Page Comparison

Table of Contents

maxLevel	2
minLevel	2
type	flat

Info
Check the reference vendor documentation here.

Introduction

The tables tags beginning with cef0.checkpoint.* identify events in CEF format generated by Check Point.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.<deviceVendor>deviceProduct.<deviceProduct>

In this case, the valid data tables are:

Tags	Devo tables
`cef0.checkPoint.anti-malware`	`cef0.checkPoint.antiMalware`
`cef0.checkPoint.anti-virus`	`cef0.checkPoint.antiVirus`
`cef0.checkPoint.applicationControl`	`cef0.checkPoint.applicationControl`
`cef0.checkPoint.applicationControlAndUrlFiltering`	`cef0.checkPoint.applicationControlAndUrlFiltering`
`cef0.checkPoint.cli`	`cef0.checkPoint.cli`
`cef0.checkPoint.clustermgmt`	`cef0.checkPoint.clustermgmt`
`cef0.checkPoint.compliance`	`cef0.checkPoint.compliance`
`cef0.checkPoint.complianceBlade`	`cef0.checkPoint.complianceBlade`
`cef0.checkPoint.connectra`	`cef0.checkPoint.connectra`
`cef0.checkPoint.contentAwareness`	`cef0.checkPoint.contentAwareness`
`cef0.checkPoint.contract_client`	`cef0.checkPoint.contract_client`
`cef0.checkPoint.cpmiClient`	`cef0.checkPoint.cpmiClient`
`cef0.checkPoint.endpointManagement`	`cef0.checkPoint.endpointManagement`
`cef0.checkPoint.endpointSecurityConsole`	`cef0.checkPoint.endpointSecurityConsole`
`cef0.checkPoint.esod`	`cef0.checkPoint.esod`
`cef0.checkPoint.eventiaAnalyzerClient`	`cef0.checkPoint.eventiaAnalyzerClient`
`cef0.checkPoint.fde`	`cef0.checkPoint.fde`
`cef0.checkPoint.fg`	`cef0.checkPoint.fg`
`cef0.checkPoint.firewall`	`cef0.checkPoint.firewall`
`cef0.checkPoint.firewall1`	`cef0.checkPoint.firewall1`
`cef0.checkPoint.fwm`	`cef0.checkPoint.fwm`
`cef0.checkPoint.gcli`	`cef0.checkPoint.gcli`
`cef0.checkPoint.httpsInspection`	`cef0.checkPoint.httpsInspection`
`cef0.checkPoint.identityAwareness`	`cef0.checkPoint.identityAwareness`
`cef0.checkPoint.identityLogging`	`cef0.checkPoint.identityLogging`
`cef0.checkPoint.ips`	`cef0.checkPoint.ips`
`cef0.checkPoint.licenseMgmt`	`cef0.checkPoint.licenseMgmt`
`cef0.checkPoint.lineEditor`	`cef0.checkPoint.lineEditor`
`cef0.checkPoint.logSystem`	`cef0.checkPoint.logSystem`
`cef0.checkPoint.log-update`	`cef0.checkPoint.logUpdate`
`cef0.checkPoint.logsIndexer`	`cef0.checkPoint.logsIndexer`
`cef0.checkPoint.managementBlade`	`cef0.checkPoint.managementBlade`
`cef0.checkPoint.mepp`	`cef0.checkPoint.mepp`
`cef0.checkPoint.new-anti-virus`	`cef0.checkPoint.newAntiVirus`
`cef0.checkPoint.noProduct`	`cef0.checkPoint.noProduct`
`cef0.checkPoint.none`	`cef0.checkPoint.none`
`cef0.checkPoint.policyServer`	`cef0.checkPoint.policyServer`
`cef0.checkPoint.queryDatabase`	`cef0.checkPoint.queryDatabase`
`cef0.checkPoint.rad`	`cef0.checkPoint.rad`
`cef0.checkPoint.scheduledSystemUpdate`	`cef0.checkPoint.scheduledSystemUpdate`
`cef0.checkPoint.securityGatewayManagement`	`cef0.checkPoint.securityGatewayManagement`
`cef0.checkPoint.securityManagementServer`	`cef0.checkPoint.securityManagementServer`
`cef0.checkPoint.smartconsole`	`cef0.checkPoint.smartconsole`
`cef0.checkPoint.smartdashboard`	`cef0.checkPoint.smartdashboard`
`cef0.checkPoint.smartdefense`	`cef0.checkPoint.smartdefense`
`cef0.checkPoint.smartdefenseAndVpn1Firewall1`	`cef0.checkPoint.smartdefenseAndVpn1Firewall1`
`cef0.checkPoint.smartdomainManager`	`cef0.checkPoint.smartdomainManager`
`cef0.checkPoint.smarteventClient`	`cef0.checkPoint.smarteventClient`
`cef0.checkPoint.smartupdate`	`cef0.checkPoint.smartupdate`
`cef0.checkPoint.smartview`	`cef0.checkPoint.smartview`
`cef0.checkPoint.smartviewMonitor`	`cef0.checkPoint.smartviewMonitor`
`cef0.checkPoint.smartviewTracker`	`cef0.checkPoint.smartviewTracker`
`cef0.checkPoint.stormagent`	`cef0.checkPoint.stormagent`
`cef0.checkPoint.system`	`cef0.checkPoint.system`
`cef0.checkPoint.system-monitor`	`cef0.checkPoint.systemMonitor`
`cef0.checkPoint.threatEmulation`	`cef0.checkPoint.threatEmulation`
`cef0.checkPoint.threatExtraction`	`cef0.checkPoint.threatExtraction`
`cef0.checkPoint.unknown`	`cef0.checkPoint.unknown`
`cef0.checkPoint.url-filtering`	`cef0.checkPoint.urlFiltering`
`cef0.checkPoint.vpn1`	`cef0.checkPoint.vpn1`
`cef0.checkPoint.vpn1EmbeddedConnector`	`cef0.checkPoint.vpn1EmbeddedConnector`
`cef0.checkPoint.vpn1-firewall-1`	`cef0.checkPoint.vpn1Firewall1`
`cef0.checkPoint.vpn-1-firewall-1-and-content-awareness`	`cef0.checkPoint.vpn1Firewall1AndContentAwareness`
`cef0.checkPoint.vpn1Firewall1Smartdefense`	`cef0.checkPoint.vpn1Firewall1Smartdefense`
`cef0.checkPoint.webUi`	`cef0.checkPoint.webUi`
`cef0.checkPoint.web_api`	`cef0.checkPoint.web_api`
`cef0.checkPoint.zeroPhishing`	`cef0.checkPoint.zeroPhishing`

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Table structure

These are the fields displayed in these tables:

