domain-match (Network Security)
- Published on Aug 25, 2026
CEF:0|Trellix|MPS|9.0.2.924861|DM|domain-match|1|rt=Oct 16 2020 14:36:16 UTC src=xxx.xxx.xxx.xxx
cn3Label=cncPort cn3=53 cn2Label=sid cn2=80461038 proto=udp spt=1070 cs5Label=cncHost cs5=fget-career.com
dvchost=abc.mrl.trellix.com dvc=xx.x.x.xxx smac=6a:c0:02:9a:9b:7d cn1Label=vlan cn1=0 externalId=85
cs4Label=link cs4=https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id\=85 act=notified
dmac=00:50:56:e5:3f:c5 cs1Label=sname cs1=Trojan.Ramnit.SNK.DNS devicePayloadId=95846ab0-a464-43e1-
a89f-9a0e51f3a4b1 start=Oct 16 2020 14:36:16 UTC .
Was this article helpful?
Related articles
Network Security (NX) > Common Security Platform Product Docs > Trellix Alert Notifications ( CEF | LEEF | CSV | XML | JSON ) > CEF notifications > Sample CEF notifications per event type
Network Security (NX) > Common Security Platform Product Docs > Trellix Alert Notifications ( CEF | LEEF | CSV | XML | JSON ) > Overview > Alerts
Helix > Trellix Helix TQL Reference Guide > TQL cheatsheet and use cases
Network Security (NX) > Common Security Platform Product Docs > Trellix Alert Notifications ( CEF | LEEF | CSV | XML | JSON ) > CEF notifications > Sample CEF notifications per event type