Syslog Content Mapping Type 2

Header (logVer)

CEF format version

CEF: 0

Header (vendor)

Appliance vendor

Trend Micro

Header (pname)

Appliance product name

Trend Micro Web Security

Header (pver)

Appliance version

Example: 3.0.0.2042

Header (eventid)

Signature ID

Example: 100000

Header (eventName)

Description

Access Log

Header (severity)

Risk level

• 0: act=allow/analyze

• 1: act=monitor/warn/override

• 2: act=block

rt

UTC timestamp

Example: Jul 05 2018 07:54:15 +0000

logType

Log type

companyID

Company ID

Example: 7800fcab-7611-416c-9ab4-721b7bd6b076

adDomain

AD domain

Example: trendmicro.com.cn

userName

User name or client IP

Example: 10.204.214.188

groupName

Group name

Example: testgroup1

userDepartment

User department

Example: finance department

gatewayName

Gateway name

Example: on-premise-2051

app

Protocol used

• 1: HTTP

• 2: HTTPS

• 3: HTTP/2

transportBytes

Body size of a request or response

Example: 221030

dst

Destination IP address of a request

Example: 54.231.184.240

src

Source IP address of a request

Example: 10.204.214.188

upStreamSize

Upstream payload from Trend Micro Web Security to server, unit bytes

Example: 501

downStreamSize

Downstream payload from server to Trend Micro Web Security, unit bytes

Example: 220529

domainName

URL domain

Example: clients4.google.com

scanType

Scan type

• 0: Not match any rule

• 1: Client certificate is required

• 2: Untrusted server certificate

• 10: Approved URLs/Blocked URLs

• 13: Client not allowed

• 14: Destination port not allowed

• 15: Access to private address

• 20: Web Reputation service

• 21: URL filtering

• 30: True file type

• 33: MIME type

• 34: File extension name

• 40: Anti-malware

• 41: Unscannable files

• 45: Predictive machine learning

• 50: Anti-botnet

• 60: Application control

• 70: Suspicious Object Analysis (Virtual Analyzer)

• 90: Suspicious Object Filtering (Virtual Analyzer)

• 100: Data loss prevention

• 110: Ransomware

policyName

Policy name

Example: default

profileName

Profile name

Example: default

severity

WRS score threshold

• 0: WRS is disabled

• 50: WRS security level=Low

• 65: WRS security level=Medium

• 80: WRS security level=high

principalName

Principal name

Example: testuser@trendmicro.com.cn

cat

URL category

Example: Search Engines/Portals

appName

Application name

Example: Google

wrsScore

WRS score

Example: 81

malwareType

Malware type

• 1: Virus

• 2: Spyware

• 3: Joke

• 4: Trojan

• 5: Test_Virus

• 6: Packer

• 7: Generic

• 8: Other

• 9: Botnet

malwareName

Malware name

Example: HEUR_OLEXP.B

fname

File name

Example: sample_nice_dda_heurb_1177077.ppt-1

filehash

SHA-1

Example: 3f21be4521b5278fb14b8f47afcabe08a17dc504

act

Action

• allow

• monitor

• block

• warn

• override

• analyze

httpTrans

HTTP transaction

JSON format. Example:{"http_req":{ "method":"GET","scheme":"http","path":"index.html","host":www.sina.com.cn,"headers":{"header_1":"value_1", ...}},"http_response":{"status_code":"200","headers":{...}}}

method

HTTP method

Example: GET, PUT, POST

version

HTTP version

Example: 1.1

path

HTTP request path

Example: example.html

host

HTTP request host

Example: client2.example.com

status_code

HTTP response status code

Example: 200, 404, 503

scheme

HTTP or HTTPS protocol

Example: HTTP, HTTPS

url

Combination of scheme, host, and path

Example: https://client2.example.com/example.html

<http-request-header-name>_q

HTTP request header field

Example: User-Agent: Mozilla/5.0

<http-response-header-name>_s

HTTP response header field

Example: Content-Length: 348