Rw ui tabs macro

Rw tab

title	Tables 1-7

cef0.checkPoint.antiMalware
cef0.checkPoint.antiVirus
cef0.checkPoint.applicationControl
cef0.checkPoint.applicationControlAndUrlFiltering
cef0.checkPoint.firewall
cef0.checkPoint.ips
cef0.checkPoint.logUpdate

Anchor
cef0.checkPoint.antiMalware
cef0.checkPoint.antiMalware
cef0.checkPoint.antiMalware

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
c6a4Label	`str`
cs1Label	`str`
cs1	`str`
deviceDirection	`int4`
dvc	`ip4`
deviceFacility	`str`
msg	`str`
requestClientApplication	`str`
rt	`timestamp`
shost	`str`
src	`ip4`
suser	`str`
ad_action__details	`str`
ad_am__update__proxy	`str`
ad_am__update__source	`str`
ad_client__version	`str`
ad_cp__severity	`str`
ad_engine__ver	`str`
ad_event__type	`str`
ad_failed__updates	`str`
ad_host__type	`str`
ad_installed__products	`str`
ad_local__time	`str`
ad_loguid	`str`
ad_machine__guid	`str`
ad_origin	`str`
ad_os__name	`str`
ad_os__version	`str`
ad_policy__date	`str`
ad_policy__name	`str`
ad_policy__number	`str`
ad_product	`str`
ad_result	`str`
ad_sequencenum	`str`
ad_sig__ver	`str`
ad_user__name	`str`
ad_user__sid	`str`
ad_version	`str`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
customerURI	`str`
deviceSeverity	`str`
deviceZoneURI	`str`
dtz	`str`
eventId	`str`
geid	`str`
sourceZoneURI	`str`
act	`str`
alert	`str`
cnt	`int4`
contract_name	`str`
cp_severity	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs6Label	`str`
cs6	`str`
db_ver	`int8`
deviceCustomDate2Label	`str`
spt	`int4`
dpt	`int4`
dst	`ip4`
flexNumber1Label	`str`
flexNumber1	`int4`
flexString2Label	`str`
flexString2	`str`
ifname	`str`
lastupdatetime	`timestamp`
log_id	`str`
loguid	`str`
next_update_desc	`str`
origin	`ip4`
originsicname	`str`
in	`int8`
out	`int8`
packet_capture_name	`str`
packet_capture_time	`timestamp`
packet_capture_unique_id	`str`
policy	`str`
policy_time	`timestamp`
product	`str`
proto	`str`
reason	`str`
sequencenum	`str`
session_id	`str`
sourceServiceName	`str`
sourceTranslatedAddress	`ip4`
special_properties	`str`
version	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.antiVirus
cef0.checkPoint.antiVirus
cef0.checkPoint.antiVirus

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
deviceDirection	`int4`
msg	`str`
reason	`str`
rt	`timestamp`
alert	`str`
cp_severity	`str`
ifname	`str`
loguid	`str`
origin	`str`
product	`str`
sequencenum	`str`
version	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.applicationControl
cef0.checkPoint.applicationControl
cef0.checkPoint.applicationControl

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
proto	`str`
cs2	`str`
deviceDirection	`int4`
start	`timestamp`
dst	`ip4`
cnt	`int4`
dvc	`ip4`
src	`ip4`
act	`str`
cs5	`str`
in	`int8`
app	`str`
cs6	`str`
rt	`timestamp`
cs6Label	`str`
out	`int8`
cs2Label	`str`
cs5Label	`str`
destinationGeoCountryCode	`str`
categoryDeviceGroup	`str`
dtz	`str`
sourceZoneID	`str`
flexString1Label	`str`
deviceZoneID	`str`
slong	`str`
categoryObject	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationVersion	`str`
eventAnnotationModificationTime	`str`
art	`str`
categorySignificance	`str`
eventId	`str`
originalAgentAddress	`str`
dpt	`str`
at	`str`
mrt	`str`
customerURI	`str`
originalAgentZoneURI	`str`
dlat	`str`
sourceZoneURI	`str`
assetCriticality	`str`
destinationZoneID	`str`
eventAnnotationFlags	`str`
agt	`str`
categoryBehavior	`str`
modelConfidence	`str`
aid	`str`
amac	`str`
deviceZoneExternalID	`str`
slat	`str`
Severity	`str`
relevance	`str`
av	`str`
eventAnnotationStageUpdateTime	`str`
categoryOutcome	`str`
catdt	`str`
locality	`str`
ahost	`str`
originalAgentVersion	`str`
customerID	`str`
dlong	`str`
atz	`str`
originalAgentMacAddress	`str`
type	`str`
deviceSeverity	`str`
originalAgentType	`str`
flexString1	`str`
originalAgentId	`str`
eventAnnotationManagerReceiptTime	`str`
originalAgentHostName	`str`
priority	`str`
deviceZoneURI	`str`
eventAnnotationEndTime	`str`
destinationZoneURI	`str`
appCategory	`str`
appProperties	`str`
layerName	`str`
layerUUID	`str`
matchID	`int8`
parentRule	`int8`
ruleAction	`str`
ruleUID	`str`
cpAppRisk	`str`
connDirection	`str`
ifname	`str`
logid	`int8`
loguid	`str`
origin	`ip4`
originsicname	`str`
sequencenum	`int8`
version	`int8`
aggregatedLogCount	`int8`
browseTime	`int8`
bytes	`int8`
clientInboundPackets	`int8`
clientOutboundPackets	`int8`
clientTypeOS	`str`
connectionCount	`int8`
appID	`int8`
creationTime	`int8`
duration	`int8`
hllKey	`int8`
inzone	`str`
lastHitTime	`int8`
outzone	`str`
packets	`int8`
product	`str`
serverInboundBytes	`int8`
serverInboundPackets	`int8`
serverOutboundBytes	`int8`
serverOutboundPackets	`int8`
serviceID	`str`
sigID	`int8`
updateCount	`int8`
requestMethod	`str`
request	`str`
connectionLUUID	`str`
requestClientApplication	`str`
lastupdatetime	`int8`
msg	`str`
db_ver	`str`
deviceCustomDate2Label	`str`
cp_severity	`str`
appDesc	`str`
tag	`str`	cefTag	✓
hostchain	`str`		✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.applicationControlAndUrlFiltering
cef0.checkPoint.applicationControlAndUrlFiltering
cef0.checkPoint.applicationControlAndUrlFiltering

