Your AV is Trying to Tell You Something: VBN's Part 1

Symantec VBN (quarantine) files have been rather troublesome for most people. I've read what articles I could find and looked at various tools on the subject but at some point, they all failed. There had to be something everyone was missing. And there was! As a community, we figured out that there were two types of VBN files. Depending on where they were in the folder structure determined whether they contained the quarantined file, or so we thought.

Shane King had shared his research into VBN's which laid the groundwork for the majority of my research. His methodology into extracting the quarantined content worked majority of the time, but not always. I was looking though Symantec's quarantine location one day and noticed some rather large VBN's in the location where they should only contain metadata and not quarantined content. When I XORed the data, I soon realized these larger files too contained quarantined content. A third VBN type!

Quarantine folder structure

Focusing back on the first structure in the VBN, they all looked the same. There had to be something in this structure that indicated what type of VBN we are dealing with. Back to Shane's work, there were a lot of unknowns in this structure. Looking through the unknown parts of the structure, I was able to figure out what the timestamps meant and various other things, but no indication on what would come next after this structure. It wasn't until I started playing around with Symantec's Qextract tool that I found my answer.

Qextract gives detailed output of the VBN files in the quarantine folder. By looking through this output, I was able to find the majority of the locations in the VBN file where Qextract was getting its information from. There was one part of the output that stood out to me, Record Type.  With this information, it confirmed my hypotheses that there were three different types of VBN. 

Now that we know there are different types of VBN's and a way to identify them, we can figure out what structures come next in the VBN file. I am going to stop here for now. I will cover the different structures of each record type in the next series of posts. In the mean time, below is the layout for the first structure. The VBN Metadata structure. *Note: This applies to VBN files found on Windows. Linux layout is still a work in progress.

VBN file format V1 (Windows - SEP 11)

VBN Metadata

Offset	Length	Field	Description
0	4	Size	Size of the VBN Metadata section, 0xe5c
4	384	Description	FQP of Quarantine File
388	984	Log Line	Information on event.
1372	4	Data Type	Value which can describe the subsequent data. (0x1 = No dates, 0x2 = Dates)
1376	4	Record ID	VBin ID/VBN Name
1380	8	Date Created	Indicates a time of creation of object on the file system. (Windows Filetime)
1388	8	Date Accessed	Indicates a time of last access of an object. (Windows Filetime)
1396	8	Date Modified	Indicates a time of last modification of content. (Windows Filetime)
1404	4	Data Type	Value which can describe the subsequent data. (0x0 = No storage info, 0x2 = Storage info)
1408	484	Unknown	Will require further investigation as to the purpose of this entry.
1892	48	Storage Name	Where threat was found (FileSystem/InternetMail/LotusNotes/MicrosoftExchange)
1940	4	Storage Instance ID	Will require further investigation as to the purpose of this entry.
1944	384	Storage Key	Will require further investigation as to the purpose of this entry.
2328	4	Data Type	Value which can describe the subsequent data.
2332	4	Unknown	Will require further investigation as to the purpose of this entry.
2336	8	Unknown	Will require further investigation as to the purpose of this entry.
2344	4	Data Type	Value which can describe the subsequent data.
2348	4	Quarantine Data Size	Size of Quarantined Data (bytes)
2352	4	Date Accessed	Indicates a time of last access of an object. (Unix: 32 bit Hex)
2356	4	Date Modified	Indicates a time of last modification of content. (Unix: 32 bit Hex)
2360	4	Date Created	Indicates a time of creation of object on the file system. (Unix: 32 bit Hex)
2364	4	VBin Time	Time data was quarantined. (Unix: 32 bit Hex)
2368	8	Unknown	Will require further investigation as to the purpose of this entry.
2376	16	Unique ID	Unique GUID
2392	260	Unknown	Will require further investigation as to the purpose of this entry.
2652	4	Unknown	Will require further investigation as to the purpose of this entry.
2656	4	Record Type	0x0 = Hybrid, 0x1 = Meta, 0x2 = Quarantine
2660	4	Quarantine Session ID	Name of subfolder where VBN is stored
2664	4	Remediation Type	Type of remediation 0 None 2000 Registry 2001 File 2002 Process 2003 Batch File 2004 INI File 2005 Service 2006 Infected File 2007 COM Object 2008 Host File Entry 2009 Directory 2010 Layered Service Provider 2011 Internet Browser Cache
2668	4	Unknown	Will require further investigation as to the purpose of this entry.
2672	4	Unknown	Will require further investigation as to the purpose of this entry.
2676	4	Unknown	Will require further investigation as to the purpose of this entry.
2680	4	Unknown	Will require further investigation as to the purpose of this entry.
2684	4	Unknown	Will require further investigation as to the purpose of this entry.
2688	4	Unknown	Will require further investigation as to the purpose of this entry.
2692	4	Unknown	Will require further investigation as to the purpose of this entry.
2696	768	Wide Description	FQP of Quarantine File (Unicode)
3464	212	Unknown	Will require further investigation as to the purpose of this entry.

