:00 p

5-27

Trend Micro Deep Discovery Inspector Syslog Guide

Comp=Sandbox dvc=10.201.156.143 dvchost=ddi38-143 deviceMacA
ddress=00:0C:29:A6:53:0C deviceGUID=D2C1D6D20FF8-4FC98F92-25
EB-D7DA-AF0E fname=DTAS_WIN32_07 fileHash=672B1A8ADB412C272C
CA21A214732C447B650349 fileType=WIN32 EXE fsize=290304 ruleC
ategory=Suspicious network or messaging activity ruleName=Qu
eries DNS server msg=012webpages.com deviceOSName=MAK_win7sp
1en_offices_noab_TL

TMEF virtual analyzer logs: deny list transaction
eventsTable 5-8. TMEF Deny List Transaction Events
TMEF Key

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

200120

Header (eventName)

Event NameDENYLIST_CHANGE

Header (severity)

Severity

3 (fixed value)act

The action in the event

Add or Remove

cs1

Deny List type

• Deny List IP/Port• Deny List URL• Deny List File SHA1
• Deny List Domain

cs1Label

5-28

Deny List type

type

Syslog content mapping - TMEF

TMEF KeydeviceExternalRiskType

Description
Risk level

Value
• Low
• Medium• High• Confirmed malware

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

deviceMacAddress

Appliance MAC address

Example: 00:0C:29:6E:CB:F9

dhost

Destination host nameExample: insta-find.com

dpt

Remote port

Value between 0 and 65535

dst

Remote IP

Example: 10.1.144.199

dvc

Appliance IP address

Example: 10.1.144.199

dvchostAppliance host nameExample: localhost

end

Report end time

Example: Mar 09 2015 17:05:21
GMT+08:00

fileHash

File SHA1

Example:
1EDD5B38DE4729545767088C5CAB
395E4197C8F3

pComp

Detection source

SandboxrequestURL

Example: _http://1.2.3.4/query?
term=value

rtAnalysis time

Example: Mar 09 2015 17:05:21
GMT+08:00

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|200120|DENYLIST_CHANGE|3|rt=Mar 11 2015 07:15:45 GMT-04:00 pComp=San
dbox dvc=10.201.156.143 dvchost=ddi38-143 deviceMacAddress=0
0:0C:29:A6:53:0C deviceGUID=D2C1D6D20FF8-4FC98F92-25EB-D7DA-

5-29

Trend Micro Deep Discovery Inspector Syslog Guide

AF0E cs1Label=type cs1=Deny List URL end=Apr 10 2015 07:15:3
5 GMT-04:00 act=Add request=http://zalepivmordu.ru:80/ devic
eExternalRiskType=Medium

TMEF retro scan report logs
Table 5-9. TMEF Retro Scan Report Logs
TMEF Key

5-30

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

100133Header (eventName)

Event NameRETROSCAN_REPORTHeader (severity)

Severity

8

callback_attempt_num

Number of callback
attempts

Example: 20

cnc_host_num

Number of C&C hosts

Example: 1

compromised_client_num

Number of compromisedclients

Example: 1

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

firstCallbackTime

First callback time

Example: Mar 09 2015 17:05:21
GMT+08:00

lastCallbackTime

Last callback time

Example: Mar 09 2015 17:05:21
GMT+08:00

report_id

Report ID

Example: 74c15fe0-90c9-446babc4-379d6d7213e7

Syslog content mapping - TMEF

TMEF Key

Description

Valuereport_ts

Report time

Example: Mar 09 2015 17:05:21
GMT+08:00

report_url

Report URL

Example: https://
retroscan.trendmicro.com/
retroscan/scanDetails.html?
reportID\=1e84c77b-0452-4f00b5b8-e41c0ea9ef1a&reportType\=standard

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1200|100133|R
ETROSCAN_REPORT|8|guid=906A61690458-4099A441-898C-BDD2-C7C1
report_ts=Mar 29 2015 03:14:27 GMT+02:00 report_id=ffa9474d6d72-44f7-a99c-c0d230fec1f3 report_url=https://retroscan.tre
ndmicro.com/retroscan/scanDetails.html?reportID\=1e84c77b-04
52-4f00-b5b8-e41c0ea9ef1a&reportType\=standard compromised_client_num=1 cnc_host_num=1 callback_attempt_num=20 firstCall
backTime=Mar 29 2015 03:04:27 GMT+02:00 lastCallbackTime=Mar
29 2015 03:09:27 GMT+02:00

TMEF retro scan detection logs
Table 5-10. TMEF Retro Scan Detection Logs
TMEF Key

Description

Value

Header (logVer)

TMEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)Appliance product

Deep Discovery Inspector

Header (pver)

Appliance version

Example: 3.8.1181

Header (eventid)

Signature ID

100134Header (eventName)

Event NameRETROSCAN_DETECTION

5-31

Trend Micro Deep Discovery Inspector Syslog Guide

TMEF Key

Description

Value

Header (severity)

Severity

8

callback_address

Callback address

Example: http://1.2.3.4/

callback_time

Callback time

Example: Mar 09 2015 17:05:21
GMT+08:00

category

Category

Example: Reference

cnc_host

C&C host address

Example: 10.1.144.199

compromised_clientCompromised client
address

Example: 10.1.144.199

deviceGUID

Appliance GUID

Example: 6B593E17AFB7-40FBBB28A4CE-0462-A536

protocolProtocolExample: HTTP

ratingRatingExample: Suspicious

related_attacker_group

Related attacker group

Example: Elise|Taidoor

related_malware

Related malware

Example: fosniw|ge|palevo

report_id

Report ID

Example: 74c15fe0-90c9-446babc4-379d6d7213e7

scan_category

Scan category

Example: C&C Server

scan_rating

Scan rating

Example: Dangerous

scan_ts

Scan time

Example: Mar 09 2015 17:05:21
GMT+08:00

Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1200|100134|R
ETROSCAN_DETECTION|8|guid=906A61690458-4099A441-898C-BDD2-C7
C1 report_id=0938508b-ec47-47a1-80ea-cd8e3b747822 scan_ts=Ma
r 29 2015 03:14:31 GMT+02:00 callback_time=Mar 29 2015 03:04:31 GMT+02:00 callback_address=http://app2.winsoft98.com/app

5-32

Syslog content mapping - TMEF

.asp?prj\=4&pid\=haha1&logdata\=MacTryCnt:0&code\=&ver\=1.0.
0.45&appcheck\=1 compromised_client=59.125.99.235 cnc_host=app2.winsoft98.com protocol=HTTP rating=Suspicious category=Reference scan_rating=Dangerous scan_category=C&C Server r
elated_malware=fosniw|ge|mactrycnt|palevo related_attacker_
group=Elise|Taidoor

5-33

Item Code: APEM69899/240430