Skip to main content
Skip table of contents

Anomali Threatstream CEF Log Messages

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

Anomali Threatstream CEF Log Messages

Base Rule

General Threat Message

Activity

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

N/A

N/A

N/A

Common Event Format identifier:Default or unspecified severity level (can be replaced with specific severity levels such as 1-10).

N/A

<vendorinfo>

Text/String

Vendor or organization name

N/A

N/A

N/A

Product or service name generating the event

N/A

<version>

Text/String

Version number

N/A

<threatname>

Text/String

Specific name or identifier for the event.

N/A

<object>

Text/String

Description

N/A

<severity>

Text/String

Severity level of the event (e.g., low, medium, high).

Extension

N/A

N/A

N/A

cs5Label

N/A

N/A

N/A

customerName

<account>

Text/String

N/A

appType

<objecttype>

Text/String

N/A

dateFirst

N/A

N/A

N/A

modifiedTs

N/A

N/A

N/A

dcid

N/A

N/A

N/A

app

N/A

N/A

N/A

spt

<sport>

Number

N/A

nodeName

<dinterface>

Text/String

N/A

cs2Label

N/A

N/A

N/A

cn3Label

N/A

N/A

N/A

srcip

<sip>

IP Address

N/A

org

N/A

N/A

N/A

totalScore

N/A

N/A

N/A

cimField

N/A

N/A

N/A

sourceFeedId

N/A

N/A

N/A

id

N/A

N/A

N/A

loc

N/A

N/A

N/A

cnt

<quantity>

Number

N/A

end

N/A

N/A

N/A

classification

<reason>

Text/String

N/A

timestamp

N/A

N/A

N/A

dst

<dip>

IP Address

N/A

lon

N/A

N/A

N/A

trustedCircleIds

N/A

N/A

N/A

age

N/A

N/A

N/A

state

<status>

Text/String

N/A

alertTime

N/A

N/A

N/A

numOfSrc

N/A

N/A

N/A

deviceDirection

N/A

N/A

N/A

shost

<sname>

Text/String

N/A

eventDsId

N/A

N/A

N/A

cn1

N/A

N/A

N/A

volume

N/A

N/A

N/A

dpt

<dport>

Number

N/A

updateId

N/A

N/A

N/A

cs6Label

N/A

N/A

N/A

lat

N/A

N/A

N/A

maltype

N/A

N/A

N/A

cs1Label

N/A

N/A

N/A

cs3Label

N/A

N/A

N/A

uuid

<session>

Text/String

N/A

src

<sip>

IP Address

N/A

span

N/A

N/A

N/A

cs6

<url>

Text/String

N/A

dateLast

N/A

N/A

N/A

cn3

N/A

N/A

N/A

iocScore

N/A

N/A

N/A

corrType

N/A

N/A

N/A

srcHost

<sname>

Text/String

N/A

clientId

N/A

N/A

N/A

trustedCircleNames

N/A

N/A

N/A

detail2

N/A

N/A

N/A

cn1Label

N/A

N/A

N/A

act

<action>

Text/String

N/A

cs5

N/A

N/A

N/A

dhost

<dname> or <dnatip>

IP Address/Text/String

N/A

cs1

<policy>

Text/String

N/A

customerId

N/A

N/A

N/A

cs3

<subject>

Text/String

N/A

cs2

N/A

N/A

N/A

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.