VBN file format V2 (Windows - SEP 12 +)

VBN Metadata

Offset	Length	Field	Description
0	4	Size	Size of the VBN Metadata section, 0x1290
4	384	Description	FQP of Quarantine File
388	2048	Log Line	Information on event.
2436	4	Data Type	Value which can describe the subsequent data. (0x1 = No dates, 0x2 = Dates)
2440	4	Record ID	VBin ID/VBN Name
2444	8	Date Created	Indicates a time of creation of object on the file system. (Windows Filetime)
2452	8	Date Accessed	Indicates a time of last access of an object. (Windows Filetime)
2460	8	Date Modified	Indicates a time of last modification of content. (Windows Filetime)
2468	4	Data Type	Value which can describe the subsequent data. (0x0 = No storage info, 0x2 = Storage info)
2472	484	Unknown	Will require further investigation as to the purpose of this entry.
2956	48	Storage Name	Where threat was found (FileSystem/InternetMail/LotusNotes/MicrosoftExchange)
3004	4	Storage Instance ID	Will require further investigation as to the purpose of this entry.
3008	384	Storage Key	Will require further investigation as to the purpose of this entry.
3392	4	Data Type	Value which can describe the subsequent data.
3396	4	Unknown	Will require further investigation as to the purpose of this entry.
3400	8	Unknown	Will require further investigation as to the purpose of this entry.
3408	4	Data Type	Value which can describe the subsequent data.
3412	4	Quarantine Data Size	Size of Quarantined Data (bytes)
3416	4	Date Accessed	Indicates a time of last access of an object. (Unix: 32 bit Hex)
3420	4	Unknown	Will require further investigation as to the purpose of this entry.
3424	4	Date Modified	Indicates a time of last modification of content. (Unix: 32 bit Hex)
3428	4	Unknown	Will require further investigation as to the purpose of this entry.
3432	4	Date Created	Indicates a time of creation of object on the file system. (Unix: 32 bit Hex)
3436	4	Unknown	Will require further investigation as to the purpose of this entry.
3440	4	VBin Time	Time data was quarantined. (Unix: 32 bit Hex)
3444	4	Unknown	Will require further investigation as to the purpose of this entry.
3448	4	Unknown	Will require further investigation as to the purpose of this entry.
3452	16	Unique ID	Unique GUID
3468	260	Unknown	Will require further investigation as to the purpose of this entry.
3728	4	Unknown	Will require further investigation as to the purpose of this entry.
3732	4	Record Type	0x0 = Hybrid, 0x1 = Meta, 0x2 = Quarantine
3736	4	Quarantine Session ID	Name of subfolder where VBN is stored
3740	4	Remediation Type	Type of remediation 0 None 2000 Registry 2001 File 2002 Process 2003 Batch File 2004 INI File 2005 Service 2006 Infected File 2007 COM Object 2008 Host File Entry 2009 Directory 2010 Layered Service Provider 2011 Internet Browser Cache
3744	4	Unknown	Will require further investigation as to the purpose of this entry.
3748	4	Unknown	Will require further investigation as to the purpose of this entry.
3752	4	Unknown	Will require further investigation as to the purpose of this entry.
3756	4	Unknown	Will require further investigation as to the purpose of this entry.
3760	4	Unknown	Will require further investigation as to the purpose of this entry.
3764	4	Unknown	Will require further investigation as to the purpose of this entry.
3768	4	Unknown	Will require further investigation as to the purpose of this entry.
3772	768	Wide Description	FQP of Quarantine File (Unicode)
4540	212	Unknown	Will require further investigation as to the purpose of this entry.

Your AV is Trying to Tell You Something: AVMan.log/Daily AV Log

AV Managment Plugin Log

The AV Managment Plugin log contains copies of all AV events that occured on the endpint. AVMan's entries consist of data, in the form of the log line format, with some additional timestamps.

