CEF
| CEF Key | Description | Value |
|---|---|---|
| Header (logVer) | CEF format version | CEF:0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | Example: SMEX |
| Header (pver) | Appliance version | 14 |
| Header (eventid) | Signature ID | 100101 |
| Header (eventName) | Event name | Virus Detection |
| Header (severity) | Severity | High |
| rt | Scan time | Example: Mar 29 2019 08:01:55 |
| cs2Label | Message found at label | foundAt |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| suser | Message source | Example: sender@win16e16.com |
| duser | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| cs4Label | Message ID label | messageId |
| messageId | Message ID | Example: adfcde36-1411-4a0a-865b-f84f79433987@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| cs1Label | Virus name label | virusName |
| virusName | Virus name | |
| cs6Label | Threat type label | threatType |
| threatType | Threat type | |
| fname | Attachment file name | |
| cs3Label | Risk level label | riskLevel |
| riskLevel | Risk level | |
| cat | Detected rule category | |
| cn1Label | Ransomware label | isRansomware |
| isRansomware | Is ransomware or not | 0 = not ransomware 1 = ransomware |
Log sample:
Mar 29 16:02:39 10.204.128.71 2019-03-29T16:02:38+08:00 Win16E16-SRV SMEX[6480]: CEF:0|Trend Micro|SMEX|14.0|100101|Virus Detection|High|rt=Mar 29 2019 08:01:55 cs2Label=foundAt foundAt=SMTP suser=sender@win16e16.com; duser=reci@win16e16.com; msg=VS Test cs4Label=messageId messageId=adfcde36-1411-4a0a-865b-f84f79433987@Win16E16-SRV.win16e16.com act=Clean fail, quarantine entire message cs1Label=virusName virusName=Eicar_test_file cs6Label=threatType threatType=Viruses fname=eicar.txt cs3Label=riskLevel riskLevel=Suspicious cat= N/A cn1Label=isRansomware isRansomware=0
| CEF Key | Description | Value |
|---|---|---|
| Header (logVer) | CEF format version | CEF:0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | Example: SMEX |
| Header (pver) | Appliance version | 14 |
| Header (eventid) | Signature ID | 100102 |
| Header (eventName) | Event name | Attachment Block |
| Header (severity) | Severity | High |
| rt | Scan time | Example: Mar 29 2019 09:48:46 |
| cs2Label | Message found at label | foundAt |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| suser | Message source | Example: sender@win16e16.com |
| duser | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| cs4Label | Message ID label | messageId |
| messageId | Message ID | Example: 0b6dcb71-b196-4278-ac71-6ccc908096f9@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| cs1Label | Policy name label | policyName |
| policyName | Policy name | |
| fname | Attachment file name |
Log sample:
Mar 29 17:48:57 10.204.128.71 2019-03-29T17:48:56+08:00 Win16E16-SRV SMEX[18476]: CEF:0|Trend Micro|SMEX|14.0|100102|Attachment Block|High|rt=Mar 29 2019 09:48:46 cs2Label=foundAt foundAt=SMTP suser=sender@win16e16.com; duser=reci@win16e16.com; msg=AB Test cs4Label=messageId messageId=0b6dcb71-b196-4278-ac71-6ccc908096f9@Win16E16-SRV.win16e16.com act=Replace with text/file cs1Label=policyName policyName=Password-Protected/Block password protected file fname=AB.zip
| CEF Key | Description | Value |
|---|---|---|
| Header (logVer) | CEF format version | CEF:0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | Example: SMEX |
| Header (pver) | Appliance version | 14 |
| Header (eventid) | Signature ID | 100107 |
| Header (eventName) | Event name | Content Violation |
| Header (severity) | Severity | High |
| rt | Scan time | Example: Apr 01 2019 02:46:53 |
| cs2Label | Message found at label | foundAt |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| suser | Message source | Example: sender@win16e16.com |
| duser | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| cs4Label | Message ID label | messageId |
