Document toolboxDocument toolbox

cef0.juniper

Introduction

The tags beginning with cef0.juniper identify events in CEF format generated by Juniper.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

Tags

Data tables

Tags

Data tables

cef0.juniper.firewallVpn

cef0.juniper.firewallVpn

cef0.juniper.juniperSsl

cef0.juniper.juniperSsl

cef0.juniper.junos

cef0.juniper.junos

cef0.juniper.netscreenVpn

cef0.juniper.netscreenVpn

cef0.juniper.nsm

cef0.juniper.nsm

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Table structure

These are the fields displayed in this table:

cef0.juniper.firewallVpn

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

hostname

str

 

 

priorityCode

str

 

 

cefTag

str

 

 

cefVersion

str

 

 

embDeviceVendor

str

 

 

embDeviceProduct

str

 

 

deviceVersion

str

 

 

signatureID

str

 

 

name

str

 

 

severity

str

 

 

_cefVer

str

 

 

act

str

 

 

app

str

 

 

cat

str

 

 

c6a4Label

str

 

 

cn1Label

str

 

 

cn1

int8

 

 

cn2Label

str

 

 

cn3Label

str

 

 

cnt

int4

 

 

cs1Label

str

 

 

cs1

str

 

 

cs2Label

str

 

 

cs2

str

 

 

cs3Label

str

 

 

cs3

str

 

 

cs4Label

str

 

 

cs4

str

 

 

cs5Label

str

 

 

cs6Label

str

 

 

destinationTranslatedAddress

ip4

 

 

destinationTranslatedPort

int4

 

 

deviceOutboundInterface

str

 

 

deviceProcessName

str

 

 

dst

ip4

 

 

dpt

int4

 

 

dvchost

str

 

 

end

timestamp

 

 

deviceFacility

str

 

 

in

int8

 

 

msg

str

 

 

out

int8

 

 

proto

str

 

 

reason

str

 

 

rt

timestamp

 

 

sourceTranslatedAddress

ip4

 

 

sourceTranslatedPort

int4

 

 

src

ip4

 

 

spt

int4

 

 

start

timestamp

 

 

suser

str

 

 

ad_MessageID

str

 

 

ad_MessageType

str

 

 

ad_SessionId

str

 

 

agentZoneURI

str

 

 

agt

str

 

 

ahost

str

 

 

aid

str

 

 

amac

str

 

 

art

str

 

 

at

str

 

 

atz

str

 

 

av

str

 

 

categoryBehavior

str

 

 

categoryDeviceGroup

str

 

 

categoryObject

str

 

 

categoryOutcome

str

 

 

categorySignificance

str

 

 

categoryTechnique

str

 

 

customerURI

str

 

 

destinationTranslatedZoneURI

str

 

 

destinationZoneURI

str

 

 

deviceSeverity

str

 

 

dtz

str

 

 

eventId

str

 

 

geid

str

 

 

sourceTranslatedZoneURI

str

 

 

sourceZoneURI

str

 

 

type

str

 

 

hostchain

str

 

✓

tag

str

cefTag

✓

rawMessage

str

 

✓

cef0.juniper.juniperSsl

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

priorityCode

str

 

 

cefTag

str

 

 

cefVersion

str

 

 

embDeviceVendor

str

 

 

embDeviceProduct

str

 

 

deviceVersion

str

 

 

signatureID

str

 

 

name

str

 

 

severity

str

 

 

_cefVer

str

 

 

act

str

 

 

app

str

 

 

cat

str

 

 

c6a1Label

str

 

 

c6a1

str

 

 

c6a2Label

str

 

 

c6a2

str

 

 

c6a3Label

str

 

 

c6a3

str

 

 

c6a4Label

str

 

 

c6a4

str

 

 

cfp1Label

str

 

 

cfp1

float8

 

 

cfp2Label

str

 

 

cfp2

float8

 

 

cfp3Label

str

 

 

cfp3

float8

 

 

cfp4Label

str

 

 

cfp4

float8

 

 

cn1Label

str

 

 

cn1

int8

 

 

cn2Label

str

 

 

cn2

int8

 

 

cn3Label

str

 

 

cn3

int8

 

 

cnt

int4

 

 

cs1Label

str

 

 

cs1

str

 

 

cs2Label

str

 

 

cs2

str

 

 

cs3Label

str

 

 

cs3

str

 

 

cs4Label

str

 

 

cs4

str

 

 

cs5Label

str

 

 

cs5

str

 

 

cs6Label

str

 

 

cs6

str

 

 

destinationDnsDomain

str

 

 

destinationServiceName

str

 

 

destinationTranslatedAddress

ip4

 

