web-infection (Network Security)
- Published on Aug 25, 2026
CEF:0|Trellix|MPS|9.0.2.924861|WI|web-infection|4|cn2Label=sid cn2=86115851 cs5Label=cncHost cs5=fget-career.com
cs2Label=anomaly cs2=98305 spt=1058 smac=6a:c0:02:9a:9b:7d cn1Label=vlan cn1=0 cs4Label=link cs4=https://
abc.mrl.trellix.com/event_stream/events_for_bot?inc_id\=4079 rt=Oct 16 2020 14:41:43 UTC proto=tcp
dst=xxx.xxx.xxx.xxx dproc=InternetExplorer 8.0 externalId=4079 filePath=yy8311.com/?/goods_list/14_25_0
cs3Label=osinfo cs3=Microsoft WindowsXP 32-bit 5.1 sp3 17.0114 dvchost=abc.mrl.trellix.com cs6Label=channel cs6=
\\000\\377\\001\\000\\000\\000 src=xxx.xxx.xxx.xxx cn3Label=cncPort cn3=443 dpt=80 dvc=xx.x.x.xxx act=notified
cs1Label=sname cs1=HTML.Infector.Ramnit devicePayloadId=bb17f03e-649d-451f-a43c-519e6301fbbb start=Oct 16 2020
14:36:12 UTC .
Was this article helpful?
Related articles
Network Security (NX) > Common Security Platform Product Docs > Trellix Alert Notifications ( CEF | LEEF | CSV | XML | JSON ) > CEF notifications > Sample CEF notifications per event type
Network Security (NX) > Common Security Platform Product Docs > Trellix Alert Notifications ( CEF | LEEF | CSV | XML | JSON ) > CEF notifications > Sample CEF notifications per event type
Network Security (NX) > Common Security Platform Product Docs > Trellix Alert Notifications ( CEF | LEEF | CSV | XML | JSON ) > CEF notifications > Sample CEF notifications per event type
Network Security (NX) > Common Security Platform Product Docs > Trellix Alert Notifications ( CEF | LEEF | CSV | XML | JSON ) > CEF notifications > Sample CEF notifications per event type