Common Event Format (CEF)

Common Event Format (CEF) is an interoperability standard for event- or log-generating devices. If your Trellix Enterprise Security Manager - Event Receiver doesn't support a specific vendor or model, follow this standard to deliver CEF-formatted events to your Trellix Enterprise Security Manager - Event Receiver.

The message is formatted using a common prefix composed of fields delimited by a bar (|) character. The prefix is mandatory and all specified fields must be present. Additional fields are specified in the extension. The format is:

The extension part of the message is a placeholder for additional fields. Following are definitions for the prefix fields:

Version— Integer that identifies the version of the CEF format
Event consumers use this information to determine what the fields represent. Currently only version 0 (zero) is established in the above format.
Device Vendor, Device Product, and Device Version — Strings that uniquely identify the type of sending device
No 2 products can use the same device-vendor and device-product pair. Event producers ensure that they assign unique name pairs.
DeviceEventClassId — Unique identifier per event-type (can be a string or an integer)
Each signature or rule that detects certain activity has a unique deviceEventClassId assigned. This is a requirement helps correlation engines deal with the events.
Name — String describing the event, such as Port scan
Severity — Integer (between 0-10, where 10 indicates the most important event) that reflects event importance
Extension — Collection of key-value pairs, where the keys are part of a predefined set
Events can contain any number of key-value pairs in any order, separated by spaces. If a field contains a space, such as a file name, this is okay and can be logged on exactly that manner. For example: fileName=c:\Program Files\ArcSight is a valid token.

This sample message shows appearance:

If you use NetWitness, configure your device to send the CEF to the Receiver. By default, the CEF format when using NetWitness looks as follows:

CEF:0|Netwitness|Informer|1.6|{name}|{name}|Medium | externalId={#sessionid} proto={#ip.proto} categorySignificance=/Normal categoryBehavior=/Authentication/Verify categoryDeviceGroup=/OS categoryOutcome=/Attempt categoryObject=/Host/Application/Service act={#action} deviceDirection=0 shost={#ip.host} src={#ip.src} spt={#tcp.srcport} dhost={#ip.host} dst={#ip.dst} dport={#tcp.dstport} duser={#username} dproc=27444 fileType=security cs1={#did} cs2={#password} cs3=4 cs4=5 cn1={#rid} cn2=0 cn3=0

The correct format requires you to change dport above to dpt.