cef0.swift

[ 1 Introduction ] [ 2 Tag structure ] [ 3 How is the data sent to Devo? ] [ 4 Table structure ]

Introduction

Tables beginning withcef0.swift identify events in CEF format generated by Swift technologies.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

Tags	Data tables

Tags	Data tables
`cef0.swift.allianceAccess`	`cef0.swift.allianceAccess`
`cef0.swift.allianceWebPlatform`	`cef0.swift.allianceWebPlatform`
`cef0.swift.swiftnetLink`	`cef0.swift.swiftnetLink`

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Table structure

These are the fields displayed in this table:

cef0.swift.allianceAccess

Field	Type	Source field name	Extra fields

Field	Type	Source field name	Extra fields
eventdate	timestamp
hostname	str
priorityCode	str
cefTag	str
cefVersion	str
embDeviceVendor	str
embDeviceProduct	str
deviceVersion	str
signatureID	str
name	str
severity	str
cat	str
cn1Label	str
cn1	int8
cn2Label	str
cn2	int8
cs1Label	str
cs1	str
deviceProcessName	str
dvchost	str
dvc	ip4
dvcmac	str
msg	str
rt	timestamp
shost	str
src	ip4
dtz	str
hostchain	str		✓
tag	str	cefTag	✓
rawMessage	str		✓

cef0.swift.allianceWebPlatform

Field	Type	Source field name	Extra fields

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`		✓
priorityCode	`str`		✓
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
cat	`str`
cn1Label	`str`
cn1	`int8`
cs1Label	`str`
cs1	`str`
cs3Label	`str`
cs3	`str`
deviceProcessName	`str`
dvchost	`str`
dvc	`ip4`
dvcmac	`str`
msg	`str`
rt	`timestamp`
src	`ip4`
suid	`str`
dtz	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

cef0.swift.swiftnetLink

Field	Type	Source field name	Extra fields

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`		✓
priorityCode	`str`		✓
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
cat	`str`
cn1Label	`str`
cn1	`int8`
deviceProcessName	`str`
dvchost	`str`
msg	`str`
rt	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