Log reference

Use the following raw log examples to validate parsing and normalization.

Raw log examples

Trend Micro Deep Security (CEF)

CEF:0|Trend Micro|Deep Security Agent|11|4000000|TROJ_KOVTER|6|...

Trend Micro Deep Discovery (CEF)

<156>CEF:0|Trend Micro|Deep Discovery Email Inspector|2.5.1300|100132|URL_DETECTION|6|...

Trend Micro Control Manager (syslog key=value)

<133>Oct 24 17:04:03 TMCM:SLF_INCIDENT_EVT_VIRUS_FOUND_DELETE_SUCCESS Security ...

Trend Micro IWSVA (key=value separated by commas)

<134>... Access tracking log tk_username=... ,tk_url=... ,tk_client_ip=...

Trend Micro IWSVA (pipe-separated)

2021/02/15 10:29:20 ... | device_ip=... | device_name=IWSVA | ...

Trend Micro IMSVA (syslog)

<183>Aug 30 12:29:34 ... [NORMAL]LOG_LEVEL_INFO: ... Rate result ...

Trend Micro IMSS (syslog)

<143>Jan  8 11:42:49 y0137p03 log.imss[29821]: 2025/01/08 11:42:27 GMT+01:00	[21282:4152043248] Memory content(size: 10091) saved as time spent <38.91> ms

Trend Micro ISMS (syslog)

<143>Jan  8 11:42:49 y0137p03 log.imss[29821]: 2025/01/08 11:42:27 GMT+01:00	[21282:4152043248] Memory content(size: 10091) saved as time spent <38.91> ms

Trend Micro Office Scan (JSON)

<12>Sep 8 10:55:15 ... {"EventTime":"2017-09-08 10:45:30","Hostname":"...","EventType":"WARNING",...}

Trend Micro Cloud App Security (CEF)

CEF:0|Trend Micro|CAS|5.0|100,104|dlp|High|...

Trend Vision One

TrendVisionOne: {"schemaVersion": "1.20", "id": "WB-*****-20***119-00000", "investigationStatus": "New", "status": "Open", "investigationResult": "No Findings", "workbenchLink": "https://portal.eu.xdr.trendmicro.com/index.html#/workbench/alerts/WB-*****-20***119-00000?ref=0c12e642ca5b7ed4436e5f23f568ae10066608d3", "alertProvider": "SAE", "modelId": "a796db2d-dacd-4aa2-8671-2fe2f7c7f9f7", "model": "Possible Disabling or Bypassing of Gatekeeper", "modelType": "preset", "score": 33, "severity": "low", "createdDateTime": "2026-02-02T04:13:43Z", "updatedDateTime": "2026-02-02T04:13:51Z", "ownerIds": [], "incidentId": "IC-**99-20****19-00000", "impactScope": {"desktopCount": 1, "serverCount": 0, "accountCount": 1, "emailAddressCount": 0, "containerCount": 0, "cloudIdentityCount": 0, "cloudWorkloadCount": 0, "entities": [{"entityType": "account", "entityValue": "kla", "entityId": "kla", "relatedEntities": ["F4998596-434F-C139-E012-59F8B706EC6F", "F4998596-434F-C139-E012-59F8B706EC6F"], "relatedIndicatorIds": [], "provenance": ["Related Asset Enrichment", "Alert"]}]}, "description": "Gatekeeper, a security feature in macOS, is designed to ensure that only trusted software runs on a Mac. This detection identifies attempts to disable or bypass Gatekeeper by modifying system settings or file attributes.", "matchedRules": [{"id": "3b021deb-b6be-441e-93b8-fb6ebf354ec0", "name": "Possible Disabling or Bypassing of Gatekeeper", "matchedFilters": [{"id": "d0eb02ee-ae77-4f61-9b41-83ddca8d94a0", "name": "Possible Disabling or Bypassing of Gatekeeper", "matchedDateTime": "2026-02-02T04:13:31.087Z", "mitreTechniqueIds": ["T1562.001", "T1222.002", "T1059.004", "T1553.001"], "matchedEvents": [{"uuid": "35d23542-142d-4146-b4fa-644df423bc1a", "matchedDateTime": "2026-02-02T04:13:31.087Z", "type": "TELEMETRY_PROCESS"}]}]}], "indicators": [{"id": 1, "type": "command_line", "field": "processCmd", "value": "/private/...OS/AppCleaner", "relatedEntities": ["F4998596-434F-C139-E012-59F8B706EC6F"], "filterIds": ["d0eb02ee-ae77-4f61-9b41-83ddca8d94a0"], "provenance": ["Alert"]}]}

Database query examples (ODBC/MSSQL)

Trend Micro DB v11

SELECT * FROM [db_ControlManager].[dbo].[v_Virus_HostDetail]

Trend Micro DB v12

SELECT * FROM tb_AVVirusLog