Syslog Common Event Format

The Common Event Format (CEF) is an ArcSight standard that aligns the output format of various technology vendors into a common form.

Carbon Black EDR watchlist syslog output supports fully-templated formats, enabling easy modification of the template to match the CEF-defined format.