cef0.arcsight.logger

Introduction

The table cef0.arcsight.logger identify events in CEF format generated by Arcsight Logger.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

Tag	Data table
cef0.arcsight.logger	cef0.arcsight.logger

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Log samples

The following is a sample log sent to the cef0.arcsight.logger table. Find how the information will be parsed in your data table under each sample log.

Extra columns

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

2021-11-12 13:25:37.918 localhost=127.0.0.1 14 CEF: 0|ArcSight|Logger|5.1.0.1281.3|archive:130|Archive deactivated|Low| eventId=123456789 msg=Successful deactivation of archive 20130519 mrt=123456789 modelConfidence=4 severity=3 relevance=10 assetCriticality=0 priority=4 art=123456789 cat=/Monitor/Archive/Deactivation/Success deviceSeverity=Warning rt=123456789 dhost=express002001 dst=127.0.0.1 destinationZoneID=M77cj2AABABCCz1pYAT3UdQ\\=\\= destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/Local Network Zones/RFC5735: IANA - Loopback (127.0.0.0-127.255.255.255) destinationAssetId=4md4PzjwBABCAV4B5AnfNIg\\=\\= fname=20130519 filePath=/opt/arcsight/logger/data/archives/20130519 fileId=0504403158265495649 fileType=Archive fileModificationTime=1369001429328 fileHash=BoCozSHaVkaSDa93oTLU7u5oUkIyeUhoGywR0IRI2Og\\= cs2=20130519 locality=1 cs2Label=Archive Name ahost=host123.es.host123.com agt=10.74.252.98 av=5.1.5.5973.0 atz=Europe/Madrid aid=U4bJFUYBABCAAuFjmWUl6g\\=\\= at=superagent dvchost=appliance dvc=127.0.0.1 deviceZoneID=M77cj2AABABCCz1pYAT3UdQ\\=\\= deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/Local Network Zones/RFC5735: IANA - Loopback (127.0.0.0-127.255.255.255) deviceAssetId=4md4PzjwBABCAV4B5AnfNIg\\=\\= dtz=Europe/Madrid eventAnnotationStageID=R9MHiNfoAABCASsxbPIxG0g\\=\\= eventAnnotationStageURI=/All Stages/Queued eventAnnotationStageUpdateTime=1400551325736 eventAnnotationModificationTime=1400551325736 eventAnnotationAuditTrail=1,1400268930065,root,Queued,,,,\\n eventAnnotationVersion=1 eventAnnotationEventId=123456789 eventAnnotationFlags=0 eventAnnotationEndTime=123456789 eventAnnotationManagerReceiptTime=123456789 _cefVer=0.1 ad.arcSightEventPath=3fd8PzjwBABCAYIB5AnfNIg\\=\\=

And this is how the log would be parsed:

Field	Value	Type	Source field name	Extra fields
eventdate	`2021-11-12 13:25:37.918`	`timestamp`
rawMessage	CEF: 0\|ArcSight\|Logger\|5.1.0.1281.3\|archive:130\|Archive deactivated\|Low\| eventId=123456789 msg=Successful deactivation of archive 20130519 mrt=123456789 modelConfidence=4 severity=3 relevance=10 assetCriticality=0 priority=4 art=123456789 cat=/Monitor/Archive/Deactivation/Success deviceSeverity=Warning rt=123456789 dhost=express002001 dst=127.0.0.1 destinationZoneID=M77cj2AABABCCz1pYAT3UdQ\\=\\= destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/Local Network Zones/RFC5735: IANA - Loopback (127.0.0.0-127.255.255.255) destinationAssetId=4md4PzjwBABCAV4B5AnfNIg\\=\\= fname=20130519 filePath=/opt/arcsight/logger/data/archives/20130519 fileId=0504403158265495649 fileType=Archive fileModificationTime=1369001429328 fileHash=BoCozSHaVkaSDa93oTLU7u5oUkIyeUhoGywR0IRI2Og\\= cs2=20130519 locality=1 cs2Label=Archive Name ahost=host123.es.host123.com agt=10.74.252.98 av=5.1.5.5973.0 atz=Europe/Madrid aid=U4bJFUYBABCAAuFjmWUl6g\\=\\= at=superagent dvchost=appliance dvc=127.0.0.1 deviceZoneID=M77cj2AABABCCz1pYAT3UdQ\\=\\= deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/Local Network Zones/RFC5735: IANA - Loopback (127.0.0.0-127.255.255.255) deviceAssetId=4md4PzjwBABCAV4B5AnfNIg\\=\\= dtz=Europe/Madrid eventAnnotationStageID=R9MHiNfoAABCASsxbPIxG0g\\=\\= eventAnnotationStageURI=/All Stages/Queued eventAnnotationStageUpdateTime=1400551325736 eventAnnotationModificationTime=1400551325736 eventAnnotationAuditTrail=1,1400268930065,root,Queued,,,,\\n eventAnnotationVersion=1 eventAnnotationEventId=123456789 eventAnnotationFlags=0 eventAnnotationEndTime=123456789 eventAnnotationManagerReceiptTime=123456789 _cefVer=0.1 ad.arcSightEventPath=3fd8PzjwBABCAYIB5AnfNIg\\=\\=	`str`		✓
hostchain	`localhost=127.0.0.1`	`str`
priorityCode	`14`	`str`
cefTag	`CEF`	`str`
cefVersion	`0`	`str`
embDeviceVendor	`ArcSight`	`str`
embDeviceProduct	`Logger`	`str`
deviceVersion	`5.1.0.1281.3`	`str`
signatureID	`archive:130`	`str`
name	`Archive deactivated`	`str`
severity	`Low`	`str`
_cefVer	`0.1`	`str`
cat	`/Monitor/Archive/Deactivation/Success`	`str`
cn1Label	`null`	`str`
cn1	`null`	`int8`
cn2Label	`null`	`str`
cn2	`null`	`int8`
cnt	`null`	`int4`
cs1Label	`null`	`str`
cs1	`null`	`str`
cs2Label	`Archive Name`	`str`
cs2	`20130519`	`str`
dvchost	`appliance`	`str`
dvc	`127.0.0.1`	`ip4`
deviceFacility	`null`	`str`
filePath	`/opt/arcsight/logger/data/archives/20130519`	`str`
fileType	`Archive`	`str`
fname	`20130519`	`str`
agt	`10.74.252.98`	`ip4`
ahost	`host123.es.host123.com`	`str`
aid	`U4bJFUYBABCAAuFjmWUl6g\=\=`	`str`
arcSightEventPath	`null`	`str`
art	`123456789`	`str`
assetCriticality	`0`	`int4`
at	`superagent`	`str`
atz	`Europe/Madrid`	`str`
av	`5.1.5.5973.0`	`str`
deviceAssetId	`4md4PzjwBABCAV4B5AnfNIg\=\=`	`str`
deviceSeverity	`Warning`	`str`
deviceZoneID	`M77cj2AABABCCz1pYAT3UdQ\=\=`	`str`
deviceZoneURI	`/All Zones/ArcSight System/Private Address Space Zones/Local Network Zones/RFC5735: IANA - Loopback (127.0.0.0-127.255.255.255)`	`str`
dtz	`Europe/Madrid`	`str`
eventAnnotationAuditTrail	`1,1400268930065,root,Queued,,,,\n`	`str`
eventAnnotationEndTime	`2014-05-20 02:02:05.069`	`timestamp`
eventAnnotationEventId	`123456789`	`str`
eventAnnotationFlags	`0`	`str`
eventAnnotationManagerReceiptTime	`2014-05-20 02:02:05.069`	`timestamp`
eventAnnotationModificationTime	`2014-05-20 02:02:05.736`	`timestamp`
eventAnnotationStageID	`R9MHiNfoAABCASsxbPIxG0g\=\=`	`str`
eventAnnotationStageUpdateTime	`2014-05-20 02:02:05.736`	`timestamp`
eventAnnotationStageURI	`/All Stages/Queued`	`str`
eventAnnotationVersion	`1`	`int4`
eventId	`123456789`	`str`
generatorID	`null`	`str`
locality	`1`	`int4`
modelConfidence	`4`	`int4`
mrt	`2014-05-20 02:02:05.069`	`timestamp`
priority	`4`	`int4`
relevance	`10`	`int4`
type	`null`	`int4`
tag	`CEF`	`str`	cefTag	✓