The SecurityID is in the Security Definition message (
35=d). This is reference data and is separate from the Incremental Refresh message (
35=X) that contains the live market data. You'll need to listen to a special IP address to get these messages. (See the config file for the Instrument Replay.)
The Security Definition will tell you symbol, asset class, exchange, expiration, and anything else you may wish to know.
It is also possible to statically get the security definition file, but CME cautions against using this:
This file is static and not refreshed throughout the trading day. It should NOT BE USED as the primary source for Security Definition information. Best practices require that CME Globex users obtain all Security Definition information from the Incremental Data channel or the Instrument Definition loop channel to ensure that intra-day instrument additions are not missed.