Page Comparison

Table of Contents

maxLevel	2
minLevel	2
type	flat

Introduction

The tables cef0.kaspersky.* identify events in CEF format generated by Kaspersky services.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

Tag

Data table

Tags	Data tables
`cef0.kaspersky.kaspersky`	`cef0.kaspersky.kaspersky`
`cef0.kaspersky.kasperskyAntivirusForWindowsServersEnterpriseEdition`	`cef0.kaspersky.kasperskyAntivirusForWindowsServersEnterpriseEdition`
`cef0.kaspersky.kasperskyEndpointSecurityForWindows`	`cef0.kaspersky.kasperskyEndpointSecurityForWindows`
`cef0.kaspersky.securityCenter`	`cef0.kaspersky.securityCenter`
`cef0.kaspersky.securityCenterNetworkAgent`	`cef0.kaspersky.securityCenterNetworkAgent`
`cef0.kasperskylab.securitycenter`	`cef0.kasperskylab.securitycenter`

cef0.kaspersky.

...

kaspersky
cef0.kaspersky.kasperskyAntivirusForWindowsServersEnterpriseEdition
cef0.kaspersky.kasperskyEndpointSecurityForWindows
cef0.kaspersky.securityCenter
cef0.kaspersky.securityCenterNetworkAgent
cef0.kasperskylab.

...

securitycenter

Anchor
tag1
tag1
cef0.kaspersky.kaspersky

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a1Label	`str`
c6a1	`str`
c6a2Label	`str`
c6a2	`str`
c6a3Label	`str`
c6a3	`str`
c6a4Label	`str`
c6a4	`str`
cfp1Label	`str`
cfp1	`float8`
cfp2Label	`str`
cfp2	`float8`
cfp3Label	`str`
cfp3	`float8`
cfp4Label	`str`
cfp4	`float8`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationDnsDomain	`str`
destinationServiceName	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceCustomDate1Label	`str`
deviceCustomDate1	`timestamp`
deviceCustomDate2Label	`str`
deviceCustomDate2	`timestamp`
deviceDirection	`int4`
deviceDnsDomain	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceMacAddress	`str`
deviceNtDomain	`str`
deviceOutboundInterface	`str`
deviceProcessName	`str`
deviceTranslatedAddress	`ip4`
dhost	`str`
dmac	`str`
dntdom	`str`
dpid	`int4`
dpriv	`str`
dproc	`str`
dst	`ip4`
duid	`str`
duser	`str`
dvchost	`str`
dvc	`ip4`
dvcpid	`int4`
end	`timestamp`
deviceFacility	`str`
externalId	`str`
fileCreateTime	`timestamp`
fileHash	`str`
fileId	`str`
fileModificationTime	`timestamp`
filePath	`str`
filePermission	`str`
fileType	`str`
fname	`str`
fsize	`int8`
in	`int8`
msg	`str`
oldFileCreateTime	`timestamp`
oldFileHash	`str`
oldFileId	`str`
oldFileModificationTime	`timestamp`
oldFileName	`str`
oldFilePath	`str`
oldFilePermission	`str`
oldFileSize	`int8`
oldFileType	`str`
outcome	`str`
out	`int8`
proto	`str`
reason	`str`
requestClientApplication	`str`
requestCookies	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
shost	`str`
smac	`str`
sntdom	`str`
sourceDnsDomain	`str`
sourceServiceName	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spid	`int4`
spriv	`str`
sproc	`str`
spt	`int4`
src	`ip4`
start	`timestamp`
suid	`str`
suser	`str`
catdt	`str`
deviceDomain	`str`
deviceSeverity	`str`
dpt	`int4`
dtz	`str`
dvcmac	`str`
endTime	`str`
eventId	`str`
flexNumber1	`str`
flexNumber1Label	`str`
flexNumber2	`str`
flexNumber2Label	`str`
flexString1	`str`
flexString1Label	`str`
flexString2	`str`
flexString2Label	`str`
modelConfidence	`int4`
priority	`int4`
relevance	`int4`
requestContext	`str`
sessionId	`str`
slat	`float8`
slong	`float8`
dlat	`float8`
dlong	`float8`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
agt	`ip4`
ahost	`str`
art	`str`
atz	`str`
mrt	`timestamp`
categoryBehavior	`str`
categoryCustomFormatField	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
categoryTechnique	`str`
categoryTupleDescription	`str`
assetCriticality	`str`
customerID	`str`
customerURI	`str`
tag	`str`	cefTag	✓
rawMessage	`str`		✓
hostchain	`str`		✓

Anchor
tag2
tag2
cef0.kaspersky.kasperskyAntivirusForWindowsServersEnterpriseEdition

Anchor

...

cef0.kaspersky.kasperskyAntivirusForWindowsServersEnterpriseEdition

...

cef0.kaspersky.kasperskyEndpointSecurityForWindows

...

cef0.kaspersky.kasperskyEndpointSecurityForWindows

How is the data sent to Devo?