 

destinationTranslatedPort

int4

 

 

deviceCustomDate1Label

str

 

 

deviceCustomDate1

timestamp

 

 

deviceCustomDate2Label

str

 

 

deviceCustomDate2

timestamp

 

 

deviceDirection

int4

 

 

deviceDnsDomain

str

 

 

deviceExternalId

str

 

 

deviceInboundInterface

str

 

 

deviceMacAddress

str

 

 

deviceNtDomain

str

 

 

deviceOutboundInterface

str

 

 

deviceProcessName

str

 

 

deviceTranslatedAddress

ip4

 

 

dhost

str

 

 

dmac

str

 

 

dntdom

str

 

 

dpid

int4

 

 

dpriv

str

 

 

dproc

str

 

 

dst

ip4

 

 

duid

str

 

 

duser

str

 

 

dvchost

str

 

 

dvc

ip4

 

 

dvcpid

int4

 

 

end

timestamp

 

 

deviceFacility

str

 

 

externalId

str

 

 

fileCreateTime

timestamp

 

 

fileHash

str

 

 

fileId

str

 

 

fileModificationTime

timestamp

 

 

filePath

str

 

 

filePermission

str

 

 

fileType

str

 

 

fname

str

 

 

fsize

int8

 

 

in

int8

 

 

msg

str

 

 

oldFileCreateTime

timestamp

 

 

oldFileHash

str

 

 

oldFileId

str

 

 

oldFileModificationTime

timestamp

 

 

oldFileName

str

 

 

oldFilePath

str

 

 

oldFilePermission

str

 

 

oldFileSize

int8

 

 

oldFileType

str

 

 

outcome

str

 

 

out

int8

 

 

proto

str

 

 

reason

str

 

 

requestClientApplication

str

 

 

requestCookies

str

 

 

requestMethod

str

 

 

request

str

 

 

rt

timestamp

 

 

shost

str

 

 

smac

str

 

 

sntdom

str

 

 

sourceDnsDomain

str

 

 

sourceServiceName

str

 

 

sourceTranslatedAddress

ip4

 

 

sourceTranslatedPort

int4

 

 

spid

int4

 

 

spriv

str

 

 

sproc

str

 

 

spt

int4

 

 

src

ip4

 

 

start

timestamp

 

 

suid

str

 

 

suser

str

 

 

catdt

str

 

 

deviceDomain

str

 

 

deviceSeverity

str

 

 

dpt

int4

 

 

dtz

str

 

 

dvcmac

str

 

 

endTime

str

 

 

eventId

str

 

 

flexNumber1

str

 

 

flexNumber1Label

str

 

 

flexNumber2

str

 

 

flexNumber2Label

str

 

 

flexString1

str

 

 

flexString1Label

str

 

 

flexString2

str

 

 

flexString2Label

str

 

 

modelConfidence

int4

 

 

priority

int4

 

 

relevance

int4

 

 

requestContext

str

 

 

sessionId

str

 

 

slat

float8

 

 

slong

float8

 

 

dlat

float8

 

 

dlong

float8

 

 

sourceGeoCountryCode

str

 

 

sourceGeoLocationInfo

str

 

 

sourceGeoPostalCode

str

 

 

sourceGeoRegionCode

str

 

 

destinationGeoCountryCode

str

 

 

destinationGeoLocationInfo

str

 

 

destinationGeoPostalCode

str

 

 

destinationGeoRegionCode

str

 

 

agt

ip4

 

 

ahost

str

 

 

art

str

 

 

atz

str

 

 

mrt

timestamp

 

 

categoryBehavior

str

 

 

categoryCustomFormatField

str

 

 

categoryDeviceGroup

str

 

 

categoryObject

str

 

 

categoryOutcome

str

 

 

categorySignificance

str

 

 

categoryTechnique

str

 

 

categoryTupleDescription

str

 

 

assetCriticality

str

 

 

customerID

str

 

 

customerURI

str

 

 

tag

str

cefTag

✓

rawMessage

str

 

✓

hostchain

str

 

✓

cef0.juniper.junos

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

priorityCode

str

 

 

cefTag

str

 

 

cefVersion

str

 

 

embDeviceVendor

str

 

 

embDeviceProduct

str

 

 

deviceVersion

str

 

 

signatureID

str

 

 

name

str

 

 

severity

str

 

 

_cefVer

str

 

 

act

str

 

 

app

str

 

 

cat

str

 

 

c6a1Label

str

 

 

c6a1

str

 

 

c6a2Label

str

 

 

c6a2

str

 

 

c6a3Label

str

 

 

c6a3

str

 

