Malware detection and prevention log (syslog CEF, event_id = Malware)

Type	Field	Name	Description
Date	_time	Time
String	event_name	Event name	e.g. Malware Created
String	risk	Risk	LOW, MEDIUM, HIGH
String	hostname	Machine name	e.g. PC-0001
String	signature	Malware name	e.g. AI.StaticAnalysis
String	action	Action	DETECT, BLOCK
String	file_path	File path	e.g. c:\users\user01\desktop\sample.exe
URL	xref	Reference URL	e.g. https://edr.example.com/#/s/search?queryString=0<-File[...]&rootType=File
String	sid	Signature ID	e.g. 123456789