Page Comparison

...

The tags beginning with cef0.extrahopf5 identify events in CEF format generated by ESET F5.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

Tags	Data tables
`cef0.f5.asm`	`cef0.eset.esetManagementConsolef5.asm`
`cef0.f5.bigIp`	`cef0.esetf5.esetManagementConsolebigIp`

How is the data sent to Devo?

...

These are the fields displayed in this table:

...

these tables:

cef0.f5.asm
cef0.f5.bigIp

Anchor
tag1
tag1
cef0.f5.asm

Field	Type	Source field name	Extra fields
eventdate	`timestamp`


hostname	`str`


priorityCode	`str`


cefTag	`str`


cefVersion	`str`


embDeviceVendor	`str`


embDeviceProduct	`str`


deviceVersion	`str`


signatureID	`str`


name	`str`

cs2Label

str

cs5Label

str

dhost

str

cs2

str

shost

str

src

ip4

act

str

cs5

str

in

int8

cs6Label

str

cs1Label

str

dtz

str

sourceZoneID

str

slong

str

deviceZoneID

str

eventAnnotationAuditTrail

str

eventAnnotationVersion

str

eventAnnotationModificationTime

str

art

str

originalAgentAddress

str

eventId

str

at

str

mrt

str

customerURI

str

dlat

str

originalAgentZoneURI

str

sourceZoneURI

str

assetCriticality

str

destinationZoneID

str

eventAnnotationFlags

str

agt

str

modelConfidence

str

aid

str

amac

str

slat

str

Severity

str

relevance

str

av

str

eventAnnotationStageUpdateTime

str

locality

str

ahost

str

originalAgentVersion

str

customerID

str

dlong

str

atz

str

originalAgentMacAddress

str

originalAgentType

str

deviceSeverity

str

originalAgentId

str

eventAnnotationManagerReceiptTime

str

originalAgentHostName

str

priority

str

deviceZoneURI

str

eventAnnotationEndTime

str

destinationZoneURI

str

hostchain

str

✓


severity	`str`

_cefVer

str

dvc

ip4

cs3Label

str

filePath

str

msg

str

cs4Label

str

cs3

str

cs1

str

dst

ip4

request

str

cs6

str

fileHash

str

rt

timestamp

cs4

str

fname

str

out

int8

_cefVer	`str`
act	`str`
app	`str`
c6a1Label	`str`
c6a1	`str`
c6a2Label	`str`
c6a2	`str`
c6a3Label	`str`
c6a3	`str`
c6a4Label	`str`
c6a4	`str`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
deviceCustomDate1Label	`str`
deviceCustomDate1	`timestamp`
deviceExternalId	`str`
dst	`ip4`
dpt	`int4`
dvchost	`str`
dvc	`ip4`
externalId	`str`
msg	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
src	`ip4`
spt	`int4`
suid	`str`
suser	`str`
microservice	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`

Anchor
tag2
tag2
cef0.f5.bigIp

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a1Label	`str`
c6a1	`str`
c6a2Label	`str`
c6a2	`str`
c6a3Label	`str`
c6a3	`str`
c6a4Label	`str`
c6a4	`str`
cfp1Label	`str`
cfp1	`float8`
cfp2Label	`str`
cfp2	`float8`
cfp3Label	`str`
cfp3	`float8`
cfp4Label	`str`
cfp4	`float8`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationDnsDomain	`str`
destinationServiceName	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceCustomDate1Label	`str`
deviceCustomDate1	`timestamp`
deviceCustomDate2Label	`str`
deviceCustomDate2	`timestamp`
deviceDirection	`int4`
deviceDnsDomain	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceMacAddress	`str`
deviceNtDomain	`str`
deviceOutboundInterface	`str`
deviceProcessName	`str`
deviceTranslatedAddress	`ip4`
dhost	`str`
dmac	`str`
dntdom	`str`
dpid	`int4`
dpriv	`str`
dproc	`str`
dst	`ip4`
duid	`str`
duser	`str`
dvchost	`str`
dvc	`ip4`
dvcpid	`int4`
end	`timestamp`
deviceFacility	`str`
externalId	`str`
fileCreateTime	`timestamp`
fileHash	`str`
fileId	`str`
fileModificationTime	`timestamp`
filePath	`str`
filePermission	`str`
fileType	`str`
fname	`str`
fsize	`int8`
in	`int8`
msg	`str`
oldFileCreateTime	`timestamp`
oldFileHash	`str`
oldFileId	`str`
oldFileModificationTime	`timestamp`
oldFileName	`str`
oldFilePath	`str`
oldFilePermission	`str`
oldFileSize	`int8`
oldFileType	`str`
outcome	`str`
out	`int8`
proto	`str`
reason	`str`
requestClientApplication	`str`
requestCookies	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
shost	`str`
smac	`str`
sntdom	`str`
sourceDnsDomain	`str`
sourceServiceName	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spid	`int4`
spriv	`str`
sproc	`str`
spt	`int4`
src	`ip4`
start	`timestamp`
suid	`str`
suser	`str`
catdt	`str`
deviceDomain	`str`
deviceSeverity	`str`
dpt	`int4`
dtz	`str`
dvcmac	`str`
endTime	`str`
eventId	`str`
flexNumber1	`str`
flexNumber1Label	`str`
flexNumber2	`str`
flexNumber2Label	`str`
flexString1	`str`
flexString1Label	`str`
flexString2	`str`
flexString2Label	`str`
modelConfidence	`int4`
priority	`int4`
relevance	`int4`
requestContext	`str`
sessionId	`str`
slat	`float8`
slong	`float8`
dlat	`float8`
dlong	`float8`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
agt	`ip4`
ahost	`str`
art	`str`
atz	`str`
mrt	`timestamp`
categoryBehavior	`str`
categoryCustomFormatField	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
categoryTechnique	`str`
categoryTupleDescription	`str`
assetCriticality	`str`
customerID	`str`
customerURI	`str`
tag	`str`	cefTag	✓
rawMessage	`str`

	✓
hostchain	`str`

Versions Compared

Old Version 1

New Version Current

Key

Tag structure

How is the data sent to Devo?

Anchor
tag1
tag1
cef0.f5.asm

Anchor
tag2
tag2
cef0.f5.bigIp

Page Comparison

Versions Compared

Old Version 1

New Version Current

Key

Tag structure

How is the data sent to Devo?

Anchortag1tag1cef0.f5.asm

Anchortag2tag2cef0.f5.bigIp

Anchor
tag1
tag1
cef0.f5.asm

Anchor
tag2
tag2
cef0.f5.bigIp