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
c6a4Label	`str`
cs2Label	`str`
cs2	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
deviceDirection	`int4`
dst	`ip4`
dpt	`int4`
duser	`str`
dvc	`ip4`
in	`int8`
out	`int8`
proto	`str`
requestClientApplication	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
shost	`str`
src	`ip4`
suser	`str`
ad_aggregated__log__count	`str`
ad_app__category	`str`
ad_app__desc	`str`
ad_app__id	`str`
ad_app__properties	`str`
ad_browse__time	`str`
ad_bytes	`str`
ad_client__inbound__packets	`str`
ad_client__outbound__packets	`str`
ad_conn__direction	`str`
ad_connection__count	`str`
ad_cp__app__risk	`str`
ad_creation__time	`str`
ad_duration	`str`
ad_hll__key	`str`
ad_https__inspection__action	`str`
ad_ifname	`str`
ad_last__hit__time	`str`
ad_layer__name	`str`
ad_layer__uuid	`str`
ad_logid	`str`
ad_loguid	`str`
ad_match__id	`str`
ad_origin	`str`
ad_originsicname	`str`
ad_packets	`str`
ad_parent__rule	`str`
ad_product	`str`
ad_rule__action	`str`
ad_rule__uid	`str`
ad_sequencenum	`str`
ad_server__inbound__bytes	`str`
ad_server__inbound__packets	`str`
ad_server__outbound__bytes	`str`
ad_server__outbound__packets	`str`
ad_service__id	`str`
ad_sig__id	`str`
ad_src__user__dn	`str`
ad_update__count	`str`
ad_version	`str`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
customerURI	`str`
destinationZoneURI	`str`
deviceSeverity	`str`
deviceZoneURI	`str`
dtz	`str`
eventId	`str`
flexString1	`str`
flexString1Label	`str`
geid	`str`
inzone	`str`
lastupdatetime	`str`
sourceZoneURI	`str`
outzone	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.firewall
cef0.checkPoint.firewall
cef0.checkPoint.firewall

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
c6a4Label	`str`
deviceDirection	`int4`
dvc	`ip4`
msg	`str`
outcome	`str`
rt	`timestamp`
ad_loguid	`str`
ad_origin	`str`
ad_originsicname	`str`
ad_product	`str`
ad_sequencenum	`str`
ad_update__service	`str`
ad_version	`str`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
catdt	`str`
customerURI	`str`
deviceSeverity	`str`
deviceZoneURI	`str`
dtz	`str`
eventId	`str`
geid	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.ips
cef0.checkPoint.ips
cef0.checkPoint.ips

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
deviceDirection	`int4`
msg	`str`
dvc	`ip4`
in	`int8`
rt	`timestamp`
out	`int8`
deviceCustomDate2Label	`str`
cs2Label	`str`
dtz	`str`
deviceZoneID	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationVersion	`str`
eventAnnotationModificationTime	`str`
art	`str`
originalAgentAddress	`str`
eventId	`str`
at	`str`
mrt	`str`
customerURI	`str`
originalAgentZoneURI	`str`
assetCriticality	`str`
eventAnnotationFlags	`str`
agt	`str`
modelConfidence	`str`
aid	`str`
amac	`str`
Severity	`str`
relevance	`str`
av	`str`
eventAnnotationStageUpdateTime	`str`
locality	`str`
ahost	`str`
originalAgentVersion	`str`
customerID	`str`
atz	`str`
originalAgentMacAddress	`str`
originalAgentType	`str`
deviceSeverity	`str`
originalAgentId	`str`
eventAnnotationManagerReceiptTime	`str`
originalAgentHostName	`str`
priority	`str`
deviceZoneURI	`str`
eventAnnotationEndTime	`str`
cp_severity	`str`
db_ver	`str`
cs2	`str`
origin	`ip4`
loguid	`str`
originsicname	`str`
product	`str`
sequencenum	`str`
version	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.logUpdate
cef0.checkPoint.logUpdate
cef0.checkPoint.logUpdate

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
cs2	`str`
deviceDirection	`int4`
dst	`ip4`
start	`timestamp`
cnt	`int4`
spt	`int4`
src	`ip4`
act	`str`
dvc	`ip4`
in	`int8`
proto	`str`
rt	`timestamp`
out	`int8`
cs2Label	`str`
categoryDeviceGroup	`str`
dtz	`str`
sourceZoneID	`str`
slong	`str`
deviceZoneID	`str`
sourceGeoRegionCode	`str`
categoryObject	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationVersion	`str`
eventAnnotationModificationTime	`str`
art	`str`
categorySignificance	`str`
eventId	`str`
dpt	`str`
originalAgentAddress	`str`
sourceGeoPostalCode	`str`
at	`str`
mrt	`str`
customerURI	`str`
dlat	`str`
originalAgentZoneURI	`str`
sourceZoneURI	`str`
assetCriticality	`str`
destinationZoneID	`str`
eventAnnotationFlags	`str`
agt	`str`
categoryBehavior	`str`
sourceGeoCountryCode	`str`
modelConfidence	`str`
aid	`str`
amac	`str`
deviceZoneExternalID	`str`
slat	`str`
Severity	`str`
destinationZoneExternalID	`str`
relevance	`str`
av	`str`
eventAnnotationStageUpdateTime	`str`
categoryOutcome	`str`
locality	`str`
ahost	`str`
originalAgentVersion	`str`
customerID	`str`
dlong	`str`
atz	`str`
originalAgentMacAddress	`str`
originalAgentType	`str`
deviceSeverity	`str`
type	`str`
originalAgentId	`str`
eventAnnotationManagerReceiptTime	`str`
originalAgentHostName	`str`
priority	`str`
deviceZoneURI	`str`
eventAnnotationEndTime	`str`
sourceGeoLocationInfo	`str`
destinationZoneURI	`str`
cn1Label	`str`
cn1	`int8`
deviceInboundInterface	`str`
__pos	`str`
__nsons	`str`
__p_dport	`str`
contextnum	`str`
context_num	`str`
hll_key	`str`
ifname	`str`
logid	`str`
loguid	`str`
origin	`ip4`
originsicname	`str`
sequencenum	`str`
bytes	`int8`
packets	`int8`
product	`str`
client_inbound_packets	`int8`
client_outbound_packets	`int8`
server_inbound_bytes	`int8`
server_inbound_packets	`int8`
server_outbound_bytes	`int8`
server_outbound_packets	`int8`
server_outbound_interface	`str`
segment_time	`timestamp`
version	`str`
administrator	`str`
alert	`str`
blade_name	`str`
deviceOutboundInterface	`str`
feature_name	`str`
fieldschanges	`str`
lastupdatetime	`timestamp`
log_sys_message	`str`
msg	`str`
operation	`str`
sam_error	`str`
sam_log_type	`str`
sendtotrackerasadvancedauditlog	`str`
server_inbound_interface	`str`
session_description	`str`
session_name	`str`
session_uid	`str`
sntdom	`str`
stormagentaction	`str`
stormagentname	`str`
subject	`str`
sys_message	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Rw tab

title	Tables 8-13

cef0.checkPoint.newAntiVirus
cef0.checkPoint.rad
cef0.checkPoint.securityGatewayManagement
cef0.checkPoint.smartdefense
cef0.checkPoint.smarteventClient
cef0.checkPoint.systemMonitor