| messageId | Message ID | Example: d3c28383-0591-44dd-9649-b0d07e61cf43@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| cs1Label | Policy name label | policyName |
| policyName | Policy name | |
| fname | Attachment file name | |
| cs6Label | Policy reason label | policyReason |
| policyReason | Policy reason |
Log sample:
Apr 1 10:48:09 10.204.128.71 2019-04-01T10:48:06+08:00 Win16E16-SRV SMEX[23244]: CEF:0|Trend Micro|SMEX|14.0|100107|Content Violation|High|rt=Apr 01 2019 02:46:53 cs2Label=foundAt foundAt=SMTP suser=sender@win16e16.com; duser=reci@win16e16.com; msg=CF Test cs4Label=messageId messageId=d3c28383-0591-44dd-9649-b0d07e61cf43@Win16E16-SRV.win16e16.com act=Quarantine entire message cs1Label=policyName policyName=PROFANITY fname=cf41.txt cs6Label=policyReason policyReason=ana1;
| CEF Key | Description | Value |
|---|---|---|
| Header (logVer) | CEF format version | CEF:0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | Example: SMEX |
| Header (pver) | Appliance version | 14 |
| Header (eventid) | Signature ID | 100105 |
| Header (eventName) | Event name | DLP Detection |
| Header (severity) | Severity | High |
| rt | Scan time | Example: Apr 01 2019 03:23:13 |
| cs2Label | Message found at label | foundAt |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| suser | Message source | Example: sender@win16e16.com |
| duser | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| cs4Label | Message ID label | messageId |
| messageId | Message ID | Example: c1b48c9c-9e56-4c14-a394-9b729e8ad6d1@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| cs1Label | Policy name label | policyName |
| policyName | Policy name | |
| fname | Attachment file name | |
| cs6Label | Policy reason label | policyReason |
| policyReason | Policy reason |
Log sample:
Apr 1 11:23:36 10.204.128.71 2019-04-01T11:23:34+08:00 Win16E16-SRV SMEX[6132]: CEF:0|Trend Micro|SMEX|14.0|100105|DLP Detection|High|rt=Apr 01 2019 03:23:13 cs2Label=foundAt foundAt=SMTP suser=sender@win16e16.com; duser=reci@win16e16.com; msg=DLP Test cs4Label=messageId messageId=c1b48c9c-9e56-4c14-a394-9b729e8ad6d1@Win16E16-SRV.win16e16.com act=Pass cs1Label=policyName policyName=Data Loss Prevention (GLBA) fname=dlp22.txt cs6Label=policyReason policyReason=US: GLBA
| CEF Key | Description | Value |
|---|---|---|
| Header (logVer) | CEF format version | CEF:0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | Example: SMEX |
| Header (pver) | Appliance version | 14 |
| Header (eventid) | Signature ID | 100103 |
| Header (eventName) | Event name | Spam Detection |
| Header (severity) | Severity | High |
| rt | Scan time | Example: Apr 01 2019 06:16:09 |
| cs2Label | Message found at label | foundAt |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| suser | Message source | Example: sender@win16e16.com |
| duser | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| act | Filter action | |
| cs1Label | Policy name label | policyName |
| policyName | Policy name |
Log sample:
Apr 1 14:16:35 10.204.128.71 2019-04-01T14:16:33+08:00 Win16E16-SRV SMEX[15624]: CEF:0|Trend Micro|SMEX|14.0|100103|Spam Detection|High|rt=Apr 01 2019 06:16:09 cs2Label=foundAt foundAt=SMTP suser=sender@win16e16.com; duser=reci@win16e16.com; msg=High spam act=Quarantine message to user's spam folder cs1Label=policyName policyName=Spam Mail
| CEF Key | Description | Value |
|---|---|---|
| Header (logVer) | CEF format version | CEF:0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | Example: SMEX |
| Header (pver) | Appliance version | 14 |
| Header (eventid) | Signature ID | 100106 |
| Header (eventName) | Event name | Advance Spam Detection |
| Header (severity) | Severity | High |
| rt | Scan time | Example: Apr 01 2019 06:35:14 |
