Decode CEF processor fields fields

Version of the CEF specification used by the message.

type: keyword

Vendor of the device that produced the message.

type: keyword

Product of the device that produced the message.

type: keyword

Version of the product that produced the message.

type: keyword

Unique identifier of the event type.

type: keyword

Importance of the event. The valid string values are Unknown, Low, Medium, High, and Very-High. The valid integer values are 0-3=Low, 4-6=Medium, 7- 8=High, and 9-10=Very-High.

type: keyword

example: Very-High

Short description of the event.

type: keyword

The IP address of the ArcSight connector that processed the event.

type: ip

The DNS domain name of the ArcSight connector that processed the event.

type: keyword

The hostname of the ArcSight connector that processed the event.

type: keyword

The agent ID of the ArcSight connector that processed the event.

type: keyword

The MAC address of the ArcSight connector that processed the event.

type: keyword

None

type: keyword

The time at which information about the event was received by the ArcSight connector.

type: date

The agent time zone of the ArcSight connector that processed the event.

type: keyword

None

type: ip

None

type: keyword

None

type: keyword

The agent type of the ArcSight connector that processed the event

type: keyword

The version of the ArcSight connector that processed the event.

type: keyword

None

type: keyword

None

type: keyword

Application level protocol, example values are HTTP, HTTPS, SSHv2, Telnet, POP, IMPA, IMAPS, and so on.

type: keyword

A count associated with this event. How many times was this same event observed? Count can be omitted if it is 1.

type: long

Number of bytes transferred inbound, relative to the source to destination relationship, meaning that data was flowing from source to destination.

type: long

Number of bytes transferred outbound relative to the source to destination relationship. For example, the byte number of data flowing from the destination to the source.

type: long

None

type: keyword

None

type: keyword

Identifies the destination address that the event refers to in an IP network. The format is an IPv4 address.

type: ip

The DNS domain part of the complete fully qualified domain name (FQDN).

type: keyword

The latitudinal value from which the destination’s IP address belongs.

type: double

The longitudinal value from which the destination’s IP address belongs.

type: double

Identifies the destination that an event refers to in an IP network. The format should be a fully qualified domain name (FQDN) associated with the destination node, when a node is available.

type: keyword

Six colon-seperated hexadecimal numbers.

type: keyword

The Windows domain name of the destination address.

type: keyword

The valid port numbers are between 0 and 65535.

type: long

Provides the ID of the destination process associated with the event. For example, if an event contains process ID 105, "105" is the process ID.

type: long

The name of the event’s destination process.

type: keyword

The service targeted by this event.

type: keyword

Identifies the translated destination that the event refers to in an IP network.

type: ip

Port after it was translated; for example, a firewall. Valid port numbers are 0 to 65535.

type: long

None

type: keyword

The URI for the Translated Zone that the destination asset has been assigned to in ArcSight.

type: keyword

Identifies the destination user by ID. For example, in UNIX, the root user is generally associated with user ID 0.

type: keyword

Identifies the destination user by name. This is the user associated with the event’s destination. Email addresses are often mapped into the UserName fields. The recipient is a candidate to put into this field.

type: keyword

The typical values are "Administrator", "User", and "Guest". This identifies the destination user’s privileges. In UNIX, for example, activity executed on the root user would be identified with destinationUser Privileges of "Administrator".

type: keyword

None

type: keyword

The URI for the Zone that the destination asset has been assigned to in ArcSight.

type: keyword

Action taken by the device.

type: keyword

Identifies the device address that an event refers to in an IP network.

type: ip

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of two timestamp fields available to map fields that do not apply to any other in this dictionary.

type: date

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of two timestamp fields available to map fields that do not apply to any other in this dictionary.

type: date

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of four floating point fields available to map fields that do not apply to any other in this dictionary.

type: double

One of four floating point fields available to map fields that do not apply to any other in this dictionary.

type: double

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of four floating point fields available to map fields that do not apply to any other in this dictionary.

type: double

One of four floating point fields available to map fields that do not apply to any other in this dictionary.

type: double

One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.

type: ip

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.

type: ip

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.

type: ip

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.

type: ip

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: long

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: long

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: long

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: keyword

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: keyword

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: keyword

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: keyword

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: keyword

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: keyword

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

Any information about what direction the observed communication has taken. The following values are supported - "0" for inbound or "1" for outbound.

type: long

The DNS domain part of the complete fully qualified domain name (FQDN).

type: keyword

Represents the category assigned by the originating device. Devices often use their own categorization schema to classify event. Example "/Monitor/Disk/Read".

type: keyword

A name that uniquely identifies the device generating this event.

type: keyword

The facility generating this event. For example, Syslog has an explicit facility associated with every event.

type: keyword

One of two alternative number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: long

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

One of two alternative number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

type: long

All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.

type: keyword

The format should be a fully qualified domain name (FQDN) associated with the device node, when a node is available.

type: keyword

Interface on which the packet or data entered the device.

type: keyword

Six colon-separated hexadecimal numbers.

type: keyword

The Windows domain name of the device address.