Antivirus Management Log File Format

The antivirus managment log for SEP can be found at the following location:
C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\AVMan.log

Header

Field	Type	Size	Description
Max Log Size	hex	8	Maximum log file size in bytes
Unknown	hex	8	?
Number of Entries	hex	8	Number of entries in log
Unknown	hex	8	?
Unknown	hex	8	?
Max Log Days	hex	8	Maximun days to save log entries

Log Entries

The log is in TSV format, meaning, each field is separated by a tab character.

Field	Type	Size	Description
Entry Length	hex	8	Length of log entry
Date and Time 1	Windows: 64 bit Hex Value - Big Endian	16	Will require further investigation as to the purpose of this log entry.
Date and Time 2	Windows: 64 bit Hex Value - Big Endian	16	Will require further investigation as to the purpose of this log entry.
Date and Time 3	Windows: 64 bit Hex Value - Big Endian	16	Will require further investigation as to the purpose of this log entry.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Data	varbinary	2000	Additional data in binary format.

Daily AV Log

The daily AV log also contains copies of AV events tha occured on the endpoint. These logs are broken down by day and consist of log line entries and do not contain a header. The daily AV logs stored in the users appdata folder go back to when Symantec was first installed and pertain only to that user. The ones in the programdata folder contain all users AV events but only go back thirty days or what the Symantec policy dictates.

The daily AV logss for SEP can be found in the following loactions:
C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\AV
C:\Users\<user>\AppData\Local\Symantec\Symantec Endpoint Protection\Logs

Your AV is Trying to Tell You Something: process.log

Client Management Control Log

The process log contains client activities that occured on the endpoint. The types of events the process log reports on are application control driver, application control rules, or tamper protect. There is little difference from the actual log and the Windows client. The process log is one of the more human readable logs.

Control Log File Format

The control log for SEP can be found at the following location: C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\processlog.log

Header

Field	Type	Size	Description
Log Type	hex	8	Always 00000004
Max Log Size	hex	8	Maximum log file size in bytes
Unknown	hex	8	?
Number of Entries	hex	8	Number of entries in log
Unknown	hex	8	?
Running Total Entries	hex	16	Total number of events generated
Max Log Days	hex	8	Maximun days to save log entries

Log Entries

The log is in TSV format, meaning, each field is separated by a tab character.

Field	Type	Size	Description
Entry Length	hex	3	Length of log entry
Date and Time	Windows: 64 bit Hex Value - Big Endian	16	The time of the generated event (GMT).
Event ID	hex	3	An event ID from the sending agent: 501 = Application Control Driver 502 = Application Control Rules 999 = Tamper Protection
Severity	int	1	The seriousness of the event 0 is most serious.
Action	int	1	The action that was taken: 0 = allow 1 = block 2 = ask 3 = continue 4 = terminate
Test Mode	int	1	Was this rule run in test mode? 0 = No, Else = Yes
Description	nvarchar	8000	The behavior that was blocked. Because of a character limit, actual values may be longer than the values that are displayed in Symantec Endpoint Protection Manager. You can verify the full text on the client that reports this data.
API	nvarchar	512	The API that was blocked.
Unknown	hex	16	Will require further investigation as to the purpose of this log entry.
Begin Time	Windows: 64 bit Hex Value - Big Endian	16	The start time of the security issue.
End Time	Windows: 64 bit Hex Value - Big Endian	16	The end time of the security issue. This field is an optional field because the exact end time of traffic may not be detected; for example, as with UDP traffic. If the end time is not detected, it is set to equal the start time.
Rule Name	nvarchar	512	The name of the rule that was triggered by the event. If the rule name is not specified in the security rule, then this field is empty. Having the rule name can be useful for troubleshooting.
Caller Process ID	hex	4	The ID of the process that triggers the logging.
Caller Process	nvarchar	512	The full path name of the application involved. It may be empty if the application is unknown, or if OS itself is involved, or if no application is involved. Also, it may be empty if profile says, "don't log application name in raw traffic log".
Unknown	int	1	Will require further investigation as to the purpose of this log entry.
Caller Return Module Name	nvarchar	512	The module name of the caller. See CallerReturnAddress for more information.
Target	nvarchar	?	Name of file
Location	nvarchar	512	The location used when the event occured.
User	nvarchar	512	The logon user name.
User Domain	nvarchar	512	The logon (Windows) domain name.
Unknown	int	1	Will require further investigation as to the purpose of this log entry.
Unknown	int	1	Will require further investigation as to the purpose of this log entry.
IPV4 Address	hex	8	The IP address of the computer associated with the application control violation.
Device Instance ID	varchar	256	The GUID of an external device (floppy disk, DVD, USB device, etc.).
File Size	hex	2	The size of the file associated with the application control violation, in bytes.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
IPV6 Address	hex	32	The IP address of the computer associated with the application control violation. (IPV6)

Your AV is Trying to Tell You Something: rawlog.log

Network and Host Exploit Mitigation Packet Log

The raw log contains packet traffic that occured on the endpoint. This log is populated if the firewall rule is set to capture a packet. The only thing the Windows client is missing is the rule id. This log is not very human readable due to the packet data it contains. One shortcoming to the smc commandline tool is that it will not export the packet data even though it is in the log and the Windows GUI client.

