cef0.aws.vpcFlow

Introduction

The table cef0.aws.vpcFlow identifies events in CEF format generated by AWS VPC Flow Log.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

cef0.aws.vpcFlow

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Log samples

The following are sample logs sent to cef0.aws.vpcFlow. Find how the information will be parsed in your data table under each sample log.

Extra columns

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

cef0.aws.vpcFlow

<22>2021-08-26 09:41:06.739 localhost=127.0.0.1 22 CEF: 0|AWS|VPC Flow|2||AWS VPC Flow Log|Unknown| eventId=52122946 proto=TCP customerURI=/All Customers/MSSP/07_Polaris/Polaris art=1629762942339 act=ACCEPT rt=1629762942339 deviceDomain=408689139386 src=209.10.197.223 sourceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93 spt=37108 dst=21.248.183.78 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93 dpt=1521 cs1=OK cs2=1629762845 cs3=1629762861 cn2=2 flexNumber1=282 cs1Label=LogStatus cs2Label=Start Time cs3Label=End Time cn2Label=Packets c6a4Label=Spain flexNumber1Label=Total bytes ahost=esawssoccol02.cghs.local agt=173.113.201.96 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93 amac=06-C2-99-52-AE-A0 av=31.93.227.4322.0 atz=UTC at=sdkfolderreader dvchost=pro-flow-logs dtz=UTC deviceInboundInterface=eni-02c66bebee67e6847 geid=2803384161065861968 _cefVer=0.1 aid=aid1234

And this is how the log would be parsed:

Field	Value	Type	Extra fields
hostchain	`localhost=127.0.0.1`	`str`
priorityCode	`22`	`str`
cefTag	`CEF`	`str`
cefVersion	`0`	`str`
embDeviceVendor	`AWS`	`str`
embDeviceProduct	`VPC Flow`	`str`
deviceVersion	`2`	`str`
signatureID	`null`	`str`
name	`AWS VPC Flow Log`	`str`
severity	`Unknown`	`str`
extension	eventId=52122946 proto=TCP customerURI=/All Customers/MSSP/07_Polaris/Polaris art=1629762942339 act=ACCEPT rt=1629762942339 deviceDomain=408689139386 src=209.10.197.223 sourceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93 spt=37108 dst=21.248.183.78 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93 dpt=1521 cs1=OK cs2=1629762845 cs3=1629762861 cn2=2 flexNumber1=282 cs1Label=LogStatus cs2Label=Start Time cs3Label=End Time cn2Label=Packets c6a4Label=Spain flexNumber1Label=Total bytes ahost=esawssoccol02.cghs.local agt=173.113.201.96 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93 amac=06-C2-99-52-AE-A0 av=31.93.227.4322.0 atz=UTC at=sdkfolderreader dvchost=pro-flow-logs dtz=UTC deviceInboundInterface=eni-02c66bebee67e6847 geid=2803384161065861968 _cefVer=0.1 aid=aid1234	`str`
eventId	`52122946`	`str`
proto	`TCP`	`str`
customerURI	`/All Customers/MSSP/07_Polaris/Polaris`	`str`
art	`1629762942339`	`str`
act	`ACCEPT`	`str`
rt	`1629762942339`	`timestamp`
deviceDomain	`408689139386`	`str`
src	`209.10.197.223`	`ip4`
sourceZoneURI	`/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93`	`str`
spt	`37108`	`int4`
dst	`21.248.183.78`	`ip4`
destinationZoneURI	`/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93`	`str`
dpt	`1521`	`int4`
cs1	`OK`	`str`
cs2	`1629762845`	`str`
cs3	`1629762861`	`str`
cn2	`2`	`int8`
flexNumber1	`282`	`str`
cs1Label	`LogStatus`	`str`
cs2Label	`Start Time`	`str`
cs3Label	`End Time`	`str`
cn2Label	`Packets`	`str`
c6a4Label	`Spain`	`str`
flexNumber1Label	`Total bytes`	`str`
ahost	`esawssoccol02.cghs.local`	`str`
agt	`173.113.201.96`	`str`
agentZoneURI	`/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93`	`str`
amac	`06-C2-99-52-AE-A0`	`str`
av	`31.93.227.4322.0`	`str`
atz	`UTC`	`str`
at	`sdkfolderreader`	`str`
dvchost	`pro-flow-logs`	`str`
dtz	`UTC`	`str`
deviceInboundInterface	`eni-02c66bebee67e6847`	`str`
geid	`2803384161065861968`	`str`
_cefVer	`0.1`	`str`
aid	`aid1234`	`str`
rawMessage	CEF: 0\|AWS\|VPC Flow\|2\|\|AWS VPC Flow Log\|Unknown\| eventId=52122946 proto=TCP customerURI=/All Customers/MSSP/07_Polaris/Polaris art=1629762942339 act=ACCEPT rt=1629762942339 deviceDomain=408689139386 src=209.10.197.223 sourceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93 spt=37108 dst=21.248.183.78 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93 dpt=1521 cs1=OK cs2=1629762845 cs3=1629762861 cn2=2 flexNumber1=282 cs1Label=LogStatus cs2Label=Start Time cs3Label=End Time cn2Label=Packets c6a4Label=Spain flexNumber1Label=Total bytes ahost=esawssoccol02.cghs.local agt=173.113.201.96 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 155.72.63.29-142.227.230.93 amac=06-C2-99-52-AE-A0 av=31.93.227.4322.0 atz=UTC at=sdkfolderreader dvchost=pro-flow-logs dtz=UTC deviceInboundInterface=eni-02c66bebee67e6847 geid=2803384161065861968 _cefVer=0.1 aid=aid1234	`str`	✓