 

c6a4Label

str

 

 

c6a4

str

 

 

cfp1Label

str

 

 

cfp1

float8

 

 

cfp2Label

str

 

 

cfp2

float8

 

 

cfp3Label

str

 

 

cfp3

float8

 

 

cfp4Label

str

 

 

cfp4

float8

 

 

cn1Label

str

 

 

cn1

int8

 

 

cn2Label

str

 

 

cn2

int8

 

 

cn3Label

str

 

 

cn3

int8

 

 

cnt

int4

 

 

cs1Label

str

 

 

cs1

str

 

 

cs2Label

str

 

 

cs2

str

 

 

cs3Label

str

 

 

cs3

str

 

 

cs4Label

str

 

 

cs4

str

 

 

cs5Label

str

 

 

cs5

str

 

 

cs6Label

str

 

 

cs6

str

 

 

destinationDnsDomain

str

 

 

destinationServiceName

str

 

 

destinationTranslatedAddress

ip4

 

 

destinationTranslatedPort

int4

 

 

deviceCustomDate1Label

str

 

 

deviceCustomDate1

timestamp

 

 

deviceCustomDate2Label

str

 

 

deviceCustomDate2

timestamp

 

 

deviceDirection

int4

 

 

deviceDnsDomain

str

 

 

deviceExternalId

str

 

 

deviceInboundInterface

str

 

 

deviceMacAddress

str

 

 

deviceNtDomain

str

 

 

deviceOutboundInterface

str

 

 

deviceProcessName

str

 

 

deviceTranslatedAddress

ip4

 

 

dhost

str

 

 

dmac

str

 

 

dntdom

str

 

 

dpid

int4

 

 

dpriv

str

 

 

dproc

str

 

 

dst

ip4

 

 

duid

str

 

 

duser

str

 

 

dvchost

str

 

 

dvc

ip4

 

 

dvcpid

int4

 

 

end

timestamp

 

 

deviceFacility

str

 

 

externalId

str

 

 

fileCreateTime

timestamp

 

 

fileHash

str

 

 

fileId

str

 

 

fileModificationTime

timestamp

 

 

filePath

str

 

 

filePermission

str

 

 

fileType

str

 

 

fname

str

 

 

fsize

int8

 

 

in

int8

 

 

msg

str

 

 

oldFileCreateTime

timestamp

 

 

oldFileHash

str

 

 

oldFileId

str

 

 

oldFileModificationTime

timestamp

 

 

oldFileName

str

 

 

oldFilePath

str

 

 

oldFilePermission

str

 

 

oldFileSize

int8

 

 

oldFileType

str

 

 

outcome

str

 

 

out

int8

 

 

proto

str

 

 

reason

str

 

 

requestClientApplication

str

 

 

requestCookies

str

 

 

requestMethod

str

 

 

request

str

 

 

rt

timestamp

 

 

shost

str

 

 

smac

str

 

 

sntdom

str

 

 

sourceDnsDomain

str

 

 

sourceServiceName

str

 

 

sourceTranslatedAddress

ip4

 

 

sourceTranslatedPort

int4

 

 

spid

int4

 

 

spriv

str

 

 

sproc

str

 

 

spt

int4

 

 

src

ip4

 

 

start

timestamp

 

 

suid

str

 

 

suser

str

 

 

catdt

str

 

 

deviceDomain

str

 

 

deviceSeverity

str

 

 

dpt

int4

 

 

dtz

str

 

 

dvcmac

str

 

 

endTime

str

 

 

eventId

str

 

 

flexNumber1

str

 

 

flexNumber1Label

str

 

 

flexNumber2

str

 

 

flexNumber2Label

str

 

 

flexString1

str

 

 

flexString1Label

str

 

 

flexString2

str

 

 

flexString2Label

str

 

 

modelConfidence

int4

 

 

priority

int4

 

 

relevance

int4

 

 

requestContext

str

 

 

sessionId

str

 

 

slat

float8

 

 

slong

float8

 

 

dlat

float8

 

 

dlong

float8

 

 

sourceGeoCountryCode

str

 

 

sourceGeoLocationInfo

str

 

 

sourceGeoPostalCode

str

 

 

sourceGeoRegionCode

str

 

 

destinationGeoCountryCode

str

 

 

destinationGeoLocationInfo

str

 

 

destinationGeoPostalCode

str

 

 

destinationGeoRegionCode

str

 

 

agt

ip4

 

 

ahost

str

 

 

art

str

 

 

atz

str

 

 

mrt

timestamp

 

 

categoryBehavior

str

 

 

categoryCustomFormatField

str

 

 

categoryDeviceGroup

str

 

