This section covers the following topics:
CSV (Comma Separated Values File Format) is similar to CEF format with one exception: there can be multiple alert messages per event. This means that for each low-level event, URL, CnC service and OS change, a separate message is generated. In this way, CSV format provides more details when compared to CEF format.
Similar to CEF, the message in CSV format includes a header and an extension as a set of key-value pairs detailing additional information.
Jan 18 11:07:53 host <message>
where message=<header>|<extension>.
The CSV header consists of a set of attributes delimited by a colon (:), and body field separated by commas. The Trellix CSV message header attributes are defined as follows:
CSV:0: Trellix :<product-name>:<product-version>:<event-type>:<event-name>:<extension>
CSV Field | CSV Description |
|---|---|
| The CSV header consists of a set of appliance attributes delimited by pipes ( | ) which starts with CSV:<VERSION>, where the current CSV version is always 0. |
| Trellix is the appliance vendor. |
| Product name must represent a valid Trellix product name. For example, valid product names are ‘MPS’ (for Network Security), ‘eMPS’ (for Email Security — Server Edition) ‘fMPS’ (for File Protect), ‘MAS’ (forMalware Analysis), and ‘CMS’ (for Central Management). |
| Version represents the version of the Trellix appliance software used to detect the malware and send the alert notification; for example: 8.2.0.74484 |
| CSV event type is an abbreviated, short form of the event name, which corresponds to the output in the next field <event-name>. CSV event types for which there is no signature (rare) are designated as MC (malware-callback), WI (web-infection), IM (infection-match), DM (domain-match), MO (malware-object), and IE (ips-event). |
<event-name> | For event name, Trellix uses the signature name as the event name in CSV message headers; if there are multiple signature names in a single detected malicious event, then notification messages will be generated separately for each:
|
<extension> | Extensions include all the alert detection details, labeled in categories; for example: osinfo=, sev=, malware_type=, alertid=, app=, spt=, locations=, smac=, header=, cnchost=, alertType=, shost=, dst=, original_name=, application=, sid=, malware-note=, objurl=, profile=, dmac=, product=, sname=, fileHash=, dvchost=, release=, link=, cncport=, src=, dpt=, anomaly=, dvc=, channel=, action=, os=, stype= NoteThe definitions for these extension field labels are provided in CSV extension field key=value pair definitions. Not all products reference the same CEF field labels in their alert notifications. |