Antivirus Log Messages

Vendor Documentation

https://docs.trendmicro.com/en-us/enterprise/apex-central-online-help/appendices/syslog-mapping-cef.aspx

https://docs.trendmicro.com/en-us/enterprise/apex-central-online-help/appendices/syslog-mapping-cef/cef-virusmalware-log.aspx

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
N/A	<severity>	N/A
Header (logVer)	N/A	N/A
Header (vendor)	N/A	N/A
Header (pname)	N/A	N/A
Header (pver)	<version>	N/A
Header (eventid)	<action> <tag1>	<vmid>
Header (eventName)	<threatname>	<threatname>
Header (severity)	N/A	<severity>
deviceExternalId	N/A	N/A
rt	N/A	N/A
cnt	N/A	<quantity>
dhost	<dname>	<dname>
duser	<account>	<account>
act	N/A	<action> <tag1>
cn1Label	N/A	N/A
cn1	N/A	N/A
cn2Label	N/A	N/A
cn2	N/A	N/A
cs1Label	N/A	N/A
cs1	N/A	N/A
cs2Label	N/A	N/A
cs2	N/A	N/A
cs3Label	N/A	N/A
cs3	N/A	<version>
cs4Label	N/A	N/A
cs4	N/A	N/A
cs5Label	N/A	N/A
cs5	N/A	<result>
cs6Label	N/A	N/A
cs6	N/A	N/A
cat	N/A	N/A
dvchost	N/A	N/A
cn3Label	N/A	N/A
cn3	N/A	N/A
fname	<objectname>	<object>
filePath	<parentprocesspath>	N/A
msg	N/A	<subject>
shost	N/A	<sname>
suser	N/A	<login>
dst	<dip>	<dip>
c6a3Label	N/A	N/A
c6a3	N/A	N/A
fileHash	<hash>	<hash>
deviceFacility	N/A	N/A
reason	N/A	<reason>
deviceNtDomain	N/A	N/A
dntdom	N/A	N/A
ApexCentralHost	N/A	N/A
devicePayloadId	N/A	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Classification	Common Event
1011378	Antivirus Log Messages	Base Rule	Information	General Antivirus Information
	File Cleaned	Sub Rule	Failed Activity	Threat Blocked
	File Quarantined	Sub Rule	Information	Primary Action - Quarantine File
	Unable To Quarantine File	Sub Rule	Error	Quarantine Error

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Classification	Common Event
1012156	V 2.0 : Virus/Malware Logs	Base Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/Malware : Unknown	Sub Rule	Other Security	General Security
	V 2.0 : Virus/Malware : Not Applicable	Sub Rule	Other Security	General Security
	V 2.0 : Virus/Malware : File Cleaned	Sub Rule	Failed Malware	Failed Malware Activity
	V 2.0 : Virus/Malware : File Deleted	Sub Rule	Failed Malware	Failed Malware Activity
	V 2.0 : Virus/Malware : File Quarantined	Sub Rule	Activity	Quarantine
	V 2.0 : Virus/Malware : File Renamed	Sub Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/Malware : File Passed	Sub Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/Malware:Unable To Clean File, Passed	Sub Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/Malware:Unable To Clean File,Deleted	Sub Rule	Failed Malware	Failed Malware Activity
	V 2.0 : Virus/Malware:Unable To Clean File,Renamed	Sub Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/MW:Unable To Clean File, Quarantined	Sub Rule	Activity	Quarantine
	V 2.0 :Virus/Malware:Unable To Clean File,Stripped	Sub Rule	Failed Malware	Failed Malware Activity
	V 2.0 : Virus/Malware : File Replaced	Sub Rule	Failed Malware	Failed Malware Activity
	V 2.0 : Virus/Malware : File Dropped	Sub Rule	Failed Malware	Failed Malware Activity
	V 2.0 : Virus/Malware : File Archived	Sub Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/Malware : Blocked Successfully	Sub Rule	Failed Malware	Failed Malware Activity
	V 2.0 : Virus/Malware : Quarantined Successfully	Sub Rule	Activity	Quarantine
	V 2.0 : Virus/Malware : Stamped Successfully	Sub Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/Malware : File Uploaded	Sub Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/Malware : Access Denied	Sub Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/Malware : No Action	Sub Rule	Malware	Detected Malware Activity
	V 2.0 : Virus/Malware : Scan Stopped	Sub Rule	Information	Scan Stopped
	V 2.0 : Virus/Malware : Encrypted	Sub Rule	Activity	Encrypted Files Detected
	V 2.0 : Virus/Malware : Undefined	Sub Rule	Activity	General Activity
	V 2.0 : Virus/Malware : System Rebooted	Sub Rule	Startup and Shutdown	System Restarted
	V 2.0 : Virus/Malware : Action Failed	Sub Rule	Activity	General Activity
	V 2.0 : Virus/Malware : Action Required	Sub Rule	Activity	General Activity