| cs2Label | Message found at label | foundAt |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| suser | Message source | Example: sender@win16e16.com |
| duser | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| cs4Label | Message ID label | messageId |
| messageId | Message ID | Example: 59927c70-4c31-4742-be58-9973c4d5d10d@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| cs1Label | Threat name label | threatName |
| threatName | Threat name | |
| cs3Label | Risk level label | riskLevel |
| riskLevel | Risk level | |
| cn1Label | Is ransomware or not label | isRansomware |
| isRansomware | Is ransomware or not | 0 = not ransomware 1 = ransomware |
| cat | Sub type |
Log sample:
Apr 1 14:36:03 10.204.128.71 2019-04-01T14:36:01+08:00 Win16E16-SRV SMEX[6696]: CEF:0|Trend Micro|SMEX|14.0|100106|Advance Spam Detection|High|rt=Apr 01 2019 06:35:14 cs2Label=foundAt foundAt=SMTP suser=sender@win16e16.com; duser=reci@win16e16.com; msg=SNAPBECTesting cs4Label=messageId messageId=59927c70-4c31-4742-be58-9973c4d5d10d@Win16E16-SRV.win16e16.com act=Quarantine entire message cs1Label=threatName threatName=BEC_CEO-FRAUD.ERS cs3Label=riskLevel riskLevel=No Risk cn1Label=isRansomware isRansomware=0 cat=BEC
| CEF Key | Description | Value |
|---|---|---|
| Header (logVer) | CEF format version | CEF:0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | Example: SMEX |
| Header (pver) | Appliance version | 14 |
| Header (eventid) | Signature ID | 100104 |
| Header (eventName) | Event name | Web Threat Detection |
| Header (severity) | Severity | High |
| rt | Scan time | Example: Apr 01 2019 07:10:17 |
| cs2Label | Message found at label | foundAt |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| suser | Message source | Example: sender@win16e16.com |
| duser | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| cs4Label | Message ID label | messageId |
| messageId | Message ID | Example: 476ed59d-46ec-48c3-9561-fb44d02c2c09@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| cs3Label | Risk level label | riskLevel |
| riskLevel | Risk level | |
| cat | URL category | |
| cn1Label | Is ransomware or not label | isRansomware |
| isRansomware | Is ransomware or not | 0 = not ransomware 1 = ransomware |
| cs6Label | Policy reason label | policyReason |
| policyReason | Policy reason |
Log sample:
Apr 1 15:10:36 10.204.128.71 2019-04-01T15:10:34+08:00 Win16E16-SRV SMEX[16780]: CEF:0|Trend Micro|SMEX|14.0|100104|Web Threat Detection|High|rt=Apr 01 2019 07:10:17 cs2Label=foundAt foundAt=SMTP suser=sender@win16e16.com; duser=reci@win16e16.com; msg=Suspicious URL:WTP Test cs4Label=messageId messageId=476ed59d-46ec-48c3-9561-fb44d02c2c09@Win16E16-SRV.win16e16.com act=Quarantine message to user's spam folder cs3Label=riskLevel riskLevel=High cat=Spyware cn1Label=isRansomware isRansomware=0 cs6Label=policyReason policyReason=https://wrs21.winshipway.com:443
| CEF Key | Description | Value |
|---|---|---|
| Header (logVer) | CEF format version | CEF:0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | Example: SMEX |
| Header (pver) | Appliance version | 14 |
| Header (eventid) | Signature ID | 300101 |
| Header (eventName) | Event name | Event Tracking |
| Header (severity) | Severity | Low |
| shost | Server name | |
| suser | User name | |
| rt | Event time | Example: Apr 01 2019 07:10:17 |
| src/ c6a1 | IPv4/IPv6 address | |
| cs1Label | Event type label | eventType |
| eventType | Event type | |
| msg | Log description |
Log sample:
Apr 1 15:32:12 10.204.128.71 2019-04-01T15:32:10+08:00 Win16E16-SRV SMEX[23028]: CEF:0|Trend Micro|SMEX|14.0|300101|Event Tracking|Low|shost=WIN16E16-SRV suser=WIN16E16\\admin rt=Apr 01 2019 07:32:07 src=10.204.128.71 cs1Label=eventType eventType=Configuration change msg=Log Forwarding settings have been changed.
