These are the event forwarding formats and the information contained in the packets when they are forwarded.
Format | Source | Contents |
|---|---|---|
Syslog (Common Event Format) | Logs | <#>date_and_time ESM_IP epoch_time;status_flag;user_name;log_category_name;device_group_name;device_name;log_message <#>2023-02-09T23:05:05.0Z 10.45.200.3 1675983905;0;NGCP;System;;Local ESM;Auto logged out |
Events | <#>date_and_time ESM_IP CEF_version|vendor|product|version|sig_id|sig_message|severity|event_data <#>2023-02-09T23:56:54.610Z 10.45.200.3 CEF:0|ESM|ESM|11.6.2|38-2001117|ET DNS Standard query response, Name Error|3|start=1675852656000 end=1675852656000 rt=1675987014000 cnt=1 deviceExternalId=Live SourceFire NS RNA deviceTranslatedAddress=10.45.200.1 externalId=13457989 cat=DNS Recon nitroNormID=147849216 act=informational proto=17 deviceDirection=0 dst=63.86.4.55 dpt=32771 src=69.20.32.1 spt=53 | |
Syslog (Standard Event Format) | Logs | <#>YYYY-MM-DDTHH:MM:SS.S [IP Address] ESM: {"source": {"id":144115188075855872,"name":"Local ESM"},"data":{"writetime":"2023-02-09T22:43:34Z","description":"User login via SSH. 2023-02-09 22:43:34.810 EntSecMgr sshd [18839]: Accepted password for root from 10.45.200.249 port 62080 ssh2","username":"0","logcategory":"Health Monitor","status":1}} |
Events | <#>YYYY-MM-DDTHH:MM:SS.S [IP Address] ESM: { "source": { "id": 144120685667549200, "name": "name of data source", "subnet": "::ffff:10.75.126.2/128" }, "fields": { "packet": { "encoding": "BASE64" } }, "data": { "alert_id": 1, "thirdpartytype": 49, "sig": { "id": 5000012, "name": "Random String Custom Type" }, "norm_sig": { "id": 1343225856, "name": "Misc Application Event" }, "action": "5", "src_ip": "65.254.48.200", "dst_ip": "0.0.0.0", "src_port": 38129, "dst_port": 0, "protocol": "n/a", "src_mac": "00:00:00:00:00:00", "dst_mac": "00:00:00:00:00:00", "src_asn_geo": 1423146310554370000, "firsttime": "2014-05-09T20:43:30Z", "lasttime": "2014-05-09T20:43:30Z", "writetime": "2014-05-09T20:44:01Z", "src_guid": "", "dst_guid": "", "total_severity": 25, "severity": 25, "eventcount": 1, "flow": "0", "vlan": "0", "sequence": 0, "trusted": 2, "session_id": 0, "compression_level": 10, "reviewed": 0, "a1_ran_string_CF1": "This is data for custom field 1" |