Packet Log File Format

The packet log for SEP can be found at the following location: C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\rawlog.log

Header

Field	Type	Size	Description
Log Type	hex	8	Always 00000003
Max Log Size	hex	8	Maximum log file size in bytes
Unknown	hex	8	?
Number of Entries	hex	8	Number of entries in log
Unknown	hex	8	?
Running Total Entries	hex	16	Total number of events generated
Max Log Days	hex	8	Maximun days to save log entries

Log Entries

The log is in TSV format, meaning, each field is separated by a tab character.

Field	Type	Size	Description
Entry Length	hex	8	Length of log entry
Date and Time	Windows: 64 bit Hex Value - Big Endian	16	The time of the generated event (GMT).
Event ID	hex	8	An event ID from the sending agent: 401 = Raw Ethernet
Local Host	hex	8	The IP address of the local computer (IPv4).
Remote Host	hex	8	The IP address of the remote computer (IPv4).
Local Port	hex	8	The TCP/UDP port of the local computer (host byte-order). It is only valid on TSE_TRAFFIC_TCP and TSE_TRAFFIC_UDP. For other events, it is always zero.
Remote Port	hex	8	The TCP/UDP port of the remote computer (host byte-order). It is only valid on TSE_TRAFFIC_TCP and TSE_TRAFFIC_UDP. For other events, it is always zero.
Packet Length	hex	8	Lenght of packet data
Direction	hex	8	The direction of traffic (unknown = 0; inbound = 1; outbound = 2).
Action	hex	8	Specifies if the traffic was blocked (yes = 1, no = 0).
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Remote Host Name	nvarchar	128	The host name of the remote computer. This field may be empty if the name resolution failed.
Application	nvarchar	512	The full path name of the application involved. It may be empty if an unknown application is involved or if no application is involved. For example, the ping of death DoS attack does not have an AppName because it attacks the operating system.
Packet	varbinary	2000
Rule	nvarchar	512	The name of the rule that was triggered by the event. If the rule name is not specified in the security rule, then this field is empty. Having the rule name can be useful for troubleshooting. You may recognize a rule by the rule ID, but rule name can help you recognize it more quickly.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Remote Host IPV6	hex	32	The IP address of the remote host (IPv6).
Local Host IPV6	hex	32	The IP address of the local computer (IPv6).
Rule ID	cahr	32	The ID of the rule that is triggered by the event. It is always 0 if the rule ID is not specified in the security rule. This field is helpful to security rule troubleshooting. If multiple rules match, it logs the rule that has the final decision on PacketProc (pass/block/drop).

Your AV is Trying to Tell You Something: tralog.log

Network and Host Exploit Midigation Traffic Log

The traffic log contains network traffic that occur on the endpoint. This log is populated when there is a hit on one of the firewall rules. The things of interest that are missing from the Windows client inlude: the MD5/SHA256 hash of the executable that triggered the firewall rule and the rule id.

Traffic Log File Format

The traffic log for SEP can be found at the following location: C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\tralog.log

Header

Field	Type	Size	Description
Log Type	hex	8	Always 00000002
Max Log Size	hex	8	Maximum log file size in bytes
Unknown	hex	8	?
Number of Entries	hex	8	Number of entries in log
Unknown	hex	8	?
Running Total Entries	hex	16	Total number of events generated
Max Log Days	hex	8	Maximun days to save log entries

Log Entries

The log is in TSV format, meaning, each field is separated by a tab character.