...

tag3
tag3
cef0.kaspersky.kasperskyEndpointSecurityForWindows

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
dntdom	`str`
cs3Label	`str`
msg	`str`
dvchost	`str`
cs4Label	`str`
cs1	`str`
dst	`ip4`
externalId	`int8`
cn3Label	`str`
cat	`str`
cs6	`str`
rt	`timestamp`
end	`timestamp`
fname	`str`
out	`int8`
cs2Label	`str`
cs5Label	`str`
dhost	`str`
act	`str`
in	`int8`
cs6Label	`str`
cn3	`int8`
cs1Label	`str`
dtz	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationVersion	`str`
eventAnnotationModificationTime	`str`
art	`str`
originalAgentAddress	`str`
eventId	`str`
at	`str`
mrt	`str`
customerURI	`str`
dlat	`str`
originalAgentZoneURI	`str`
destinationZoneID	`str`
assetCriticality	`str`
eventAnnotationFlags	`str`
agt	`str`
modelConfidence	`str`
aid	`str`
amac	`str`
Severity	`str`
destinationZoneExternalID	`str`
relevance	`str`
av	`str`
eventAnnotationStageUpdateTime	`str`
catdt	`str`
locality	`str`
ahost	`str`
originalAgentVersion	`str`
customerID	`str`
dlong	`str`
atz	`str`
originalAgentMacAddress	`str`
originalAgentType	`str`
deviceSeverity	`str`
flexString1	`str`
originalAgentId	`str`
eventAnnotationManagerReceiptTime	`str`
originalAgentHostName	`str`
priority	`str`
eventAnnotationEndTime	`str`
destinationZoneURI	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
tag4
tag4
cef0.kaspersky.securityCenter

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a1Label	`str`
c6a1	`str`
c6a2Label	`str`
c6a2	`str`
c6a3Label	`str`
c6a3	`str`
c6a4Label	`str`
c6a4	`str`
cfp1Label	`str`
cfp1	`float8`
cfp2Label	`str`
cfp2	`float8`
cfp3Label	`str`
cfp3	`float8`
cfp4Label	`str`
cfp4	`float8`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationDnsDomain	`str`
destinationServiceName	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceCustomDate1Label	`str`
deviceCustomDate1	`timestamp`
deviceCustomDate2Label	`str`
deviceCustomDate2	`timestamp`
deviceDirection	`int4`
deviceDnsDomain	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceMacAddress	`str`
deviceNtDomain	`str`
deviceOutboundInterface	`str`
deviceProcessName	`str`
deviceTranslatedAddress	`ip4`
dhost	`str`
dmac	`str`
dntdom	`str`
dpid	`int4`
dpriv	`str`
dproc	`str`
dst	`ip4`
duid	`str`
duser	`str`
dvchost	`str`
dvc	`ip4`
dvcpid	`int4`
end	`timestamp`
deviceFacility	`str`
externalId	`str`
fileCreateTime	`timestamp`
fileHash	`str`
fileId	`str`
fileModificationTime	`timestamp`
filePath	`str`
filePermission	`str`
fileType	`str`
fname	`str`
fsize	`int8`
in	`int8`
msg	`str`
oldFileCreateTime	`timestamp`
oldFileHash	`str`
oldFileId	`str`
oldFileModificationTime	`timestamp`
oldFileName	`str`
oldFilePath	`str`
oldFilePermission	`str`
oldFileSize	`int8`
oldFileType	`str`
outcome	`str`
out	`int8`
proto	`str`
reason	`str`
requestClientApplication	`str`
requestCookies	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
shost	`str`
smac	`str`
sntdom	`str`
sourceDnsDomain	`str`
sourceServiceName	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spid	`int4`
spriv	`str`
sproc	`str`
spt	`int4`
src	`ip4`
start	`timestamp`
suid	`str`
suser	`str`
catdt	`str`
deviceDomain	`str`
deviceSeverity	`str`
dpt	`int4`
dtz	`str`
dvcmac	`str`
endTime	`str`
eventId	`str`
flexNumber1	`str`
flexNumber1Label	`str`
flexNumber2	`str`
flexNumber2Label	`str`
flexString1	`str`
flexString1Label	`str`
flexString2	`str`
flexString2Label	`str`
modelConfidence	`int4`
priority	`int4`
relevance	`int4`
requestContext	`str`
sessionId	`str`
slat	`float8`
slong	`float8`
dlat	`float8`
dlong	`float8`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
agt	`ip4`
ahost	`str`
art	`str`
atz	`str`
mrt	`timestamp`
categoryBehavior	`str`
categoryCustomFormatField	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
categoryTechnique	`str`
categoryTupleDescription	`str`
assetCriticality	`str`
customerID	`str`
customerURI	`str`
tag	`str`	cefTag	✓
rawMessage	`str`		✓
hostchain	`str`		✓