Anchor
cef0.checkPoint.newAntiVirus
cef0.checkPoint.newAntiVirus
cef0.checkPoint.newAntiVirus

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
c6a4Label	`str`
cs1Label	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs6Label	`str`
cs6	`str`
deviceDirection	`int4`
dst	`ip4`
dpt	`int4`
dvc	`ip4`
in	`int8`
msg	`str`
out	`int8`
proto	`str`
request	`str`
rt	`timestamp`
shost	`str`
sourceTranslatedAddress	`ip4`
src	`ip4`
spt	`int4`
ad_action__details	`str`
ad_cp__severity	`str`
ad_ifname	`str`
ad_layer__name	`str`
ad_layer__uuid	`str`
ad_log__id	`str`
ad_loguid	`str`
ad_origin	`str`
ad_originsicname	`str`
ad_policy	`str`
ad_policy__time	`str`
ad_product	`str`
ad_sequencenum	`str`
ad_session__id	`str`
ad_smartdefense__profile	`str`
ad_snid	`str`
ad_vendor__list	`str`
ad_version	`str`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
catdt	`str`
customerURI	`str`
destinationZoneURI	`str`
deviceSeverity	`str`
deviceZoneURI	`str`
dtz	`str`
eventId	`str`
flexNumber1	`str`
flexNumber1Label	`str`
flexString2	`str`
flexString2Label	`str`
geid	`str`
sourceTranslatedZoneURI	`str`
sourceZoneURI	`str`
loguid	`str`
cp_severity	`str`
db_ver	`str`
deviceCustomDate2Label	`str`
next_update_desc	`str`
contract_name	`str`
product	`str`
special_properties	`str`
version	`int4`
log_id	`str`
sequencenum	`int4`
origin	`ip4`
cnt	`int4`
http_host	`str`
lastupdatetime	`timestamp`
packet_capture_name	`str`
packet_capture_time	`timestamp`
packet_capture_unique_id	`str`
policy_time	`timestamp`
proxy_src_ip	`ip4`
referrer	`str`
requestClientApplication	`str`
requestMethod	`str`
subscription_stat	`str`
subscription_stat_desc	`str`
user_agent	`str`
cs1	`str`
deviceCustomDate2	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.rad
cef0.checkPoint.rad
cef0.checkPoint.rad

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
deviceDirection	`int4`
alert	`str`
ifname	`str`
loguid	`str`
reason	`str`
msg	`str`
dvc	`ip4`
in	`int8`
rt	`timestamp`
out	`int8`
dtz	`str`
deviceZoneID	`str`
eventAnnotationAuditTrail	`str`
version	`str`
eventAnnotationVersion	`str`
eventAnnotationModificationTime	`str`
art	`str`
origin	`ip4`
originalAgentAddress	`str`
eventId	`str`
at	`str`
mrt	`str`
customerURI	`str`
originalAgentZoneURI	`str`
assetCriticality	`str`
eventAnnotationFlags	`str`
agt	`str`
modelConfidence	`str`
aid	`str`
amac	`str`
deviceZoneExternalID	`str`
Severity	`str`
relevance	`str`
av	`str`
eventAnnotationStageUpdateTime	`str`
locality	`str`
ahost	`str`
originalAgentVersion	`str`
customerID	`str`
atz	`str`
originalAgentMacAddress	`str`
originalAgentType	`str`
cp_severity	`str`
deviceSeverity	`str`
originalAgentId	`str`
eventAnnotationManagerReceiptTime	`str`
originalAgentHostName	`str`
priority	`str`
deviceZoneURI	`str`
eventAnnotationEndTime	`str`
product	`str`
sequencenum	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.securityGatewayManagement
cef0.checkPoint.securityGatewayManagement
cef0.checkPoint.securityGatewayManagement

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a1Label	`str`
c6a1	`str`
c6a2Label	`str`
c6a2	`str`
c6a3Label	`str`
c6a3	`str`
c6a4Label	`str`
c6a4	`str`
cfp1Label	`str`
cfp1	`float8`
cfp2Label	`str`
cfp2	`float8`
cfp3Label	`str`
cfp3	`float8`
cfp4Label	`str`
cfp4	`float8`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationDnsDomain	`str`
destinationServiceName	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceCustomDate1Label	`str`
deviceCustomDate1	`timestamp`
deviceCustomDate2Label	`str`
deviceCustomDate2	`timestamp`
deviceDirection	`int4`
deviceDnsDomain	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceMacAddress	`str`
deviceNtDomain	`str`
deviceOutboundInterface	`str`
deviceProcessName	`str`
deviceTranslatedAddress	`ip4`
dhost	`str`
dmac	`str`
dntdom	`str`
dpid	`int4`
dpriv	`str`
dproc	`str`
dst	`ip4`
duid	`str`
duser	`str`
dvchost	`str`
dvc	`ip4`
dvcpid	`int4`
end	`timestamp`
deviceFacility	`str`
externalId	`str`
fileCreateTime	`timestamp`
fileHash	`str`
fileId	`str`
fileModificationTime	`timestamp`
filePath	`str`
filePermission	`str`
fileType	`str`
fname	`str`
fsize	`int8`
in	`int8`
msg	`str`
oldFileCreateTime	`timestamp`
oldFileHash	`str`
oldFileId	`str`
oldFileModificationTime	`timestamp`
oldFileName	`str`
oldFilePath	`str`
oldFilePermission	`str`
oldFileSize	`int8`
oldFileType	`str`
outcome	`str`
out	`int8`
proto	`str`
reason	`str`
requestClientApplication	`str`
requestCookies	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
shost	`str`
smac	`str`
sntdom	`str`
sourceDnsDomain	`str`
sourceServiceName	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spid	`int4`
spriv	`str`
sproc	`str`
spt	`int4`
src	`ip4`
start	`timestamp`
suid	`str`
suser	`str`
agt	`ip4`
ahost	`str`
art	`str`
assetCriticality	`str`
atz	`str`
catdt	`str`
categoryBehavior	`str`
categoryCustomFormatField	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
categoryTechnique	`str`
categoryTupleDescription	`str`
comment	`str`
cp_severity	`str`
customerID	`str`
customerURI	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
deviceDomain	`str`
deviceSeverity	`str`
dlat	`float8`
dlong	`float8`
dpt	`int4`
dtz	`str`
dvcmac	`str`
endTime	`str`
eventId	`str`
failure_impact	`str`
flexNumber1	`str`
flexNumber1Label	`str`
flexNumber2	`str`
flexNumber2Label	`str`
flexString1	`str`
flexString1Label	`str`
flexString2	`str`
flexString2Label	`str`
loguid	`str`
modelConfidence	`int4`
mrt	`timestamp`
origin	`str`
originsicname	`str`
priority	`int4`
product	`str`
relevance	`int4`
requestContext	`str`
sequencenum	`str`
sessionId	`str`
slat	`float8`
slong	`float8`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
update_service	`str`
version	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.smartdefense
cef0.checkPoint.smartdefense
cef0.checkPoint.smartdefense