Field	Type	Size	Description
Entry Length	hex	8	Length of log entry
Date and Time	Windows: 64 bit Hex Value - Big Endian	16	The time of the generated event (GMT).
Event ID	hex	8	An event ID from the sending agent: 301 = TCP initiated 302 = UDP datagram 303 = Ping request 304 = TCP completed 305 = Traffic (other) 306 = ICMPv4 packet 307 = Ethernet packet 308 = IP packet 309 = ICMPv6 packet *
Local Host	hex	8	The IP address of the local computer (IPv4).
Remote Host	hex	8	The IP address of the remote computer (IPv4).
Local Port	hex	8	The TCP/UDP port of the local computer (host byte-order). It is only valid on TSE_TRAFFIC_TCP and TSE_TRAFFIC_UDP. For other events, it is always zero.
Remote Port	hex	8	The TCP/UDP port of the remote computer (host byte-order). It is only valid on TSE_TRAFFIC_TCP and TSE_TRAFFIC_UDP. For other events, it is always zero.
Direction	hex	8	The direction of traffic. (Unknown = 0; inbound = 1; outbound = 2)
Begin Time	Windows: 64 bit Hex Value - Big Endian	16	The start time of the security issue.
End Time	Windows: 64 bit Hex Value - Big Endian	16	The end time of the security issue. This field is an optional field because the exact end time of traffic may not be detected; for example, as with UDP traffic. If the end time is not detected, it is set to equal the start time.
Repetition	hex	8	The number of attacks. Sometime, when a hacker launches a mass attack, it may be reduced to one event by the log system, depending on the damper period.
Action	hex	8	Specifies if the traffic was blocked. (Yes = 1, no = 0)
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Severity	hex	8	Severity as defined in the security rule. Critical = 0 - 3 Major = 4 - 7 Minor = 8 - 11 Info = 12 - 15
Rule ID	char	32	The ID of the rule that is triggered by the event. It is always 0 if the rule ID is not specified in the security rule. This field is helpful to security rule troubleshooting. If multiple rules match, it logs the rule that has the final decision on PacketProc (pass/block/drop).
Remote Host Name	nvarchar	128	The host name of the remote computer. This field may be empty if the name resolution failed.
Rule	nvarchar	512	The name of the rule that was triggered by the event. If the rule name is not specified in the security rule, then this field is empty. Having the rule name can be useful for troubleshooting. You may recognize a rule by the rule ID, but rule name can help you recognize it more quickly.
Application	nvarchar	512	The full path of application involved. It may be empty if an unknown application is involved or if no application is involved. For example, the ping of death DoS attack does not have AppName because it attacks the operating system itself.
Local MAC	binary	32	The MAC address of the local computer.
Remote MAC	binary	32	The MAC address of the remote computer.
Location	nvarchar	512	The location used when the event occured.
User	nvarchar	512	The logon user name.
User Domain	nvarchar	512	The logon domain name.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Remote Host IPV6	hex	32	The IP address of the remote host (IPv6).
Local Host IPV6	hex	32	The IP address of the local comuter (IPv6).
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
MD5	char	32	The MD5 hash of the executable that triggered the firewall rule.
SHA-256	char	64	The SHA256 hash of the executable that triggered the firewall rule.
Unknown	?	?	Will require further investigation as to the purpose of this log entry.
Unknown	?	?	Will require further investigation as to the purpose of this log entry.
Unknown	?	?	Will require further investigation as to the purpose of this log entry.

* SEP14.2.1

NTOSKRNL is a special SYSTEM process with PID 4. Due to how Windows locks the file, SEP is unable to get the hash, so it was hard-coded with a static value.
MD5: 53797320000000000000000000000000
SHA-256: 5379732000000000000000000000000000000000000000000000000000000000

This value is a hexadecimal representation of text:
Hex: 53 79 73 20
Ascii: "Sys "

The reported hash on NTSOKRNL.exe is by design.

Your AV is Trying to Tell You Something: seclog.log

Client Management Security Log

The security log contains security events that occur on the endpoint. These include compliance, firewall and IPS, application and device control, and memory exploit mitigation events. Majority of the entries will be related to IPS. There are too many differences to list but, the Windows client will only show you 23 of the 42 fields available. As you can see, this log needs quite a bit of interpretation to figure out what it is trying to say.

Security Log File Format

The security log for SEP can be found at the following location: C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\seclog.log

Header

Field	Type	Size	Description
Log Type	hex	8	Always 00000001
Max Log Size	hex	8	Maximum log file size in bytes
Unknown	hex	8	?
Number of Entries	hex	8	Number of entries in log
Unknown	hex	8	?
Running Total Entries	hex	16	Total number of events generated
Max Log Days	hex	8	Maximun days to save log entries

Log Entries

The log is in TSV format, meaning, each field is separated by a tab character.