 

categoryObject

str

 

 

categoryOutcome

str

 

 

categorySignificance

str

 

 

categoryTechnique

str

 

 

categoryTupleDescription

str

 

 

assetCriticality

str

 

 

customerID

str

 

 

customerURI

str

 

 

tag

str

cefTag

✓

rawMessage

str

 

✓

hostchain

str

 

✓

cef0.juniper.netscreenVpn

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

priorityCode

str

 

 

cefTag

str

 

 

cefVersion

str

 

 

embDeviceVendor

str

 

 

embDeviceProduct

str

 

 

deviceVersion

str

 

 

signatureID

str

 

 

name

str

 

 

severity

str

 

 

_cefVer

str

 

 

cat

str

 

 

cn1Label

str

 

 

cn1

int8

 

 

cn2Label

str

 

 

cn2

int8

 

 

cn3Label

str

 

 

cn3

int8

 

 

cnt

int4

 

 

cs1Label

str

 

 

cs1

str

 

 

cs2Label

str

 

 

cs2

str

 

 

cs4Label

str

 

 

cs4

str

 

 

cs5Label

str

 

 

cs5

str

 

 

dhost

str

 

 

dst

ip4

 

 

duser

str

 

 

dvchost

str

 

 

dvc

ip4

 

 

deviceFacility

str

 

 

filePath

str

 

 

fileType

str

 

 

fname

str

 

 

msg

str

 

 

out

int8

 

 

requestMethod

str

 

 

rt

timestamp

 

 

shost

str

 

 

spriv

str

 

 

sproc

str

 

 

src

ip4

 

 

suser

str

 

 

agt

ip4

 

 

ahost

str

 

 

aid

str

 

 

arcSightEventPath

str

 

 

art

str

 

 

assetCriticality

int4

 

 

at

str

 

 

atz

str

 

 

av

str

 

 

catdt

str

 

 

categoryBehavior

str

 

 

categoryDeviceGroup

str

 

 

categoryObject

str

 

 

categoryOutcome

str

 

 

categorySignificance

str

 

 

customerID

str

 

 

customerURI

str

 

 

destinationAssetId

str

 

 

destinationGeoCountryCode

str

 

 

destinationGeoLocationInfo

str

 

 

destinationGeoRegionCode

str

 

 

destinationZoneID

str

 

 

destinationZoneURI

str

 

 

deviceAssetId

str

 

 

deviceSeverity

str

 

 

deviceZoneID

str

 

 

deviceZoneURI

str

 

 

dlat

float8

 

 

dlong

float8

 

 

dpt

int4

 

 

dtz

str

 

 

eventAnnotationAuditTrail

str

 

 

eventAnnotationEndTime

timestamp

 

 

eventAnnotationEventId

str

 

 

eventAnnotationFlags

str

 

 

eventAnnotationManagerReceiptTime

timestamp

 

 

eventAnnotationModificationTime

timestamp

 

 

eventAnnotationStageID

str

 

 

eventAnnotationStageUpdateTime

timestamp

 

 

eventAnnotationStageURI

str

 

 

eventAnnotationVersion

int4

 

 

eventId

str

 

 

generatorID

str

 

 

locality

int4

 

 

modelConfidence

int4

 

 

mrt

timestamp

 

 

priority

int4

 

 

relevance

int4

 

 

slat

float8

 

 

slong

float8

 

 

sourceGeoCountryCode

str

 

 

sourceGeoLocationInfo

str

 

 

sourceGeoRegionCode

str

 

 

sourceZoneID

str

 

 

sourceZoneURI

str

 

 

type

str

 

 

tag

str

cefTag

✓

rawMessage

str

 

✓

hostchain

str

 

✓

cef0.juniper.nsm

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

priorityCode

str

 

 

cefTag

str

 

 

cefVersion

str

 

 

embDeviceVendor

str

 

 

embDeviceProduct

str

 

 

deviceVersion

str

 

 

signatureID

str

 

 

name

str

 

 

severity

str

 

 

_cefVer

str

 

 

act

str

 

 

app

str

 

 

cat

str

 

 

c6a1Label

str

 

 

c6a1

str

 

 

c6a2Label

str

 

 

c6a2

str

 

 

c6a3Label

str

 

 

c6a3

str

 

 

c6a4Label

str

 

 

c6a4

str

 

 

cfp1Label

str

 

 

cfp1

float8

 

 

cfp2Label

str

 

 

cfp2

float8

 

 

cfp3Label

str

 

 

cfp3

float8

 

 

cfp4Label

str

 

 

cfp4

float8

 

 

cn1Label

str

 

 

cn1

int8

 

 

cn2Label

str

 

 

cn2

int8

 

 

cn3Label

str

 

 

cn3

int8

 

 

cnt

int4

 

 

cs1Label

str

 

 

cs1

str

 

 

cs2Label

str

 

 

cs2

str

 

 

cs3Label

str

 

 

cs3

str

 

 

cs4Label

str

 

 

cs4

str

 

 

cs5Label

str

 

 

cs5

str

 

 

cs6Label

str

 

 

cs6

str

 

 

destinationDnsDomain

str

 

 

destinationServiceName

str

 

 

destinationTranslatedAddress

ip4

 

 

destinationTranslatedPort

int4

 

 

deviceCustomDate1Label

str

 

 

deviceCustomDate1

timestamp

 

 

deviceCustomDate2Label

str

 

 

deviceCustomDate2

timestamp

 

 

deviceDirection

int4

 

 

deviceDnsDomain

str

 

 

deviceExternalId

str

 

 

deviceInboundInterface

str

 

 

deviceMacAddress

str

 

 

deviceNtDomain

str

 

 

deviceOutboundInterface

str

 

 

deviceProcessName

str

 

 

deviceTranslatedAddress

ip4

 

 

dhost

str

 

 

dmac

str

 

 

dntdom

str

 

 

dpid

int4

 

 

dpriv

str

 

 

dproc

str

 

 

dst

ip4

 

 

duid

str

 

 

duser

str

 

 

dvchost

str

 

 

dvc

ip4

 

 

dvcpid

int4

 

 

end

timestamp

 

 

deviceFacility

str

 

 

externalId

str

 

 

fileCreateTime

timestamp

 

 

fileHash

str

 

 

fileId

str

 

 

fileModificationTime

timestamp

 

 

filePath

str

 

 

filePermission

str

 

 

fileType

str

 

 

fname

str

 

 

fsize

int8

 

 

in

int8

 

 

msg

str

 

 

oldFileCreateTime

timestamp

 

 

oldFileHash

str

 

 

oldFileId

str

 

 

oldFileModificationTime

timestamp

 

 

oldFileName

str

 

 

oldFilePath

str

 

 

oldFilePermission

str

 

 

oldFileSize

int8

 

 

oldFileType

str

 

 

outcome

str

 

 

out

int8

 

 

proto

str

 

 

reason

str

 

 

requestClientApplication

str

 

 

requestCookies

str

 

 

requestMethod

str

 

 

request

str

 

 

rt

timestamp

 

 

shost

str

 

 

smac

str

 

 

sntdom

str

 

 

sourceDnsDomain

str

 

 

sourceServiceName

str

 

 

sourceTranslatedAddress

ip4

 

 

sourceTranslatedPort

int4

 

 

spid

int4

 

 

spriv

str

 

 

sproc

str

 

 

spt

int4

 

 

src

ip4

 

 

start

timestamp

 

 

suid

str

 

 

suser

str

 

 

catdt

str

 

 

deviceDomain

str

 

 

deviceSeverity

str

 

 

dpt

int4

 

 

dtz

str

 

 

dvcmac

str

 

 

endTime

str

 

 

eventId

str

 

 

flexNumber1

str

 

 

flexNumber1Label

str

 

 

flexNumber2

str

 

 

flexNumber2Label

str

 

 

flexString1

str

 

 

flexString1Label

str

 

 

flexString2

str

 

 

flexString2Label

str

 

 

modelConfidence

int4

 

 

priority

int4

 

 

relevance

int4

 

 

requestContext

str

 

 

sessionId

str

 

 

slat

float8

 

 

slong

float8

 

 

dlat

float8

 

 

dlong

float8

 

 

sourceGeoCountryCode

str

 

 

sourceGeoLocationInfo

str

 

 

sourceGeoPostalCode

str

 

 

sourceGeoRegionCode

str

 

 

destinationGeoCountryCode

str

 

 

destinationGeoLocationInfo

str

 

 

destinationGeoPostalCode

str

 

 

destinationGeoRegionCode

str

 

 

agt

ip4

 

 

ahost

str

 

 

art

str

 

 

atz

str

 

 

mrt

timestamp

 

 

categoryBehavior

str

 

 

categoryCustomFormatField

str

 

 

categoryDeviceGroup

str

 

 

categoryObject

str

 

 

categoryOutcome

str

 

 

categorySignificance

str

 

 

categoryTechnique

str

 

 

categoryTupleDescription

str

 

 

assetCriticality

str

 

 

customerID

str

 

 

customerURI

str

 

 

tag

str

cefTag

✓

rawMessage

str

 

✓

hostchain

str

 

✓