This section includes the following topics:
Like CEF, the alert notification in LEEF format includes a header and an extension as a set of key=value pairs.
The Trellix LEEF message header is defined as follows. The header fields are separated using the pipe ('|') character, and the body fields are separated using the caret ('^') character.
LEEF:1.0|<vendor>|<product name>|<version>|<LEEF eventID>|<extension>
where
LEEF Field | Description |
|---|---|
| The LEEF header consists of a set of appliance attributes delimited by pipes ( | ) which starts with LEEF:<VERSION>, where the current LEEF version is always 1.0. |
| Trellix is the appliance vendor. |
| Product name must represent a valid Trellix product name. For example, valid product names are ‘MPS’ (for Network Security), ‘eMPS’ (for Email Security — Server Edition) ‘fMPS’ (for File Protect), ‘MAS’ (for Malware Analysis), and ‘CMS’ (for Central Management). |
| Version represents the version of the Trellix appliance software used to detect the malware and send the alert notification; for example: 8.2.0.74484 |
| Event ID types:
|
| Extensions include all the alert detection details, labeled in categories; for example: fileHash=, src=, request=, proto=, dvchost=, srcPort=, dvc=, filePath=, sname=, dstmac=, vlan=, cncHost=, externalID=, devTime=, sID=, cncPort=, link=, srcMAC=, dst=, dstPort=, cncChannel=, osinfo=, targetApp=, anomaly= NoteThe definitions for these extension field labels are provided in LEEF extension field key=value pair definitions. Not all products reference the same LEEF field labels in their alert notifications. |