Field	Type	Size	Description
Entry Length	hex	8	Length of log entry
Date and Time	Windows: 64 bit Hex Value - Big Endian	16	The time of the generated event (GMT).
Event ID	hex	8	Compliance events: 209 = Host Integrity failed. 210 = Host Integrity passed. 221 = Host Integrity failed, but reported as passed. 237 = Host Integrity custom log entry. Firewall and IPS events: 201 = Invalid traffic by rule. * 202 = Port scan. * 203 = Denial of service. * 204 = Trojan. * 205 = Executable file was changed. * 206 = Intrusion Prevention System Intrusion was detected. * 207 = Active Response. 208 = MAC spoofing. * 211 = Active Response was disengaged. 216 = Executable file change was detected. 217 = Executable file change was accepted. 218 = Executable file change was denied. 219 = Active Response was cancelled. * 220 = Application hijacking. 249 = Browser Protection event. Application and Device control: 238 = Device control disabled the device. 239 = Buffer Overflow event. 240 = Software protection has thrown an exception. 241 = Not used. * 242 = Device control enabled the device. * Memory Exploit Mitigation events: * 250 = Memory Exploit Mitigation blocked an event. * 251 = Memory Exploit Mitigation allowed an event. *
Severity	hex	8	The severity as defined in the security rule. Critical = 0 - 3 Major = 4 - 7 Minor = 8 - 11 Info = 12 - 15
Local Host	hex	8	The IP address of the local computer (IPv4).
Remote Host	hex	8	The IP address of the remote computer (IPv4).
Protocol	hex	8	The protocol type. (OTHERS = 1; TCP = 2; UDP = 3; ICMP = 4)
Hack Type	hex	8	If event ID = 209, Host Integrity failed (TSLOG_SEC_NO_AV), the reason for the failure If Event ID = 206, Intrusion Prevention System( Intrusion Detected, TSLOG_SEC_INTRUSION_DETECTED), the intrusion ID If event ID = 210, Host Integrity passed( TSLOG_SEC_AV), additional information Possible reasons are as follows: Process is not running - Bit0 is 1 Signature is out of date - Bit1 is 1 Recovery was attempted - Bit2 is 1
Direction	hex	8	The direction of traffic. (Unknown = 0; inbound = 1; outbound = 2)
Begin Time	Windows: 64 bit Hex Value - Big Endian	16	The start time of the security issue.
End Time	Windows: 64 bit Hex Value - Big Endian	16	The end time of the security issue. This field is an optional field because the exact end time of traffic may not be detected; for example, as with UDP traffic. If the end time is not detected, it is set to equal the start time.
Occurences	hex	8	The number of attacks. Sometime, when a hacker launches a mass attack, it may be reduced to one event by the log system, depending on the damper period.
Log Data Size	hex	8
Description	nvarchar	4000	Description of the event. Usually, the first line of the description is treated as the summary.
Unknown	?	?	Will require further investigation as to the purpose of this log entry.
Application	nvarchar	512	The full path of the application involved. This field may be empty if an unknown application is involved, or no application is involved. For example, the ping of death DoS attack does not have an application name because it attacks the OS itself.
Log Data	varbinary	3000	Additional data in binary format. This field is optional.
Local MAC	binary	32	The MAC address of the local computer.
Remote MAC	binary	32	The MAC address of the remote computer.
Location	nvarchar	512	The location used when the event occured.
User	nvarchar	512	The logon user name.
User Domain	nvarchar	512	The logon domain name.
Signature ID	hex	8	The signature ID.
Signature Sub ID	hex	8	The signature sub ID.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Remote Port	hex	8	The remote port.
Locacl Port	hex	8	The local port.
Local Host IPV6	hex	32	The IP address of the local computer (IPv6).
Remote Host IPV6	hex	32	The IP address of the remote computer (IPv6).
Signature Name	nvarchar	520	The signature name.
X Intrusion Payload	nvarchar	4200	The URL that hosted the payload.
Intrusion URL	nvarchar	4200	The URL from the detection
Unknown	?	?	Will require further investigation as to the purpose of this log entry.
Symantec Version Number	nvarchar	128	The agent version number on the client.
Profile Serial Number	varchar	64	The policy serial number.
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
MD5 Hash	char	32	The MD5 hash value.
SHA-256 Hash	char	64	The SHA-256 hash value.
URL_HID_LEVEL †	hex	8	Added for future release. Not used now.
URL_RISK_SCORE †	hex	8	Added for future release. Not used now.
URL_CATEGORIES †	char	64	1 = Adult/Mature Content 3 = Pornography 4 = Sex Education 5 = Intimate Apparel/Swimsuit 6 = Nudity 7 = Gore/Extreme 9 = Scam/Questionable Legality 11 = Gambling 14 = Violence/Intolerance 15 = Weapons 16 = Abortion 17 = Hacking 18 = Phishing 20 = Entertainment 21 = Business/Economy 22 = Alternative Spirituality/Belief 23 = Alcohol 24 = Tobacco 25 = Controlled Substances 26 = Child Pornography 27 = Education 29 = Charitable/Non-Profit 30 = Art/Culture 31 = Finance 32 = Brokerage/Trading 33 = Games 34 = Government/Legal 35 = Military 36 = Political/Social Advocacy 37 = Health 38 = Technology/Internet 40 = Search Engines/Portals 43 = Malicious Sources/Malnets 44 = Malicious Outbound Data/Botnets 45 = Job Search/Careers 46 = News 47 = Personals/Dating 49 = Reference 50 = Mixed Content/Potentially Adult 51 = Chat (IM)/SMS 52 = Email 53 = Newsgroups/Forums 54 = Religion 55 = Social Networking 56 = File Storage/Sharing 57 = Remote Access 58 = Shopping 59 = Auctions 60 = Real Estate 61 = Society/Daily Living 63 = Personal Sites 64 = Restaurants/Food 65 = Sports/Recreation 66 = Travel 67 = Vehicles 68 = Humor/Jokes 71 = Software Downloads 83 = Peer-to-Peer (P2P) 84 = Audio/Video Clips 85 = Office/Business Applications 86 = Proxy Avoidance 87 = For Kids 88 = Web Ads/Analytics 89 = Web Hosting 90 = Uncategorized 92 = Suspicious 93 = Sexual Expression 95 = Translation 96 = Web Infrastructure 97 = Content Delivery Networks 98 = Placeholders 101 = Spam 102 = Potentially Unwanted Software 103 = Dynamic DNS Host 104 = URL Shorteners 105 = Email Marketing 106 = E-Card/Invitations 107 = Informational 108 = Computer/Information Security 109 = Internet Connected Devices 110 = Internet Telephony 111 = Online Meetings 112 = Media Sharing 113 = Radio/Audio Streams 114 = TV/Video Streams 116 = Cloud Infrastructure 117 = Cryptocurrency 118 = Piracy/Copyright Concerns 121 = Marijuana 124 = Compromised Sites