type: keyword

Interface on which the packet or data left the device.

type: keyword

Unique identifier for the payload associated with the event.

type: keyword

Provides the ID of the process on the device generating the event.

type: long

Process name associated with the event. An example might be the process generating the syslog entry in UNIX.

type: keyword

The time at which the event related to the activity was received. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970)

type: date

The time zone for the device generating the event.

type: keyword

Identifies the translated device address that the event refers to in an IP network.

type: ip

None

type: keyword

The URI for the Translated Zone that the device asset has been assigned to in ArcSight.

type: keyword

None

type: keyword

Thee URI for the Zone that the device asset has been assigned to in ArcSight.

type: keyword

The time at which the activity related to the event ended. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st1970). An example would be reporting the end of a session.

type: date

This is a unique ID that ArcSight assigns to each event.

type: long

Displays the outcome, usually as success or failure.

type: keyword

The ID used by an originating device. They are usually increasing numbers, associated with events.

type: keyword

Time when the file was created.

type: date

Hash of a file.

type: keyword

An ID associated with a file could be the inode.

type: keyword

Time when the file was last modified.

type: date

Name of the file only (without its path).

type: keyword

Full path to the file, including file name itself.

type: keyword

Permissions of the file.

type: keyword

Size of the file.

type: long

Type of file (pipe, socket, etc.)

type: keyword

A timestamp field available to map a timestamp that does not apply to any other defined timestamp field in this dictionary. Use all flex fields sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary.

type: date

The label field is a string and describes the purpose of the flex field.

type: keyword

One of four floating point fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary.

type: keyword

One of four floating point fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary.

type: keyword

The label field is a string and describes the purpose of the flex field.

type: keyword

The label field is a string and describes the purpose of the flex field.

type: keyword

An arbitrary message giving more details about the event. Multi-line entries can be produced by using \n as the new line separator.

type: keyword

Time when old file was created.

type: date

Hash of the old file.

type: keyword

An ID associated with the old file could be the inode.

type: keyword

Time when old file was last modified.

type: date

Name of the old file.

type: keyword

Full path to the old file, including the file name itself.

type: keyword

Permissions of the old file.

type: keyword

Size of the old file.

type: long

Type of the old file (pipe, socket, etc.)

type: keyword

None

type: keyword

The reason an audit event was generated. For example "bad password" or "unknown user". This could also be an error or return code. Example "0x1234".

type: keyword

The User-Agent associated with the request.

type: keyword

Description of the content from which the request originated (for example, HTTP Referrer)

type: keyword

Cookies associated with the request.

type: keyword

The HTTP method used to access a URL.

type: keyword

In the case of an HTTP request, this field contains the URL accessed. The URL should contain the protocol as well.

type: keyword

Identifies the source that an event refers to in an IP network.

type: ip

The DNS domain part of the complete fully qualified domain name (FQDN).

type: keyword

None

type: double

None

type: double

Identifies the source that an event refers to in an IP network. The format should be a fully qualified domain name (FQDN) associated with the source node, when a mode is available. Examples: host or host.domain.com.

type: keyword

Six colon-separated hexadecimal numbers.

type: keyword

example: 00:0d:60:af:1b:61

The Windows domain name for the source address.

type: keyword

The valid port numbers are 0 to 65535.

type: long

The ID of the source process associated with the event.

type: long

The name of the event’s source process.

type: keyword

The service that is responsible for generating this event.

type: keyword

Identifies the translated source that the event refers to in an IP network.

type: ip

A port number after being translated by, for example, a firewall. Valid port numbers are 0 to 65535.

type: long

None

type: keyword

The URI for the Translated Zone that the destination asset has been assigned to in ArcSight.

type: keyword

Identifies the source user by ID. This is the user associated with the source of the event. For example, in UNIX, the root user is generally associated with user ID 0.

type: keyword

Identifies the source user by name. Email addresses are also mapped into the UserName fields. The sender is a candidate to put into this field.

type: keyword

The typical values are "Administrator", "User", and "Guest". It identifies the source user’s privileges. In UNIX, for example, activity executed by the root user would be identified with "Administrator".

type: keyword

None

type: keyword

The URI for the Zone that the source asset has been assigned to in ArcSight.

type: keyword

The time when the activity the event referred to started. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970)

type: date

Identifies the Layer-4 protocol used. The possible values are protocols such as TCP or UDP.

type: keyword

0 means base event, 1 means aggregated, 2 means correlation, and 3 means action. This field can be omitted for base events (type 0).

type: long

Device type. Examples - Proxy, IDS, Web Server

type: keyword

Object that the event is about. For example it can be an operating sytem, database, file, etc.

type: keyword

Action or a behavior associated with an event. It’s what is being done to the object.

type: keyword

Technique being used (e.g. /DoS).

type: keyword

General device group like Firewall.

type: keyword

Characterization of the importance of the event.

type: keyword

Outcome of the event (e.g. sucess, failure, or attempt).

type: keyword

When the Arcsight ESM received the event.

type: date

Service that is the source of the event.

type: keyword

Service that is the target of the event.

type: keyword