Anchor
tag5
tag5
cef0.kaspersky.securityCenterNetworkAgent

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a1Label	`str`
c6a1	`str`
c6a2Label	`str`
c6a2	`str`
c6a3Label	`str`
c6a3	`str`
c6a4Label	`str`
c6a4	`str`
cfp1Label	`str`
cfp1	`float8`
cfp2Label	`str`
cfp2	`float8`
cfp3Label	`str`
cfp3	`float8`
cfp4Label	`str`
cfp4	`float8`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationDnsDomain	`str`
destinationServiceName	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceCustomDate1Label	`str`
deviceCustomDate1	`timestamp`
deviceCustomDate2Label	`str`
deviceCustomDate2	`timestamp`
deviceDirection	`int4`
deviceDnsDomain	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceMacAddress	`str`
deviceNtDomain	`str`
deviceOutboundInterface	`str`
deviceProcessName	`str`
deviceTranslatedAddress	`ip4`
dhost	`str`
dmac	`str`
dntdom	`str`
dpid	`int4`
dpriv	`str`
dproc	`str`
dst	`ip4`
duid	`str`
duser	`str`
dvchost	`str`
dvc	`ip4`
dvcpid	`int4`
end	`timestamp`
deviceFacility	`str`
externalId	`str`
fileCreateTime	`timestamp`
fileHash	`str`
fileId	`str`
fileModificationTime	`timestamp`
filePath	`str`
filePermission	`str`
fileType	`str`
fname	`str`
fsize	`int8`
in	`int8`
msg	`str`
oldFileCreateTime	`timestamp`
oldFileHash	`str`
oldFileId	`str`
oldFileModificationTime	`timestamp`
oldFileName	`str`
oldFilePath	`str`
oldFilePermission	`str`
oldFileSize	`int8`
oldFileType	`str`
outcome	`str`
out	`int8`
proto	`str`
reason	`str`
requestClientApplication	`str`
requestCookies	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
shost	`str`
smac	`str`
sntdom	`str`
sourceDnsDomain	`str`
sourceServiceName	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spid	`int4`
spriv	`str`
sproc	`str`
spt	`int4`
src	`ip4`
start	`timestamp`
suid	`str`
suser	`str`
catdt	`str`
deviceDomain	`str`
deviceSeverity	`str`
dpt	`int4`
dtz	`str`
dvcmac	`str`
endTime	`str`
eventId	`str`
flexNumber1	`str`
flexNumber1Label	`str`
flexNumber2	`str`
flexNumber2Label	`str`
flexString1	`str`
flexString1Label	`str`
flexString2	`str`
flexString2Label	`str`
modelConfidence	`int4`
priority	`int4`
relevance	`int4`
requestContext	`str`
sessionId	`str`
slat	`float8`
slong	`float8`
dlat	`float8`
dlong	`float8`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
agt	`ip4`
ahost	`str`
art	`str`
atz	`str`
mrt	`timestamp`
categoryBehavior	`str`
categoryCustomFormatField	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
categoryTechnique	`str`
categoryTupleDescription	`str`
assetCriticality	`str`
customerID	`str`
customerURI	`str`
tag	`str`	cefTag	✓
rawMessage	`str`		✓
hostchain	`str`		✓

Anchor
tag6
tag6
cef0.kasperskylab.securitycenter

Field

Type

Field transformation

Source field name

Extra fields

eventdate

timestamp

srcIp

ip4

Code Block
ip4(split(split(hostchain, "/")[0], "=")[1])

hostchain

priorityCode

str

cefTag

str

cefVersion

str

embDeviceVendor

str

embDeviceProduct

str

deviceVersion

str

signatureID

str

name

str

severity

str

_cefVer

str

act

str

app

str

cat

str

c6a1Label

str

c6a1

str

c6a2Label

str

c6a2

str

c6a3Label

str

c6a3

str

c6a4Label

str

c6a4

str

cfp1Label

str

cfp1

float8

cfp2Label

str

cfp2

float8

cfp3Label

str

cfp3

float8

cfp4Label

str

cfp4

float8

cn1Label

str

cn1

int8

cn2Label

str

cn2

int8

cn3Label

str

cn3

int8

cnt

int4

cs1Label

str

cs1

str

cs2Label

str

cs2

str

cs3Label

str

cs3

str

cs4Label

str

cs4

str

cs5Label

str

cs5

str

cs6Label

str

cs6

str

destinationDnsDomain

str

destinationServiceName

str

destinationTranslatedAddress

ip4

destinationTranslatedPort

int4

deviceCustomDate1Label

str

deviceCustomDate1

timestamp

deviceCustomDate2Label

str

deviceCustomDate2

timestamp

deviceDirection

int4

deviceDnsDomain

str

deviceExternalId

str

deviceInboundInterface

str

deviceMacAddress

str

deviceNtDomain

str

deviceOutboundInterface

str

deviceProcessName

str

deviceTranslatedAddress

ip4

dhost

str

dmac

str

dntdom

str

dpid

int4

dpriv

str

dproc

str

dst

ip4

duid

str

duser

str

dvchost

str

dvc

ip4

dvcpid

int4

end

timestamp

deviceFacility

str

externalId

str

fileCreateTime

timestamp

fileHash

str

fileId

str

fileModificationTime

timestamp

filePath

str

filePermission

str

fileType

str

fname

str

fsize

int8

in

int8

msg

str

oldFileCreateTime

timestamp

oldFileHash

str

oldFileId

str

oldFileModificationTime

timestamp

oldFileName

str

oldFilePath

str

oldFilePermission

str

oldFileSize

int8

oldFileType

str

outcome

str

out

int8

proto

str

reason

str

requestClientApplication

str

requestCookies

str

requestMethod

str

request

str

rt

timestamp

shost

str

smac

str

sntdom

str

sourceDnsDomain

str

sourceServiceName

str

sourceTranslatedAddress

ip4

sourceTranslatedPort

int4

spid

int4

spriv

str

sproc

str

spt

int4

src

ip4

start

timestamp

suid

str

suser

str

catdt

str

deviceDomain

str

deviceSeverity

str

dpt

int4

dtz

str

dvcmac

str

endTime

str

eventId

str

flexNumber1

str

flexNumber1Label

str

flexNumber2

str

flexNumber2Label

str

flexString1

str

flexString1Label

str

flexString2

str

flexString2Label

str

modelConfidence

int4

priority

int4

relevance

int4

requestContext

str

sessionId

str

slat

float8

slong

float8

dlat

float8

dlong

float8

sourceGeoCountryCode

str

sourceGeoLocationInfo

str

sourceGeoPostalCode

str

sourceGeoRegionCode

str

destinationGeoCountryCode

str

destinationGeoLocationInfo

str

destinationGeoPostalCode

str

destinationGeoRegionCode

str

agt

ip4

ahost

str

art

str

atz

str

mrt

timestamp

categoryBehavior

str

categoryCustomFormatField

str

categoryDeviceGroup

str

categoryObject

str

categoryOutcome

str

categorySignificance

str

categoryTechnique

str

categoryTupleDescription

str

assetCriticality

str

customerID

str

customerURI

str

tag

str

cefTag

✓

rawMessage

str

✓

hostchain

str

✓

Versions Compared

Old Version 2

New Version Current

Key

Introduction

Tag structure

Anchor
tag1
tag1
cef0.kaspersky.kaspersky

Anchor
tag2
tag2
cef0.kaspersky.kasperskyAntivirusForWindowsServersEnterpriseEdition

Anchor

How is the data sent to Devo?

tag3
tag3
cef0.kaspersky.kasperskyEndpointSecurityForWindows

Anchor
tag4
tag4
cef0.kaspersky.securityCenter

Anchor
tag5
tag5
cef0.kaspersky.securityCenterNetworkAgent

Anchor
tag6
tag6
cef0.kasperskylab.securitycenter

Page Comparison

Versions Compared

Old Version 2

New Version Current

Key

Introduction

Tag structure

Anchortag1tag1cef0.kaspersky.kaspersky

Anchortag2tag2cef0.kaspersky.kasperskyAntivirusForWindowsServersEnterpriseEdition

Anchor

How is the data sent to Devo?

tag3tag3cef0.kaspersky.kasperskyEndpointSecurityForWindows

Anchortag4tag4cef0.kaspersky.securityCenter

Anchortag5tag5cef0.kaspersky.securityCenterNetworkAgent

Anchortag6tag6cef0.kasperskylab.securitycenter

Anchor
tag1
tag1
cef0.kaspersky.kaspersky

Anchor
tag2
tag2
cef0.kaspersky.kasperskyAntivirusForWindowsServersEnterpriseEdition

tag3
tag3
cef0.kaspersky.kasperskyEndpointSecurityForWindows

Anchor
tag4
tag4
cef0.kaspersky.securityCenter

Anchor
tag5
tag5
cef0.kaspersky.securityCenterNetworkAgent

Anchor
tag6
tag6
cef0.kasperskylab.securitycenter