This section covers the following topics:
Common Event Format (CEF) [2] is an ArcSight [1] supported format for rsyslog [3]. ArcSight provides an open standard for log management and interoperability of security related information from different devices, network appliances and applications. The open log format (that is, CEF) is adopted by Trellix for sending Trellix malware event notifications to an ArcSight channel. This format contains the most relevant event information, making it available for event consumers to parse and use the data interoperably. To integrate the events, the syslog message format is used as a transport mechanism. This mechanism is structured to include a common prefix applied to each message, and contains the date and hostname as shown:
Jan 18 11:07:53 host <message>
where message=<header>|<extension>
The message in CEF format includes a header and an extension as a set of key=value pairs. For additional information, refer to the ArcSight Common Event Format white paper [2] for a detailed description of the ArcSight CEF format.
The Trellix CEF message header is defined as follows:
CEF:0|<vendor>|<product name>|<version>|<cef event type>|<event-name>|<severity>|<extension>
where
CEF Field | Description |
|---|---|
| The CEF header consists of a set of appliance attributes delimited by pipes ( | ) which starts with CEF:<VERSION>, where the current CEF version is always 0. |
| Trellix is the appliance vendor. |
| Product name must represent a valid Trellix product name. For example, valid product names are ‘MPS’ (for Network Security), ‘eMPS’ (for Email Security — Server Edition), ‘fMPS’ (for File Protect), ‘MAS’ (for Malware Analysis), and ‘CMS’ (for Central Management). |
| Version represents the Trellix software release on the appliance used to detect the malware and send the alert notification. |
| cef event type is an abbreviated, short form of the event name, which corresponds to the output in the next field <event-name>. CEF event types for which there is no signature (rare) are designated as MC (malware-callback), WI (web-infection), BA (binary-analysis), IM (infection-match), MW (mw-analysis-done), DM (domain-match), MO (malware-object), IE (ips-event), riskware-callback (RC), or riskware-object (RO). |
| For event name, Trellix uses the signature name as the event name in CEF message headers; if there are multiple signature names in a single detected malicious event, then the first match is used in this field. If there is no signature name (a very rare case), then the following event types may be used as the event name:
|
| The possible severity of an event ranges between 0 - 10, where 10 is the highest malware severity. |
| Extensions include all the alert detection details, labeled in categories; for example: rt= , fileHash=, src=, cn1=, cn2=, cn3=, cn1Label=, cn2Label=, cn3Label=, cs1=, cs2=, cs3=, cs4=, cs5=, cs6=, cs1Label=, cs2Label=, cs3Label=, cs4Label=, cs5Label=, cs6Label=, request=, shost=, proto=, smac=, externalID=, dvchost=, spt=, dpt=, dst=, dvc=, dmac=, suser=, msg=, filePath=, duser=, dproc=, eventURL=, sID=, sName=, sType= NoteThe definitions for these extension field labels are provided in CEF Extension Field Key=Value Pair Definitions. Not all products reference the same CEF field labels in their alert notifications. |