Values of fields in the body of CEF messages for classes of ScanLogic group events

Support

Support for business applications

Kaspersky Security 8.0 for Linux Mail Server

Publishing program events to a SIEM system

Values of fields in the body of CEF messages for classes of ScanLogic group events

July 4, 2024

ID 151789

In the body of CEF messages for classes of ScanLogic group events, you can use keys in accordance with their semantics (see the table below).

Permissible values of the fields for classes of ScanLogic group events

Event class	Key	Value
All ScanLogic group classes	cs1	Message ID.
	cs1Label	Its value is always `MessageId`.
	src	IP address of the server from which the message was received.
	act	Action.
	fsize	Message size.
	suser	Mail sender.
	duser	List of message recipients.
	reason	Reason for the event.
	cs2	List of rules.
	cs2Label	Its value is always `Rules`.
	outcome	Scan status.
	cs3	List of recipients of the detected message (from the Skip action).
	cs3Label	Its value is always `UnsafeRecipients`.
	fname	File name.
LMS_EV_SCAN_LOGIC_AS_STATUS LMS_EV_SCAN_LOGIC_AP_STATUS	cs4	Detection method.
LMS_EV_SCAN_LOGIC_AS_STATUS LMS_EV_SCAN_LOGIC_AP_STATUS	cs4Label	Its value is always `Method`.
LMS_EV_SCAN_LOGIC_MA_STATUS	cs4	SPF status.
	cs4Label	Its value is always `SpfVerdict`.
	cs5	DKIM status.
	cs5Label	Its value is always `DkimVerdict`.
	cs6	DMARC status.
	cs6Label	Its value is always `DmarcVerdict`.
LMS_EV_SCAN_LOGIC_KT_STATUS	suser	Name of the user account that extracted the message from KATA Quarantine.
	cs4	Reason for skipping the scan.
	cs4Label	Its value is always `SkipReason`.
LMS_EV_SCAN_LOGIC_CF_STATUS	cs4	`BannedFileFormat` or `BannedFileName`.
LMS_EV_SCAN_LOGIC_CF_STATUS	cs4Label	Its value is always `BannedEntity`.
LMS_EV_SCAN_LOGIC_PART_RESULT	cn1	Number of objects.
	cn1Label	Its value is always `ObjectsNumber`.
	cs2	List of rules.
	cs2Label	Its value is always `Rules`.
	cs3	Unscanned files.
	cs3Label	Its value is always `AvExclude`.
	cs4	Names of threats.
	cs4Label	Its value is always `Threats`.
	cs5	Name of the blocked file.
	cs5Label	Its value is always `BannedFileName`.
	cs6	Format of the blocked file.
	cs6Label	Its value is always `BannedFileFormat`.

Each class of ScanLogic group events can contain only keys that are relevant to it (see the table below).

Relevant keys for classes of ScanLogic group events

Event class	Relevant keys
LMS_EV_SCAN_LOGIC_ALL_NOT_PROCESSED	cs1, cs1Label, src, act, fsize, suser, duser
LMS_EV_SCAN_LOGIC_AS_STATUS	cs1, cs1Label, src, act, fsize, suser, duser, cs2, cs2Label
LMS_EV_SCAN_LOGIC_AV_STATUS	cs1, cs1Label, src, act, fsize, suser, duser, cs2, cs2Label, cs3, cs3Label, reason, outcome
LMS_EV_SCAN_LOGIC_AP_STATUS	cs1, cs1Label, src, act, fsize, suser, duser, cs2, cs2Label, cs3, cs3Label, reason, cs4, cs4Label, outcome
LMS_EV_SCAN_LOGIC_KT_STATUS	cs1, cs1Label, src, act, fsize, suser, duser, cs2, cs2Label, cs3, cs3Label, reason, suser, outcome
LMS_EV_SCAN_LOGIC_MA_STATUS	cs1, cs1Label, src, act, fsize, suser, duser, cs2, cs2Label, cs3, cs3Label, reason, cs4, cs4Label, cs5, cs5Label, cs6, cs6Label, outcome
LMS_EV_SCAN_LOGIC_CF_STATUS	cs1, cs1Label, src, act, fsize, suser, duser, cs2, cs2Label, cs3, cs3Label, reason, cs4, cs4Label, outcome
LMS_EV_SCAN_LOGIC_PART_RESULT	cs1, cs1Label, cn1, cn1Label, fname, act, cn2, cn2Label, reason, cs2, cs2Label, cs3, cs3Label, cs4, cs4Label, cs5, cs5Label, cs6, cs6Label, outcome
LMS_EV_SCAN_LOGIC_MESSAGE_BACKUP	cs1, cs1Label, src, act, fsize, suser, duser, reason, cs2, cs2Label

');

Kaspersky Endpoint Security for Business Advanced: Adaptive security of your company

Web and device controls. Data encryption. Centralized and convenient management from a single console.

');

Kaspersky Premium Support (MSA): High‑priority incident processing

Telephone and web ticket support. Fast response, monitoring and health check. Submit a request and activate the contract (MSA).