Message Format

ArcSight CEF format uses the Syslog message protocol as a transport mechanism.

The format of the message is:

Date-Time host CEF:Version|Device Vendor|Device Product|Device Version|
SignatureID|Name|Severity|Extension

Each message includes a common prefix consisting of the message date and time, the hostname of the server from which it was sent, and "CEF:" plus the version of CEF format. The remainder of the message is formatted into event-specific fields delimited by a bar ("|") character.

The following example illustrates a CEF-formatted message using Syslog output from App Control:

Sep 19 08:26:10 server3.mycorp.local CEF:0|VMware Carbon Black|App Control
|8.1.0.899|801|Execution block (unapproved file)|5| dst=10.0.0.1 
duser=NTAUTHORITY\SYSTEM msg=File 'itunessetup64.exe' has been blocked because it was unapproved.