FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

What is CEF (Common Event Format); which TR7 logs can be sent in CEF format? ​

Short answer

CEF (Common Event Format) is a log format developed by ArcSight and widely used in the security industry (OpenText · Implementing ArcSight CEF): it contains a fixed header separated by | (CEF:Version|Device Vendor|Device Product|Device Version|Device Event Class ID|Name|Severity|) followed by an extension consisting of key=value fields; it is designed to be parsed easily by SIEMs. In TR7, it is selected in three places: CEF Format and Manual CEF Format in the Line Format list of the Logs profile assigned to the vService (vService access logs; on an HTTP vService, the CEF Format line also carries the WAF fields), CEF (Common Event Format) in the Message Format field of the Log Forwarding profile through which device logs are sent, and CEF in the Message Format field of the AGS Log Forwarding profile.

Where It Is Used in TR7 ​

WhereField / labelWhat for
Load Balancer → Profiles → LogsLine Format → CEF FormatvService access logs; in HTTP, the request details and the WAF fields (isWafAttack, wafInfo), in L7 TCP, the connection fields (TCP CEF)
Same fieldManual CEF FormatBuilding the extension fields with self-chosen variables
Settings → General Settings → Log ForwardingMessage Format → CEF (Common Event Format)User, Notification, GTM and Health Check logs; L4 DDoS quarantine entries, if the profile is selected in the Quarantine Log Forwarding field of the route table
AGS → Integrations → Log ForwardingMessage Format → CEF (Common Event Format)AGS audit events

CEF Headers in TR7 ​

SourceHeaderSeverity
Logs profile, CEF Format (HTTP)CEF:0|TR7|TR7 ASP|v1.9|<status-code>|<response-source>|5|name=<vService-name> …Fixed 5
Log Forwarding, CEFCEF:0|TR7|LogTransport|1.0|<log-source>|<message>|<severity>|sev=… …info 3, warning 5, error 7, critical 10
AGS Log Forwarding, CEFCEF:0|TR7|LogTransport|1.0|agsAuditLogs|<message>|<severity>|…info 3, warning 5, error 7, critical 10

Common Misconceptions ​

  • "CEF is only for WAF logs." CEF can also be selected for vService access logs, device logs and AGS audit events.
  • "If there is an attack in the CEF line, a separate log type comes." The CEF Format line of the Logs profile comes with the same header on every request; the attack information is in the isWafAttack and wafInfo fields, and if there is no attack, wafInfo is an empty object.
  • "CEF in Log Forwarding and in the Logs profile is the same format." The two produce different headers and fields; CEF in Log Forwarding is for device logs.

How it is done in the documentation

Related questions