* SEP14.2.1
† SEP14.3.0.1

Your AV is Trying to Tell You Something: syslog.log

Client Management System Log

The system log contains system traffic that occur on the endpoint. This includes installation, service, configuration, host integrity, import, client, server, policy, antivirus engine, licensing, security, submission, and other events. The Windows client will show you the Date and Time, Severity, Summary, and Description. But what you are missing is the Event ID, Event Source, Location, and the log line. On the plus side though, it is one of the more human readable logs.

System Log File Format

The system log for SEP can be found at the following location:
C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\syslog.log

Header

The syslog.log file contains a tab separated header containing the following information:

Field	Type	Size	Description
Log Type	hex	8	Always 00000000
Max Log Size	hex	8	Maximum log file size in bytes
Unknown	hex	8	?
Number of Entries	hex	8	Number of entries in log
Unknown	hex	8	?
Running Total Entries	hex	16	Total number of events generated
Max Log Days	hex	8	Maximun days to save log entries

Log Entries

The log is in TSV format, meaning, each field is separated by a tab character. The following information can be found in the event entries:

Field	Type	Size	Description
Entry Length	hex	8	Length of log entry
Date and Time	Windows: 64 bit Hex Value - Big Endian	16	The time of the generated event (GMT).
Event ID	hex	8	An event ID sent by a managed client. Installation events Possible values are: 0x12070001 = Internal error 0x12070101 = Install complete 0x12070102 = Restart recommended 0x12070103 = Restart required 0x12070104 = Installation failed 0x12070105 = Uninstallation complete 0x12070106 = Uninstallation failed 0x12071037 = Symantec Endpoint Protection installed 0x12071038 = Symantec Firewall installed 0x12071039 = Uninstall 0x1207103A = Uninstall rolled-back Service events Possible values are: 0x12070201 = Service starting 0x12070202 = Service started 0x12070203 = Service start failure 0x12070204 = Service stopped 0x12070205 = Service stop failure 0x1207021A = Attempt to stop service Configuration events Possible values are: 0x12070206 = Config import complete 0x12070207 = Config import error 0x12070208 = Config export complete 0x12070209 = Config export error Host Integrity events Possible values are: 0x12070210 = Host Integrity disabled 0x12070211 = Host Integrity enabled 0x12070220 = NAP integration enabled Import events Possible values are: 0x12070214 = Successfully imported advanced rule 0x12070215 = Failed to import advanced rule 0x12070216 = Successfully exported advanced rule 0x12070217 = Failed to export advanced rule 0x1207021B = Imported sylink Client events Possible values are: 0x12070218 = Client Engine enabled 0x12070219 = Client Engine disabled 0x12071046 = Proactive Threat Scanning is not supported on this platform 0x12071047 = Proactive Threat Scanning load error 0x12071048 = SONAR content load error 0x12071049 = Allow application Server events Possible values are: 0x12070301 = Server connected 0x12070302 = No server response 0x12070303 = Server connection failed 0x12070304 = Server disconnected 0x120B0001 = Cannot reach server 0x120B0002 = Reconnected to the server 0x120b0003 = Automatic upgrade complete Policy events Possible values are: 0x12070306 = New policy received 0x12070307 = New policy applied 0x12070308 = New policy failed 0x12070309 = Cannot download policy 0x120B0005 = Cannot download policy 0x1207030A = Have latest policy 0x120B0004 = Have latest policy Antivirus engine