Use these sample event messages as a way of verifying a successful integration with QRadar.
Sample 1
The following sample event message shows Sample 1 logs collected from Trend Micro Vision
One:
LEEF:2.0|Trend Micro|Server & Workload Protection Manager|1.0|192|cat=System name=Alert Ended desc=Alert: CPU Warning Threshold Exceeded\\nSubject: 10.0.0.1\\nSeverity: Warning sev=3 src=10.0.0.1 usrName=System msg=Alert: CPU Warning Threshold Exceeded\\nSubject: 10.0.0.1\\nSeverity: Warning TrendMicroDsTenant=Primary
Table 1. Highlighted values in the
Trend Micro Vision One System Logs sample event.
| QRadar field name |
Highlighted payload field name |
| Event ID |
192 |
| Source ID |
src |
| Username |
usrName |
Sample 2
The following sample event message shows Sample 2 logs collected from Trend Micro Vision
One:
CEF:0|Trend Micro|Deep Security Agent|1.0|20|Log for TCP Port 2|0|cn1=1 cn1Label=Host ID dvc=hostname act=Log dmac=00-00-5E-00-53-00 smac=00-00-5E-00-53-01 TrendMicroDsFrameType=IP src=10.0.0.1 dst=10.0.0.2 out=1019 cs3=DF MF cs3Label=Fragmentation Bits proto=TCP spt=1 dpt=2 cs2=0x00 ACK PSH cs2Label=TCP Flags cnt=1 TrendMicroDsPacketData=AFB
Table 2. Highlighted values in the
Trend Micro Vision One System Logs sample event.
| QRadar field name |
Highlighted payload field name |
| Event ID |
20 |
| Source ID |
src |
| Source Port |
spt |
| Source MAC |
smac |
| Destination IP |
dst |
| Destination Port |
dpt |
| Destination MAC |
dmac |
| Severity |
0 |