LEEF
| LEEF Key | Description | Value |
|---|---|---|
| Header (logVer) | LEEF format version | LEEF:1.0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | SMEX |
| Header (pver) | Appliance version | Example: 14.0 |
| Header (eventName) | Event name | Virus Detection |
| devTime | Scan time | Example: Mar 29 2019 08:01:55 |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| usrName | Message source | Example: sender@win16e16.com |
| recipient | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| messageId | Message ID | Example: adfcde36-1411-4a0a-865b-f84f79433987@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| virusName | Virus name | |
| threatType | Threat type | |
| filename | Attachment file name | |
| riskLevel | Risk level | |
| cat | Detected rule category | |
| isRansomware | Is ransomware or not | 0 = not ransomware 1 = ransomware |
Log sample:
Mar 29 16:03:18 10.204.128.71 2019-03-29T16:03:17+08:00 Win16E16-SRV SMEX[21464]: LEEF:1.0|Trend Micro|SMEX|14.0|Virus Detection|^|devTime=Mar 29 2019 08:01:55 foundAt=SMTP usrName=sender@win16e16.com; recipient=reci@win16e16.com; msg=VS Test messageId=adfcde36-1411-4a0a-865b-f84f79433987@Win16E16-SRV.win16e16.com act=Clean fail, quarantine entire message virusName=Eicar_test_file threatType=Viruses filename=eicar.txt riskLevel=Suspicious cat= N/A isRansomware=0
| LEEF Key | Description | Value |
|---|---|---|
| Header (logVer) | LEEF format version | LEEF:1.0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | SMEX |
| Header (pver) | Appliance version | Example: 14.0 |
| Header (eventName) | Event name | Attachment Block |
| devTime | Scan time | Example: Mar 29 2019 09:48:46 |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| usrName | Message source | Example: sender@win16e16.com |
| recipient | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| messageId | Message ID | Example: 0b6dcb71-b196-4278-ac71-6ccc908096f9@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| policyName | Policy name | |
| filename | Attachment file name |
Log sample:
Mar 29 17:51:09 10.204.128.71 2019-03-29T17:51:08+08:00 Win16E16-SRV SMEX[19132]: LEEF:1.0|Trend Micro|SMEX|14.0|Attachment Block|^|devTime=Mar 29 2019 09:48:46 foundAt=SMTP usrName=sender@win16e16.com; recipient=reci@win16e16.com; msg=AB Test messageId=0b6dcb71-b196-4278-ac71-6ccc908096f9@Win16E16-SRV.win16e16.com act=Replace with text/file policyName=Password-Protected/Block password protected file filename=AB.zip
| LEEF Key | Description | Value |
|---|---|---|
| Header (logVer) | LEEF format version | LEEF:1.0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | SMEX |
| Header (pver) | Appliance version | Example: 14.0 |
| Header (eventName) | Event name | Content Violation |
| devTime | Scan time | Example: Apr 01 2019 02:58:24 |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| usrName | Message source | Example: sender@win16e16.com |
| recipient | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| messageId | Message ID | Example: 7d06b7a1-1303-41db-b9be-c2e24de2a32b@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| policyName | Policy name | |
| filename | Attachment file name | |
| policyReason | Policy reason |
Log sample:
Apr 1 11:09:31 10.204.128.71 2019-04-01T11:09:29+08:00 Win16E16-SRV SMEX[22148]: LEEF:1.0|Trend Micro|SMEX|14.0|Content Violation|^|devTime=Apr 01 2019 02:58:24 foundAt=SMTP usrName=sender@win16e16.com; recipient=reci@win16e16.com; msg=CF Test messageId=7d06b7a1-1303-41db-b9be-c2e24de2a32b@Win16E16-SRV.win16e16.com act=Quarantine entire message policyName=PROFANITY filename=cf41.txt policyReason=ana1;
| LEEF Key | Description | Value |
|---|---|---|
| Header (logVer) | LEEF format version | LEEF:1.0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | SMEX |
| Header (pver) | Appliance version | Example: 14.0 |
| Header (eventName) | Event name | DLP Detection |
| devTime | Scan time | Example: Apr 01 2019 03:23:13 |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| usrName | Message source | Example: sender@win16e16.com |
| recipient | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| messageId | Message ID | Example: c1b48c9c-9e56-4c14-a394-9b729e8ad6d1@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| policyName | Policy name | |
| filename | Attachment file name | |
| policyReason | Policy reason |
Log sample:
Apr 1 11:23:57 10.204.128.71 2019-04-01T11:23:55+08:00 Win16E16-SRV SMEX[12136]: LEEF:1.0|Trend Micro|SMEX|14.0|DLP Detection|^|devTime=Apr 01 2019 03:23:13 foundAt=SMTP usrName=sender@win16e16.com; recipient=reci@win16e16.com; msg=DLP Test messageId=c1b48c9c-9e56-4c14-a394-9b729e8ad6d1@Win16E16-SRV.win16e16.com act=Pass policyName=Data Loss Prevention (GLBA) filename=dlp22.txt policyReason=US: GLBA
| LEEF Key | Description | Value |
|---|---|---|
| Header (logVer) | LEEF format version | LEEF:1.0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | SMEX |
| Header (pver) | Appliance version | Example: 14.0 |
| Header (eventName) | Event name | Spam Detection |
| devTime | Scan time | Example: Apr 01 2019 06:16:09 |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| usrName | Message source | Example: sender@win16e16.com |
| recipient | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| act | Filter action | |
| policyName | Policy name |
Log sample:
Apr 1 14:18:13 10.204.128.71 2019-04-01T14:18:11+08:00 Win16E16-SRV SMEX[12552]: LEEF:1.0|Trend Micro|SMEX|14.0|Spam Detection|^|devTime=Apr 01 2019 06:16:09 foundAt=SMTP usrName=sender@win16e16.com; recipient=reci@win16e16.com; msg=High spam act=Quarantine message to user's spam folder policyName=Spam Mail
| LEEF Key | Description | Value |
|---|---|---|
| Header (logVer) | LEEF format version | LEEF:1.0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | SMEX |
| Header (pver) | Appliance version | Example: 14.0 |
| Header (eventName) | Event name | Advanced Spam Detection |
| devTime | Scan time | Example: Apr 01 2019 06:35:14 |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| usrName | Message source | Example: sender@win16e16.com |
| recipient | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| messageId | Message ID | Example: 59927c70-4c31-4742-be58-9973c4d5d10d@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| threatName | Threat name | |
| riskLevel | Risk level | |
| isRansomware | Is ransomware or not | 0 = not ransomware 1 = ransomware |
| cat | Sub type |
Log sample:
Apr 1 14:36:26 10.204.128.71 2019-04-01T14:36:24+08:00 Win16E16-SRV SMEX[10632]: LEEF:1.0|Trend Micro|SMEX|14.0|Advance Spam Detection|^|devTime=Apr 01 2019 06:35:14 foundAt=SMTP usrName=sender@win16e16.com; recipient=reci@win16e16.com; msg=SNAPBECTesting messageId=59927c70-4c31-4742-be58-9973c4d5d10d@Win16E16-SRV.win16e16.com act=Quarantine entire message threatName=BEC_CEO-FRAUD.ERS riskLevel=No Risk isRansomware=0 cat=BEC
| LEEF Key | Description | Value |
|---|---|---|
| Header (logVer) | LEEF format version | LEEF:1.0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | SMEX |
| Header (pver) | Appliance version | Example: 14.0 |
| Header (eventName) | Event name | Web Threat Detection |
| devTime | Scan time | Example: Apr 01 2019 07:10:17 |
| foundAt | Message found at | SMTP |
| Mailbox | ||
| usrName | Message source | Example: sender@win16e16.com |
| recipient | Message destination | Example: reci@win16e16.com |
| msg | Message subject | |
| messageId | Message ID | Example: 476ed59d-46ec-48c3-9561-fb44d02c2c09@Win16E16-SRV.win16e16.com |
| act | Filter action | |
| riskLevel | Risk level | |
| cat | URL category | |
| isRansomware | Is ransomware or not | 0 = not ransomware 1 = ransomware |
| policyReason | Policy reason |
Log sample:
Apr 1 15:11:13 10.204.128.71 2019-04-01T15:11:10+08:00 Win16E16-SRV SMEX[10656]: LEEF:1.0|Trend Micro|SMEX|14.0|Web Threat Detection|^|devTime=Apr 01 2019 07:10:17 foundAt=SMTP usrName=sender@win16e16.com; recipient=reci@win16e16.com; msg=Suspicious URL:WTP Test messageId=476ed59d-46ec-48c3-9561-fb44d02c2c09@Win16E16-SRV.win16e16.com act=Quarantine message to user's spam folder riskLevel=High cat=Spyware isRansomware=0 policyReason=https://wrs21.winshipway.com:443
| LEEF Key | Description | Value |
|---|---|---|
| Header (logVer) | LEEF format version | LEEF:1.0 |
| Header (vendor) | Appliance vendor | Trend Micro |
| Header (pname) | Appliance product | SMEX |
| Header (pver) | Appliance version | Example: 14.0 |
| Header (eventName) | Event name | Event Tracking |
| shost | Server name | |
| usrName | User name | |
| devTime | Event time | Example: Apr 01 2019 07:10:17 |
| src | IP address | |
| eventType | Event type | |
| msg | Log description |
Log sample:
Apr 1 15:33:19 10.204.128.71 2019-04-01T15:33:17+08:00 Win16E16-SRV SMEX[22144]: LEEF:1.0|Trend Micro|SMEX|14.0|Event Tracking|^|shost=WIN16E16-SRV usrName=WIN16E16\\chris devTime=Apr 01 2019 07:33:04 src=10.204.128.71 eventType=Configuration change msg=Log Forwarding settings have been changed.