events Possible values are: 0x12071006 = Scan omission 0x12071007 = Definition file loaded 0x1207100B = Virus behavior detected 0x1207100C = Configuration changed 0x12071010 = Definition file download 0x12071012 = Sent to quarantine server 0x12071013 = Delivered to Symantec 0x12071014 = Security Response backup 0x12071015 = Scan aborted 0x12071016 = Symantec Endpoint Protection Auto-Protect Load error 0x12071017 = Symantec Endpoint Protection Auto-Protect enabled 0x12071018 = Symantec Endpoint Protection Auto-Protect disabled 0x1207101A = Scan delayed 0x1207101B = Scan restarted 0x12071027 = Symantec Endpoint Protection is using old virus definitions 0x12071041 = Scan suspended 0x12071042 = Scan resumed 0x12071043 = Scan duration too short 0x12071045 = Scan enhancements failed Licensing events Possible values are: 0x1207101E = License warning 0x1207101F = License error 0x12071020 = License in grace period 0x12071023 = License installed 0x12071025 = License up-to-date Security events Possible values are: 0x1207102B = Computer not compliant with security policy 0x1207102C = Computer compliant with security policy 0x1207102D = Tamper attempt 0x12071034 = Login failed 0x12071035 = Login succeeded Submission events Possible values are: 0x12120001 = System message from centralized reputation 0x12120002 = Authentication token failure 0x12120003 = Reputation failure 0x12120004 = Reputation network failure 0x12130001 = System message from Submissions 0x12130002 = Submissions failure 0x12130003 = Intrusion prevention submission 0x12130004 = Antivirus detection submission 0x12130005 = Antivirus advanced heuristic detection submission 0x12130006 = Manual user submission 0x12130007 = SONAR heuristic submission 0x12130008 = SONAR detection submission 0x12130009 = File Reputation submission 0x1213000A = Client authentication token request 0x1213000B = LiveUpdate error submission 0x1213000C = Process data submission 0x1213000D = Configuration data submission 0x1213000E = Network data submission Other events Possible values are: 0x1207020A = Email post OK 0x1207020B = Email post failure 0x1207020C = Update complete 0x1207020D = Update failure 0x1207020E = Manual location change 0x1207020F = Location changed 0x12070212 = Old rasdll version detected 0x12070213 = Auto-update postponed 0x12070305 = Mode changed 0x1207030B = Cannot apply HI script 0x1207030C = Content Update Server 0x1207030D = Content Update Packet 0x12070500 = System message from device control 0x12070600 = System message from anti-buffer overflow driver 0x12070700 = System message from network access component 0x12070800 = System message from LiveUpdate 0x12070900 = System message from GUP 0x12072000 = System message from Memory Exploit Mitigation 0x12072009 = Intensive Protection disabled 0x1207200A = Intensive Protection enabled 0x12071021 = Access denied warning 0x12071022 = Log forwarding error 0x12071044 = Client moved 0x12071036 = Access denied warning 0x12071000 = Message from Intrusion Prevention 0x12071050 = SONAR disabled 0x12071051 = SONAR enabled
Unknown	hex	8	Will require further investigation as to the purpose of this log entry.
Severity	hex	8	The type of event. (0 = Info, 1 = Warning, 2 = Error, 3 = Fatal)
Data Size	hex	8	Length of data field
Summary/Description	nvarchar	2048	Description of the event. Usually, the first line of the description is treated as the summary.
Event Source	nvarchar	32	Type of event (CVE, Smc, IPS, SONAR, REP)
Data/Log Line	varbinary	2000	Additional data in binary format. This field is optional.
Location	nvarchar	512	The location used when the event occured.