thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Common Event Format (CEF)

A standardized text-based log format developed by ArcSight for interoperable security event reporting.

Definition

CEF messages have a header with pipe-separated fields (version, vendor, product, version, signature ID, name, severity) followed by key-value extensions, usually transported over syslog. Many SIEMs, including Microsoft Sentinel and QRadar, ingest CEF. LEEF is IBM's similar format.

Example

CEF:0|Palo Alto Networks|PAN-OS|11.1|THREAT|virus|8|src=10.1.1.5 dst=203.0.113.9

Exam tip

CEF is often sent over syslog to a forwarder; know it is a format, not a transport.

Related terms