Press CTRL+K to open search

XML notifications schema

  • Published on Aug 25, 2026
  • 11 minute(s) read
Prev Next

Trellix XML notifications

The structure and content of Trellix XML notifications are based on the following XSD schema:

On any appliance: /opt/trellix/etc/TrellixAlert.xsd

<?xml version="1.0" encoding="UTF-8"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
  elementFormDefault="qualified" targetNamespace="http://www.trellix.com/alert/2014/AlertSchema"
  xmlns="http://www.trellix.com/alert/2014/AlertSchema">
  <xs:include schemaLocation="TrellixOSCDataSet.xsd" />
  <xs:element name="alerts">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="alert" minOccurs="0" maxOccurs="unbounded" />
      </xs:sequence>
      <xs:attribute name="appliance" use="required" type="xs:string" />
      <!--
      Appliance ID, which is the MAC addr
      -->
      <xs:attribute name="appliance-id" use="optional" type="xs:string" />
      <xs:attribute name="product" use="optional" type="ProductType" />
      <xs:attribute name="version" use="optional" type="xs:string" />
      <xs:attribute name="msg" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="alert">
    <xs:complexType>
      <xs:all>
        <xs:element ref="explanation" minOccurs="0" />
        <xs:element ref="src" minOccurs="0" />
        <xs:element ref="alert-url" minOccurs="0" />
        <xs:element ref="action" minOccurs="0" />
        <xs:element ref="locations" minOccurs="0" />
        <xs:element name="description"   type="xs:string" minOccurs="0" />
        <xs:element name="occurred" type="feDateTime" minOccurs="0" />
        <xs:element minOccurs="0" name="dst">
          <xs:complexType>
            <xs:all>
              <xs:element ref="mac" minOccurs="0" />
              <xs:element name="port" type="xs:integer" minOccurs="0" />
              <xs:element ref="ip" minOccurs="0" />
              <xs:element name="smtp-to" type="xs:string" minOccurs="0" />
              <xs:element name="smtp-cc" type="xs:string" minOccurs="0" />
            </xs:all>
          </xs:complexType>
        </xs:element>
        <xs:element maxOccurs="1" minOccurs="0" name="smtp-message">
          <xs:complexType>
            <xs:all>
              <xs:element name="subject" type="xs:string" minOccurs="0" />
              <xs:element minOccurs="0" name="smtp-header" type="xs:string" />
              <xs:element minOccurs="0" name="last-malware" type="xs:string" />
              <xs:element minOccurs="0" name="protocol" type="xs:string" />
              <xs:element name="date" type="xs:string" />
            </xs:all>
            <xs:attribute name="id" type="xs:string" use="required" />
            <xs:attribute name="queue-id" type="xs:string" use="optional" />
          </xs:complexType>
        </xs:element>
        <xs:element name="interface" minOccurs="0">
          <xs:complexType>
            <xs:simpleContent>
              <xs:extension base="xs:string">
                <xs:attribute name="label" type="InterfaceLabel" />
                <xs:attribute name="mode" type="InterfaceMode" />
              </xs:extension>
            </xs:simpleContent>
          </xs:complexType>
        </xs:element>
      </xs:all>
      <!--
      Appliance ID, which is the MAC addr
      -->
      <xs:attribute name="appliance-id" use="optional" type="xs:string" />
      <xs:attribute name="id" use="required" type="xs:long" />
      <xs:attribute name="root-infection" use="optional" type="xs:unsignedLong" />
      <xs:attribute name="sensor-ip" use="optional" type="xs:string" />
      <xs:attribute name="name" use="required" type="AlertType" />
      <xs:attribute name="retroactive" use="optional" type="RetroActiveType" />
      <xs:attribute name="severity" use="optional" type="AlertSeverity" />
      <xs:attribute name="uuid" use="optional" type="xs:string" />
      <xs:attribute name="ack" use="optional" type="xs:string" />
      <xs:attribute name="product" use="optional" type="ProductType" />
      <xs:attribute name="version" use="optional" type="xs:string" />
      <xs:attribute name="sigid" use="optional" type="xs:int" />
      <xs:attribute name="sensor" use="optional" type="xs:string" />
      <xs:attribute name="sigrevision" use="optional" type="xs:int" />
      <xs:attribute name="matchcount" use="optional" type="xs:long" />
      <!--
      ips rule name, this is used only for ips events
      -->
      <xs:attribute name="signame" use="optional" type="xs:string" />
      <xs:attribute name="vlan" use="optional" type="xs:integer" />
      <xs:attribute name="class" use="optional" type="AlertCategoryType" />
      <xs:attribute name="sc-version" use="optional" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="explanation">
    <xs:complexType>
      <xs:sequence>
        <!-- for ips events -->
        <xs:element minOccurs="0" name="ips-detected">
          <xs:complexType>
            <xs:sequence>
              <xs:element maxOccurs="unbounded" minOccurs="0" ref="ips-event" />
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element minOccurs="0" name="malware-detected">
          <xs:complexType>
            <xs:sequence>
              <xs:element maxOccurs="unbounded" minOccurs="0" ref="malware" />
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element minOccurs="0" name="cnc-services">
          <xs:complexType>
            <xs:sequence>
              <xs:element maxOccurs="unbounded" minOccurs="0" ref="cnc-service" />
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element name="os-changes" maxOccurs="unbounded" minOccurs="0">
          <xs:complexType>
            <xs:complexContent>
              <xs:extension base="OSCChangeSet">
                <xs:attribute name="osinfo" type="xs:string" />
                <xs:attribute name="id" type="xs:long" />
                <xs:attribute name="version" type="xs:string" use="optional" />
              </xs:extension>
            </xs:complexContent>
          </xs:complexType>
        </xs:element>
        <xs:element minOccurs="0" name="static-analysis">
          <xs:complexType>
            <xs:sequence>
              <xs:element maxOccurs="unbounded" minOccurs="0" ref="static" />
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element name="service" type="xs:string" minOccurs="0" />
        <xs:element ref="anomaly" minOccurs="0" />
        <xs:element ref="target-application" minOccurs="0" />
        <xs:element ref="target-os" minOccurs="0" />
        <xs:element ref="osinfo" minOccurs="0" />
        <xs:element ref="stolen_data" minOccurs="0" />
      </xs:sequence>
      <xs:attribute name="analysis" use="optional" type="xs:NCName" />
      <xs:attribute name="protocol" use="optional" type="xs:string" />
      <xs:attribute name="urls" use="optional" type="xs:integer" />
    </xs:complexType>
  </xs:element>
  <!--
  ips related information
  -->
  <xs:element name="ips-event">
    <xs:complexType>
      <xs:sequence>
        <xs:element name="sig-id" type="xs:string" minOccurs="0" />
        <xs:element name="sig-revision" type="xs:string" minOccurs="0" />
        <xs:element name="sig-name" type="xs:string" minOccurs="0" />
        <xs:element name="match-count" type="xs:integer" minOccurs="0" />
        <xs:element name="cve-id" type="xs:string" minOccurs="0" />
        <xs:element name="action-taken" type="xs:string" minOccurs="0" />
        <xs:element name="attack-mode" type="xs:string" minOccurs="0" />
        <xs:element name="mvx-status" type="xs:string" minOccurs="0" />
      </xs:sequence>
    </xs:complexType>
  </xs:element>
  <xs:element name="malware">
    <xs:complexType mixed="false">
      <xs:all maxOccurs="1" minOccurs="0">
        <xs:element ref="note" minOccurs="0" />
        <xs:element ref="url" minOccurs="0" />
        <xs:element name="profile" type="xs:string" minOccurs="0" />
        <xs:element name="md5sum" type="xs:string" minOccurs="0" />
        <xs:element name="sha1" type="xs:string" minOccurs="0" />
        <xs:element name="sha256" type="xs:string" minOccurs="0" />
        <xs:element name="sha512" type="xs:string" minOccurs="0" />
        <xs:element name="application" type="xs:string" minOccurs="0" />
        <xs:element name="http-header" type="xs:string" minOccurs="0" />
        <xs:element name="domain" type="xs:string" minOccurs="0" />
        <xs:element name="user" type="xs:Name" minOccurs="0" />
        <xs:element name="original" type="xs:string" minOccurs="0" />
        <xs:element name="downloaded-at" type="feDateTime" minOccurs="0" />
        <xs:element name="submitted-at" type="feDateTime" minOccurs="0" />
        <xs:element name="executed-at" type="feDateTime" minOccurs="0" />
        <xs:element minOccurs="0" name="objurl" type="xs:anyURI" />
      </xs:all>
      <xs:attribute name="content" type="xs:string" />
      <xs:attribute name="name" use="optional" type="xs:string" />
      <xs:attribute name="original-infection-id" use="optional" type="xs:integer" />
      <xs:attribute name="original-infection-type" use="optional" type="AlertType" />
      <xs:attribute name="original-infection-url" use="optional" type="xs:string" />
      <xs:attribute name="scan" type="xs:integer" />
      <xs:attribute name="sid" type="xs:string" use="optional" />
      <xs:attribute name="type" use="optional" type="xs:string" />
      <xs:attribute name="stype" use="optional" type="xs:string" />
      <xs:attribute name="archives" type="xs:integer" />
      <xs:attribute name="parent" type="xs:long" />
      <xs:attribute name="origid" type="xs:long" />
      <xs:attribute name="malicious" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="note" type="xs:string" />
  <xs:element name="url" type="xs:string" />
  <xs:element name="cnc-service">
    <xs:complexType>
      <xs:all>
        <xs:element name="address" type="xs:string" minOccurs="0" />
        <xs:element ref="channel" minOccurs="0" />
        <xs:element minOccurs="0" name="location" type="xs:string" />
        <xs:element name="url" type="xs:string" minOccurs="0" />
      </xs:all>
      <xs:attribute name="port" use="required" type="xs:integer" />
      <xs:attribute name="protocol" use="optional" type="xs:NCName" />
      <xs:attribute name="sname" use="optional" type="xs:string" />
      <xs:attribute name="type" use="optional" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="channel" type="xs:string" />
  <xs:element name="target-application" type="xs:string" />
  <xs:element name="anomaly" type="xs:string" />
  <xs:element name="target-os" type="xs:string" />
  <xs:element name="osinfo" type="xs:string" />
  <xs:element name="stolen_data">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="info" minOccurs="0" />
      </xs:sequence>
      <xs:attribute name="event_id" use="optional" type="xs:integer" />
      <xs:attribute name="size" use="optional" type="xs:integer" />
    </xs:complexType>
  </xs:element>
  <xs:element name="info">
    <xs:complexType>
      <xs:sequence>
        <xs:element name="description" type="xs:string" minOccurs="0" />
        <xs:element name="severity" type="xs:string" minOccurs="0" />
        <xs:choice maxOccurs="unbounded" minOccurs="0">
          <xs:element ref="field" />
        </xs:choice>
      </xs:sequence>
      <xs:attribute name="decrypted" use="optional" type="xs:string" />
      <xs:attribute name="encryption" use="optional" type="xs:string" />
      <xs:attribute name="type" use="optional" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="field">
    <xs:complexType>
      <xs:simpleContent>
        <xs:extension base="xs:string">
          <xs:attribute name="name" use="optional" type="xs:string" />
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>
  <xs:element name="src">
    <xs:complexType>
      <xs:all maxOccurs="1" minOccurs="0">
        <xs:element ref="ip" minOccurs="0" />
        <xs:element ref="mac" minOccurs="0" />
        <xs:element minOccurs="0" name="host" type="xs:string" />
        <xs:element minOccurs="0" name="port" type="xs:integer" />
        <xs:element maxOccurs="1" minOccurs="0" name="domain" type="xs:string" />
        <xs:element minOccurs="0" name="smtp-mail-from" type="xs:string" />
        <xs:element minOccurs="0" name="repository" type="xs:anyURI" />
        <xs:element minOccurs="0" ref="url" />
        <xs:element name="proxy" type="xs:string" minOccurs="0" />
      </xs:all>
      <xs:attribute name="vlan" use="optional" type="xs:integer" />
    </xs:complexType>
  </xs:element>
  <xs:element name="ip" type="xs:string" />
  <xs:element name="mac" type="xs:string" />
  <xs:element name="alert-url" type="xs:anyURI" />
  <xs:element name="action" type="xs:string" />
  <xs:element name="locations" type="xs:string" />
  <xs:element name="ati-data" type="xs:string" />
  <xs:element name="static">
  <xs:complexType>
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="version" type="xs:string" />
         <xs:attribute name="tool" type="xs:string" form="unqualified" use="optional" />
       </xs:extension>
     </xs:simpleContent>
  </xs:complexType>
</xs:element>
<xs:simpleType name="RetroActiveType">
  <xs:restriction base="xs:string">
    <xs:enumeration value="yes" />
    <xs:enumeration value="no" />
  </xs:restriction>

</xs:simpleType>
<xs:simpleType name="AlertType">
  <xs:restriction base="xs:string">
    <xs:enumeration value="malware-callback" />
    <xs:enumeration value="domain-match" />
    <xs:enumeration value="infection-match" />
    <xs:enumeration value="web-infection" />
    <xs:enumeration value="malware-object" />
    <xs:enumeration value="ips-event" />
    <xs:enumeration value="riskware-callback" />
    <xs:enumeration value="riskware-object" />
    <xs:enumeration value="riskware-infection" />
  </xs:restriction>
</xs:simpleType>
<xs:simpleType name="feDateTime">
  <xs:restriction base="xs:dateTime">
    <xs:whiteSpace value="collapse" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AlertCategoryType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="IPS" />
      <xs:enumeration value="GENERIC" />
      <xs:enumeration value="RISKWARE" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="ProductType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="Web MPS" />
      <xs:enumeration value="Email MPS" />
      <xs:enumeration value="File MPS" />
      <xs:enumeration value="MAS" />
      <xs:enumeration value="CMS" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AlertSeverity">
    <xs:restriction base="xs:string">
      <xs:enumeration value="crit" />
      <xs:enumeration value="majr" />
      <xs:enumeration value="minr" />
      <xs:enumeration value="unkn" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AnalysisType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="replay" />
      <xs:enumeration value="malware" />
      <xs:enumeration value="direct" />
      <xs:enumeration value="binary" />
      <xs:enumeration value="content" />
      <xs:enumeration value="none" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="InterfaceLabel">
    <xs:restriction base="xs:string">
      <xs:enumeration value="A" />
      <xs:enumeration value="B" />
      <xs:enumeration value="A1" />
      <xs:enumeration value="B1" />
      <xs:enumeration value="A2" />
      <xs:enumeration value="B2" />
      <xs:enumeration value="C" />
      <xs:enumeration value="D" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="InterfaceMode">
    <xs:restriction base="xs:string">
      <xs:enumeration value="inline" />
      <xs:enumeration value="tap" />

      <!-- for Email Security, we need below extra modes (tap is already included above)  -->
      <xs:enumeration value="drop" />
      <xs:enumeration value="block-email" />
      <xs:enumeration value="monitor" />
    </xs:restriction>
  </xs:simpleType>
</xs:schema>

Common XML notifications

The structure and content of Common XML notifications are based on the following XSD schema:

<!-- Version: 1.17 -->
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified">

  <xs:complexType name="FeELEvent">
    <xs:attribute name="sequenceNumber" type="xs:int" use="optional"/>
  </xs:complexType>

  <xs:element name="OS-CORRELATION">
    <xs:complexType>
      <xs:attribute type="xs:string" name="ACTION"/>
      <xs:attribute type="xs:string" name="ID"/>
      <xs:attribute type="xs:string" name="CLASSTYPE"/>
      <xs:attribute type="xs:int" name="WEIGHT"/>
      <xs:attribute type="xs:string" name="MESSAGE"/>
    </xs:complexType>
  </xs:element>

  <xs:element name="malicious-alert">
    <xs:complexType>
      <xs:complexContent>
        <xs:extension base="FeELEvent">
          <xs:sequence>
            <xs:element minOccurs="0" ref="msg"/>
            <xs:element minOccurs="0" ref="display-msg"/>
          </xs:sequence>
          <xs:attribute name="classtype" use="required" type="xs:string"/>
          <xs:attribute name="ruleid" use="required" type="xs:string"/>
          <xs:attribute name="weight" use="required" type="xs:int"/>
        </xs:extension>
      </xs:complexContent>
    </xs:complexType>
  </xs:element>

  <xs:element name="msg" type="xs:string"/>
  <xs:element name="display-msg" type="xs:string"/>

</xs:schema>

The XML message elements and attributes set by the schema are specified in XPath notation and described in XML Path (XPath) Element and Attribute Definitions.

:
Related articles
  • CSV fields for daily digest notifications
    Malware Analysis (AX) > Malware Analysis User Guide Release 11.x > Configuration > Configuring event notifications > Daily digest notifications
  • CSV fields for daily digest notifications
    Malware Analysis (AX) > Malware Analysis User Guide Release 10.x > Configuration > Configuring event notifications > Daily digest notifications
  • About notifications
    Malware Analysis (AX) > Malware Analysis User Guide Release 11.x > Configuration > Configuring event notifications
  • About notifications
    Malware Analysis (AX) > Malware Analysis User Guide Release 10.x > Configuration > Configuring event notifications
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy.
Products
Company
Top Features
Solutions
Existing Users
Connect With Us
Sales and Support
Copyright © Abc Inc. All Rights Reserved