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
cat	`str`
c6a2Label	`str`
c6a2	`str`
c6a3Label	`str`
c6a3	`str`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
deviceCustomDate1Label	`str`
deviceCustomDate1	`timestamp`
deviceDirection	`int4`
dst	`ip4`
dvc	`ip4`
in	`int8`
msg	`str`
out	`int8`
proto	`str`
reason	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
sourceServiceName	`str`
dpt	`int4`
spt	`int4`
src	`ip4`
start	`timestamp`
agt	`ip4`
ahost	`str`
aid	`str`
arcSightEventPath	`str`
art	`str`
assetCriticality	`int4`
at	`str`
atz	`str`
av	`str`
catdt	`str`
customerID	`str`
customerURI	`str`
deviceAssetId	`str`
deviceZoneID	`str`
deviceZoneURI	`str`
dtz	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationEndTime	`timestamp`
eventAnnotationEventId	`str`
eventAnnotationFlags	`str`
eventAnnotationManagerReceiptTime	`timestamp`
eventAnnotationModificationTime	`timestamp`
eventAnnotationStageID	`str`
eventAnnotationStageUpdateTime	`timestamp`
eventAnnotationStageURI	`str`
eventAnnotationVersion	`int4`
eventId	`str`
locality	`int4`
modelConfidence	`int4`
mrt	`timestamp`
priority	`int4`
relevance	`int4`
type	`int4`
aggressive_aging_status	`str`
alert	`str`
capacity_notification	`str`
connections_table_capacity	`str`
content_type	`str`
content_length	`int8`
cp_severity	`str`
description_url	`str`
flexNumber1Label	`str`
flexNumber1	`int4`
flexNumber2Label	`str`
flexNumber2	`int4`
flexString2Label	`str`
flexString2	`str`
http_host	`str`
http_server	`str`
http_status	`str`
ifname	`str`
lastupdatetime	`timestamp`
layer_uuid	`str`
layer_name	`str`
loguid	`str`
log_id	`str`
memory_consumption	`str`
origin	`ip4`
originsicname	`str`
packet_capture_name	`str`
packet_capture_time	`timestamp`
packet_capture_unique_id	`str`
policy	`str`
policy_time	`timestamp`
precise_error	`str`
product	`str`
proxy_src_ip	`ip4`
referrer	`str`
reject_id_kid	`str`
rule	`str`
rule_name	`str`
rule_uid	`str`
sequencenum	`str`
ser_agent_kid	`str`
server_kid	`str`
session_id	`str`
signature	`str`
smartdefense_profile	`str`
streaming_engine	`str`
sub_policy_name	`str`
sub_policy_uid	`str`
syn_defender	`str`
user_agent	`str`
version	`str`
rawMessage	`str`		✓
hostchain	`str`		✓
tag	`str`	cefTag	✓

Anchor
cef0.checkPoint.smarteventClient
cef0.checkPoint.smarteventClient
cef0.checkPoint.smarteventClient

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
deviceDirection	`int4`
reason	`str`
msg	`str`
dvc	`ip4`
in	`int8`
rt	`timestamp`
out	`int8`
outcome	`str`
dtz	`str`
deviceZoneID	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationVersion	`str`
eventAnnotationModificationTime	`str`
art	`str`
originalAgentAddress	`str`
eventId	`str`
at	`str`
mrt	`str`
customerURI	`str`
originalAgentZoneURI	`str`
assetCriticality	`str`
eventAnnotationFlags	`str`
agt	`str`
modelConfidence	`str`
aid	`str`
amac	`str`
deviceZoneExternalID	`str`
Severity	`str`
relevance	`str`
av	`str`
eventAnnotationStageUpdateTime	`str`
locality	`str`
ahost	`str`
originalAgentVersion	`str`
customerID	`str`
atz	`str`
originalAgentMacAddress	`str`
originalAgentType	`str`
deviceSeverity	`str`
originalAgentId	`str`
eventAnnotationManagerReceiptTime	`str`
originalAgentHostName	`str`
priority	`str`
deviceZoneURI	`str`
eventAnnotationEndTime	`str`
product	`str`
origin	`ip4`
sequencenum	`int4`
originsicname	`str`
update_service	`str`
failure_impact	`str`
loguid	`str`
version	`int4`
cp_severity	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.systemMonitor
cef0.checkPoint.systemMonitor
cef0.checkPoint.systemMonitor

