cef0.xss

Introduction

The tables beginning with cef0.xss identify events in CEF format generated by Zscaler products.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

cef0.xss.filtro_xss

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

cef0.xss.filtro_xss

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
dst	`ip4`
requestClientApplication	`str`
requestMethod	`str`
request	`str`
src	`ip4`
in	`int8`
rt	`timestamp`
out	`int8`
filePath	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedZoneID	`str`
destinationGeoCountryCode	`str`
sourceZoneID	`str`
slong	`str`
sourceGeoRegionCode	`str`
art	`str`
eventId	`str`
sourceGeoPostalCode	`str`
mrt	`str`
customerURI	`str`
dlat	`str`
sourceZoneURI	`str`
assetCriticality	`str`
destinationZoneID	`str`
destinationGeoLocationInfo	`str`
sourceGeoCountryCode	`str`
modelConfidence	`str`
destinationGeoPostalCode	`str`
slat	`str`
Severity	`str`
relevance	`str`
destinationGeoRegionCode	`str`
customerID	`str`
dlong	`str`
sourceTranslatedZoneURI	`str`
priority	`str`
sourceGeoLocationInfo	`str`
destinationZoneURI	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`