Content Comparison

...

How is the data sent to Devo?

CEF data can be sent directly to Devo or by using a relay. To use the CEF default relay rule, send to the relay’s port 13000. Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Table structure

These are the fields displayed in these tables:

...

Anchor
tag1
tag1
cef0.fireeye.cms

Field

Type

Field transformation

Source field name

Extra fields

eventdate

timestamp

hostname

str

cefTag

str

cefVersion

str

embDeviceVendor

str

embDeviceProduct

str

deviceVersion

str

signatureID

str

name

str

severity

str

rt

timestamp

Code Block
(rt_aux -> 'UTC') ? parsedate(split(rt_aux, " UTC", 0), dateformat("MMM DD YYYY HH:mm:ss", "UTC", "en-US")) : null('')

rt_aux

src

ip4

cn3Label

str

cn3

int8

cn2Label

str

cn2

int8

proto

str

spt

int4

dst

ip4

cs5Label

str

cs5

ip4

dvchost

str

dvc

ip4

smac

str

cn1Label

str

cn1

int8

dpt

str

externalId

str

cs4Label

str

cs4

str

act

str

cs6Label

str

cs6

str

dmac

str

cs1Label

str

cs1

str

devicePayloadId

str

start

timestamp

Code Block
(start_aux -> 'UTC') ? parsedate(split(start_aux, " UTC", 0), dateformat("MMM DD YYYY HH:mm:ss", "UTC", "en-US")) : null('')

start_aux

tag

str

cefTag

✓

rawMessage

str

✓

hostchain

str

✓

Anchor
tag2
tag2
cef0.fireeye.emps

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
id	`str`	externalId
malware	`str`	cs1
Sev	`str`
src	`ip4`
dst	`ip4`
url_mal	`str`	cs5
url_web	`str`	filePath
location	`str`
tag	`str`	cefTag	✓
rawMessage	`str`		✓
hostchain	`str`		✓

Anchor
tag3
tag3
cef0.fireeye.mas

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
dvchost	`str`
dvc	`ip4`
externalId	`int8`
fileHash	`str`
filePath	`str`
fileType	`str`
fname	`str`
fsize	`int8`
proto	`str`
rt	`str`
sproc	`str`
devicePayloadId	`str`
flexString1	`str`
flexString1Label	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
tag4
tag4
cef0.fireeye.mps

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
act	`str`
dvchost	`str`
flexString2	`str`
flexString2Label	`str`
msg	`str`
_cefVer	`str`
id	`str`	externalId
malware	`str`	cs1
Sev	`str`
src	`ip4`
dst	`ip4`
url_mal	`str`	cs5
url_web	`str`	filePath
location	`str`
tag	`str`	cefTag	✓
rawMessage	`str`		✓
hostchain	`str`		✓

Version	Old Version 1	New Version Current
Changes made by	Juan Tomás Alonso Nieto	Virginia Camuñas Núñez
Saved on	Oct 03, 2023	Feb 13, 2025

Versions Compared

Key

How is the data sent to Devo?

Table structure

Anchor
tag1
tag1
cef0.fireeye.cms

Anchor
tag2
tag2
cef0.fireeye.emps

Anchor
tag3
tag3
cef0.fireeye.mas

Anchor
tag4
tag4
cef0.fireeye.mps

Content Comparison

Versions Compared

Key

How is the data sent to Devo?

Table structure

Anchortag1tag1cef0.fireeye.cms

Anchortag2tag2cef0.fireeye.emps

Anchortag3tag3cef0.fireeye.mas

Anchortag4tag4cef0.fireeye.mps

Anchor
tag1
tag1
cef0.fireeye.cms

Anchor
tag2
tag2
cef0.fireeye.emps

Anchor
tag3
tag3
cef0.fireeye.mas

Anchor
tag4
tag4
cef0.fireeye.mps