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a1Label	`str`
c6a1	`str`
c6a2Label	`str`
c6a2	`str`
c6a3Label	`str`
c6a3	`str`
c6a4Label	`str`
c6a4	`str`
cfp1Label	`str`
cfp1	`float8`
cfp2Label	`str`
cfp2	`float8`
cfp3Label	`str`
cfp3	`float8`
cfp4Label	`str`
cfp4	`float8`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationDnsDomain	`str`
destinationServiceName	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceCustomDate1Label	`str`
deviceCustomDate1	`timestamp`
deviceCustomDate2Label	`str`
deviceCustomDate2	`timestamp`
deviceDirection	`int4`
deviceDnsDomain	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceMacAddress	`str`
deviceNtDomain	`str`
deviceOutboundInterface	`str`
deviceProcessName	`str`
deviceTranslatedAddress	`ip4`
dhost	`str`
dmac	`str`
dntdom	`str`
dpid	`int4`
dpriv	`str`
dproc	`str`
dst	`ip4`
duid	`str`
duser	`str`
dvchost	`str`
dvc	`ip4`
dvcpid	`int4`
end	`timestamp`
deviceFacility	`str`
externalId	`str`
fileCreateTime	`timestamp`
fileHash	`str`
fileId	`str`
fileModificationTime	`timestamp`
filePath	`str`
filePermission	`str`
fileType	`str`
fname	`str`
fsize	`int8`
in	`int8`
msg	`str`
sys_message	`str`
oldFileCreateTime	`timestamp`
oldFileHash	`str`
oldFileId	`str`
oldFileModificationTime	`timestamp`
oldFileName	`str`
oldFilePath	`str`
oldFilePermission	`str`
oldFileSize	`int8`
oldFileType	`str`
outcome	`str`
out	`int8`
proto	`str`
reason	`str`
requestClientApplication	`str`
requestCookies	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
ifname	`str`
loguid	`str`
sequencenum	`str`
shost	`str`
smac	`str`
sntdom	`str`
sourceDnsDomain	`str`
sourceServiceName	`str`
origin	`ip4`
originsicname	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spid	`int4`
spriv	`str`
sproc	`str`
spt	`int4`
src	`ip4`
start	`timestamp`
suid	`str`
suser	`str`
catdt	`str`
deviceDomain	`str`
deviceSeverity	`str`
dpt	`int4`
dtz	`str`
dvcmac	`str`
endTime	`str`
eventId	`str`
flexNumber1	`str`
flexNumber1Label	`str`
flexNumber2	`str`
flexNumber2Label	`str`
flexString1	`str`
flexString1Label	`str`
flexString2	`str`
flexString2Label	`str`
modelConfidence	`int4`
priority	`int4`
relevance	`int4`
requestContext	`str`
sessionId	`str`
slat	`float8`
slong	`float8`
dlat	`float8`
dlong	`float8`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
agt	`ip4`
ahost	`str`
art	`str`
atz	`str`
mrt	`timestamp`
categoryBehavior	`str`
categoryCustomFormatField	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
categoryTechnique	`str`
categoryTupleDescription	`str`
assetCriticality	`str`
customerID	`str`
customerURI	`str`
version	`str`
product	`str`
hostchain			✓
tag	`str`	cefTag	✓
rawMessage			✓

Rw tab

title	Tables 14-19

cef0.checkPoint.threatEmulation
cef0.checkPoint.urlFiltering
cef0.checkPoint.vpn1Firewall1
cef0.checkPoint.vpn1Firewall1AndContentAwareness
cef0.checkPoint.web_api

Anchor
cef0.checkPoint.threatEmulation
cef0.checkPoint.threatEmulation
cef0.checkPoint.threatEmulation

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
c6a4Label	`str`
deviceDirection	`int4`
dvc	`ip4`
deviceFacility	`str`
msg	`str`
reason	`str`
requestClientApplication	`str`
rt	`timestamp`
shost	`str`
src	`ip4`
suser	`str`
ad_additional__info	`str`
ad_client__version	`str`
ad_cp__severity	`str`
ad_event__type	`str`
ad_host__type	`str`
ad_installed__products	`str`
ad_local__time	`str`
ad_loguid	`str`
ad_machine__guid	`str`
ad_origin	`str`
ad_os__name	`str`
ad_os__version	`str`
ad_policy__date	`str`
ad_policy__name	`str`
ad_policy__number	`str`
ad_product	`str`
ad_sequencenum	`str`
ad_user__name	`str`
ad_user__sid	`str`
ad_version	`str`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
control_log_type	`str`
cp_severity	`str`
customerURI	`str`
deviceSeverity	`str`
deviceZoneURI	`str`
dtz	`str`
eventId	`str`
geid	`str`
log_id	`str`
loguid	`str`
origin	`str`
originsicname	`str`
product	`str`
sequencenum	`str`
sourceZoneURI	`str`
version	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.urlFiltering
cef0.checkPoint.urlFiltering
cef0.checkPoint.urlFiltering

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
cs2	`str`
deviceDirection	`int4`
msg	`str`
dvc	`ip4`
in	`int8`
rt	`timestamp`
out	`int8`
deviceCustomDate2Label	`str`
cs2Label	`str`
dtz	`str`
deviceZoneID	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationVersion	`str`
eventAnnotationModificationTime	`str`
art	`str`
originalAgentAddress	`str`
eventId	`str`
at	`str`
mrt	`str`
customerURI	`str`
originalAgentZoneURI	`str`
assetCriticality	`str`
eventAnnotationFlags	`str`
agt	`str`
modelConfidence	`str`
aid	`str`
amac	`str`
deviceZoneExternalID	`str`
Severity	`str`
relevance	`str`
av	`str`
eventAnnotationStageUpdateTime	`str`
catdt	`str`
locality	`str`
ahost	`str`
originalAgentVersion	`str`
customerID	`str`
atz	`str`
originalAgentMacAddress	`str`
originalAgentType	`str`
deviceSeverity	`str`
originalAgentId	`str`
eventAnnotationManagerReceiptTime	`str`
originalAgentHostName	`str`
priority	`str`
deviceZoneURI	`str`
eventAnnotationEndTime	`str`
act	`str`
aggregated_log_count	`int8`
alert	`str`
app_category	`str`
app_id	`str`
app_properties	`str`
app	`str`
browse_time	`str`
client_type_os	`str`
bytes	`int8`
certificate_resource	`str`
certificate_validation	`str`
client_inbound_packets	`int8`
client_outbound_packets	`int8`
connection_count	`int8`
conn_direction	`str`
cp_app_risk	`str`
cp_severity	`str`
creation_time	`timestamp`
cs5	`str`
cs5Label	`str`
cs6	`str`
cs6Label	`str`
dpt	`int4`
dst	`ip4`
duration	`str`
flexString1Label	`str`
hll_key	`str`
ifname	`str`
inzone	`str`
last_hit_time	`timestamp`
lastupdatetime	`timestamp`
layer_name	`str`
layer_uuid	`str`
logid	`str`
loguid	`str`
match_id	`str`
origin	`str`
originsicname	`str`
outzone	`str`
packets	`int8`
parent_rule	`str`
product	`str`
proto	`str`
reason	`str`
request	`str`
requestClientApplication	`str`
requestMethod	`str`
requestCookies	`str`
rule_action	`str`
rule_uid	`str`
sequencenum	`int4`
server_inbound_bytes	`int8`
server_inbound_packets	`int8`
server_outbound_bytes	`int8`
server_outbound_packets	`int8`
service_id	`str`
sig_id	`str`
spt	`int4`
src	`ip4`
update_count	`int8`
web_server_type	`str`
version	`str`
db_ver	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.vpn1Firewall1
cef0.checkPoint.vpn1Firewall1
cef0.checkPoint.vpn1Firewall1

