Document toolboxDocument toolbox

cef0.symantec

Introduction

Tables beginning with cef0.symantec identify events in CEF format generated by Symantec Endpoint Protection services.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

Product / Service

Tags

Data tables

Product / Service

Tags

Data tables

Symantec Endpoint Protection

cef0.symantec.antivirus

cef0.symantec.antivirus

cef0.symantec.dlp

cef0.symantec.dlp

cef0.symantec.endpointProtection

cef0.symantec.endpointProtection

cef0.symantec.mailSecurityAppliance

cef0.symantec.mailSecurityAppliance

cef0.symantec.symantec

cef0.symantec.symantec

cef0.symantec.symantecEndpointProtectionMobile

cef0.symantec.symantecEndpointProtectionMobile

cef0.symantec.wssProxy

cef0.symantec.wssProxy

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Table structure

These are the fields displayed in this table: