ArcSight CEF format uses the Syslog message protocol as a transport mechanism.

The format of the message is:

Date-Time host CEF:Version|Device Vendor|Device Product|Device Version|

Each message includes a common prefix consisting of the message date and time, the hostname of the server from which it was sent, and "CEF:" plus the version of CEF format. The remainder of the message is formatted into event-specific fields delimited by a bar ("|") character.

The following example illustrates a CEF-formatted message using Syslog output from App Control:

Sep 19 08:26:10 server3.mycorp.local CEF:0|VMware Carbon Black|App Control
||801|Execution block (unapproved file)|5| dst= 
duser=NTAUTHORITY\SYSTEM msg=File 'itunessetup64.exe' has been blocked because it was unapproved.

CEF-formatted messages in Syslog output from App Control