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs6Label	`str`
cs6	`str`
destinationServiceName	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceDirection	`int4`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
dst	`ip4`
dvc	`ip4`
msg	`str`
proto	`str`
reason	`str`
requestClientApplication	`str`
request	`str`
rt	`timestamp`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spt	`int4`
src	`ip4`
start	`timestamp`
agt	`ip4`
ahost	`str`
aid	`str`
arcSightEventPath	`str`
art	`str`
assetCriticality	`int4`
at	`str`
atz	`str`
av	`str`
catdt	`str`
categoryBehavior	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
customerID	`str`
customerURI	`str`
destinationAssetId	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
destinationTranslatedZoneID	`str`
destinationTranslatedZoneURI	`str`
destinationZoneExternalID	`str`
destinationZoneID	`str`
destinationZoneURI	`str`
deviceAssetId	`str`
deviceZoneID	`str`
deviceZoneURI	`str`
dlat	`float8`
dlong	`float8`
dpt	`int4`
dtz	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationEndTime	`timestamp`
eventAnnotationEventId	`str`
eventAnnotationFlags	`str`
eventAnnotationManagerReceiptTime	`timestamp`
eventAnnotationModificationTime	`timestamp`
eventAnnotationStageID	`str`
eventAnnotationStageUpdateTime	`timestamp`
eventAnnotationStageURI	`str`
eventAnnotationVersion	`int4`
eventId	`str`
locality	`int4`
modelConfidence	`int4`
mrt	`timestamp`
priority	`int4`
relevance	`int4`
slat	`float8`
slong	`float8`
sourceAssetId	`str`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
sourceZoneExternalID	`str`
sourceZoneID	`str`
sourceZoneURI	`str`
type	`int4`
conn_direction	`str`
context_num	`str`
contextnum	`str`
hll_key	`str`
ifname	`str`
inzone	`str`
layer_name	`str`
layer_uuid	`str`
logid	`str`
loguid	`str`
match_id	`str`
nat_addtnl_rulenum	`str`
nat_rulenum	`str`
needs_browse_time	`str`
origin	`ip4`
originsicname	`str`
outzone	`str`
parent_rule	`str`
product	`str`
rule_action	`str`
rule_uid	`str`
sequencenum	`str`
service_id	`str`
sig_id	`str`
version	`str`
action_reason	`str`
aggregated_log_count	`str`
alert	`str`
bytes	`str`
creation_time	`timestamp`
client_inbound_packets	`str`
client_outbound_packets	`str`
cluster_info	`str`
connection_count	`int4`
c_bytes	`str`
dst_domain_name	`str`
duration	`str`
fw_message	`str`
icmp	`str`
in	`int8`
lastupdatetime	`timestamp`
last_hit_time	`timestamp`
last_rematch_time	`str`
log_delay	`str`
nat_rule_uid	`str`
out	`int8`
packets	`str`
precise_error	`str`
proxy_src_ip	`str`
rematch_info	`str`
rpc_prog	`str`
segment_time	`str`
server_inbound_bytes	`str`
server_inbound_interface	`str`
server_inbound_packets	`str`
server_outbound_bytes	`str`
server_outbound_interface	`str`
server_outbound_packets	`str`
src_domain_name	`str`
tcp_packet_out_of_state	`str`
update_count	`str`
cp_severity	`str`
db_ver	`str`
log_id	`str`
rawMessage	`str`		✓
hostchain	`str`		✓
tag	`str`	cefTag	✓

Anchor
cef0.checkPoint.vpn1Firewall1AndContentAwareness
cef0.checkPoint.vpn1Firewall1AndContentAwareness
cef0.checkPoint.vpn1Firewall1AndContentAwareness

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
c6a4Label	`str`
cs2Label	`str`
cs2	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceDirection	`int4`
dst	`ip4`
dst_domain_name	`str`
dpt	`int4`
dvc	`ip4`
proto	`str`
rt	`timestamp`
shost	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
src	`ip4`
spt	`int4`
ad_conn__direction	`str`
ad_context__num	`str`
ad_contextnum	`str`
ad_hll__key	`str`
ad_https__inspection__action	`str`
ad_ifname	`str`
ad_inzone	`str`
ad_layer__name	`str`
ad_layer__uuid	`str`
ad_logid	`str`
ad_loguid	`str`
ad_match__id	`str`
ad_nat__addtnl__rulenum	`str`
ad_nat__rulenum	`str`
ad_needs__browse__time	`str`
ad_origin	`str`
ad_originsicname	`str`
ad_outzone	`str`
ad_parent__rule	`str`
ad_product	`str`
ad_rule__action	`str`
ad_rule__uid	`str`
ad_sequencenum	`str`
ad_service__id	`str`
ad_sig__id	`str`
ad_unauthorized__sni	`str`
ad_version	`str`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
customerURI	`str`
destinationTranslatedZoneURI	`str`
destinationZoneURI	`str`
deviceSeverity	`str`
deviceZoneURI	`str`
dtz	`str`
eventId	`str`
geid	`str`
sourceTranslatedZoneURI	`str`
sourceZoneURI	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
cef0.checkPoint.web_api
cef0.checkPoint.web_api
cef0.checkPoint.web_api

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
c6a4Label	`str`
deviceDirection	`int4`
dvc	`ip4`
rt	`timestamp`
sntdom	`str`
src	`ip4`
ad_additional__info	`str`
ad_administrator	`str`
ad_loguid	`str`
ad_operation	`str`
ad_origin	`str`
ad_originsicname	`str`
ad_product	`str`
ad_sendtotrackerasadvancedauditlog	`str`
ad_sequencenum	`str`
ad_session__uid	`str`
ad_subject	`str`
ad_version	`str`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
customerURI	`str`
deviceSeverity	`str`
deviceZoneURI	`str`
dtz	`str`
eventId	`str`
geid	`str`
sourceZoneURI	`str`
additional_info	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Versions Compared

Old Version 9

New Version Current

Key

Introduction

Tag structure

How is the data sent to Devo?

Table structure

Anchor
cef0.checkPoint.antiMalware
cef0.checkPoint.antiMalware
cef0.checkPoint.antiMalware

Anchor
cef0.checkPoint.antiVirus
cef0.checkPoint.antiVirus
cef0.checkPoint.antiVirus

Anchor
cef0.checkPoint.applicationControl
cef0.checkPoint.applicationControl
cef0.checkPoint.applicationControl

Anchor
cef0.checkPoint.applicationControlAndUrlFiltering
cef0.checkPoint.applicationControlAndUrlFiltering
cef0.checkPoint.applicationControlAndUrlFiltering

Anchor
cef0.checkPoint.firewall
cef0.checkPoint.firewall
cef0.checkPoint.firewall

Anchor
cef0.checkPoint.ips
cef0.checkPoint.ips
cef0.checkPoint.ips

Anchor
cef0.checkPoint.logUpdate
cef0.checkPoint.logUpdate
cef0.checkPoint.logUpdate

Anchor
cef0.checkPoint.newAntiVirus
cef0.checkPoint.newAntiVirus
cef0.checkPoint.newAntiVirus

Anchor
cef0.checkPoint.rad
cef0.checkPoint.rad
cef0.checkPoint.rad

Anchor
cef0.checkPoint.securityGatewayManagement
cef0.checkPoint.securityGatewayManagement
cef0.checkPoint.securityGatewayManagement

Anchor
cef0.checkPoint.smartdefense
cef0.checkPoint.smartdefense
cef0.checkPoint.smartdefense

Anchor
cef0.checkPoint.smarteventClient
cef0.checkPoint.smarteventClient
cef0.checkPoint.smarteventClient

Anchor
cef0.checkPoint.systemMonitor
cef0.checkPoint.systemMonitor
cef0.checkPoint.systemMonitor

Anchor
cef0.checkPoint.threatEmulation
cef0.checkPoint.threatEmulation
cef0.checkPoint.threatEmulation

Anchor
cef0.checkPoint.urlFiltering
cef0.checkPoint.urlFiltering
cef0.checkPoint.urlFiltering

Anchor
cef0.checkPoint.vpn1Firewall1
cef0.checkPoint.vpn1Firewall1
cef0.checkPoint.vpn1Firewall1

Anchor
cef0.checkPoint.vpn1Firewall1AndContentAwareness
cef0.checkPoint.vpn1Firewall1AndContentAwareness
cef0.checkPoint.vpn1Firewall1AndContentAwareness

Anchor
cef0.checkPoint.web_api
cef0.checkPoint.web_api
cef0.checkPoint.web_api

Page Comparison

Versions Compared

Old Version 9

New Version Current

Key

Introduction

Tag structure

How is the data sent to Devo?

Table structure

Anchorcef0.checkPoint.antiMalwarecef0.checkPoint.antiMalwarecef0.checkPoint.antiMalware

Anchorcef0.checkPoint.antiViruscef0.checkPoint.antiViruscef0.checkPoint.antiVirus

Anchorcef0.checkPoint.applicationControlcef0.checkPoint.applicationControlcef0.checkPoint.applicationControl

Anchorcef0.checkPoint.applicationControlAndUrlFilteringcef0.checkPoint.applicationControlAndUrlFilteringcef0.checkPoint.applicationControlAndUrlFiltering

Anchorcef0.checkPoint.firewallcef0.checkPoint.firewallcef0.checkPoint.firewall

Anchorcef0.checkPoint.ipscef0.checkPoint.ipscef0.checkPoint.ips

Anchorcef0.checkPoint.logUpdatecef0.checkPoint.logUpdatecef0.checkPoint.logUpdate

Anchorcef0.checkPoint.newAntiViruscef0.checkPoint.newAntiViruscef0.checkPoint.newAntiVirus

Anchorcef0.checkPoint.radcef0.checkPoint.radcef0.checkPoint.rad

Anchorcef0.checkPoint.securityGatewayManagementcef0.checkPoint.securityGatewayManagementcef0.checkPoint.securityGatewayManagement

Anchorcef0.checkPoint.smartdefensecef0.checkPoint.smartdefensecef0.checkPoint.smartdefense

Anchorcef0.checkPoint.smarteventClientcef0.checkPoint.smarteventClientcef0.checkPoint.smarteventClient

Anchorcef0.checkPoint.systemMonitorcef0.checkPoint.systemMonitorcef0.checkPoint.systemMonitor

Anchorcef0.checkPoint.threatEmulationcef0.checkPoint.threatEmulationcef0.checkPoint.threatEmulation

Anchorcef0.checkPoint.urlFilteringcef0.checkPoint.urlFilteringcef0.checkPoint.urlFiltering

Anchorcef0.checkPoint.vpn1Firewall1cef0.checkPoint.vpn1Firewall1cef0.checkPoint.vpn1Firewall1

Anchorcef0.checkPoint.vpn1Firewall1AndContentAwarenesscef0.checkPoint.vpn1Firewall1AndContentAwarenesscef0.checkPoint.vpn1Firewall1AndContentAwareness

Anchorcef0.checkPoint.web_apicef0.checkPoint.web_apicef0.checkPoint.web_api

Anchor
cef0.checkPoint.antiMalware
cef0.checkPoint.antiMalware
cef0.checkPoint.antiMalware

Anchor
cef0.checkPoint.antiVirus
cef0.checkPoint.antiVirus
cef0.checkPoint.antiVirus

Anchor
cef0.checkPoint.applicationControl
cef0.checkPoint.applicationControl
cef0.checkPoint.applicationControl

Anchor
cef0.checkPoint.applicationControlAndUrlFiltering
cef0.checkPoint.applicationControlAndUrlFiltering
cef0.checkPoint.applicationControlAndUrlFiltering

Anchor
cef0.checkPoint.firewall
cef0.checkPoint.firewall
cef0.checkPoint.firewall

Anchor
cef0.checkPoint.ips
cef0.checkPoint.ips
cef0.checkPoint.ips

Anchor
cef0.checkPoint.logUpdate
cef0.checkPoint.logUpdate
cef0.checkPoint.logUpdate

Anchor
cef0.checkPoint.newAntiVirus
cef0.checkPoint.newAntiVirus
cef0.checkPoint.newAntiVirus

Anchor
cef0.checkPoint.rad
cef0.checkPoint.rad
cef0.checkPoint.rad

Anchor
cef0.checkPoint.securityGatewayManagement
cef0.checkPoint.securityGatewayManagement
cef0.checkPoint.securityGatewayManagement

Anchor
cef0.checkPoint.smartdefense
cef0.checkPoint.smartdefense
cef0.checkPoint.smartdefense

Anchor
cef0.checkPoint.smarteventClient
cef0.checkPoint.smarteventClient
cef0.checkPoint.smarteventClient

Anchor
cef0.checkPoint.systemMonitor
cef0.checkPoint.systemMonitor
cef0.checkPoint.systemMonitor

Anchor
cef0.checkPoint.threatEmulation
cef0.checkPoint.threatEmulation
cef0.checkPoint.threatEmulation

Anchor
cef0.checkPoint.urlFiltering
cef0.checkPoint.urlFiltering
cef0.checkPoint.urlFiltering

Anchor
cef0.checkPoint.vpn1Firewall1
cef0.checkPoint.vpn1Firewall1
cef0.checkPoint.vpn1Firewall1

Anchor
cef0.checkPoint.vpn1Firewall1AndContentAwareness
cef0.checkPoint.vpn1Firewall1AndContentAwareness
cef0.checkPoint.vpn1Firewall1AndContentAwareness

Anchor
cef0.checkPoint.web_api
cef0.checkPoint.web_api
cef0.checkPoint.web_api