Selects the default delivery format for rsyslog notifications.
Syntax
[no] fenotify rsyslog trap-sink <sink_name> prefer message format <format_type>
Parameters
no
Disables rsyslog notification trap sinks.
sink_name
The name of the rsyslog notification trap sink.
format_type
The following default delivery formats are supported:
cef—Delivery in common event format (CEF).csv—Delivery in comma-separated values (CSV) format.leef—Delivery in log event enhanced format (LEEF).
Select one of the Text, JSON (JavaScript Object Notation), or XML options:
json-concise—Sends a notification in JSON CONCISE format containing basic information such as Alert type, ID, src_IP, malware name, hostname, and Alert URL.json-extended—Sends a notification in JSON EXTENDED format containing detailed information and abstracts including data-theft information (if any) and static analysis details. JSON Extended provides all details about files and objects modified during analysis.json-normal—Sends a notification in JSON NORMAL format containing detailed information and abstracts such as Alert type, ID, src_IP, malware name, hostname, and Alert URL without any redundant information.json-legacy-concise—Sends a notification in JSON legacy CONCISE format containing basic information such as Alert type, ID, src_IP, malware name, hostname, and Alert URL.json-legacy-extended—Sends a notification in JSON legacy EXTENDED format containing detailed information and abstracts including data-theft information (if any) and static analysis details. JSON legacy Extended provides all details about files and objects modified during analysis.json-legacy-normal—Sends a notification in JSON legacy NORMAL format containing detailed information and abstracts such as Alert type, ID, src_IP, malware name, hostname, and Alert URL without any redundant information.text-concisetext-concise—Sends a notification in TEXT CONCISE format containing basic information such as Alert type, ID, src_IP, malware name, hostname, and Alert URL.text-extended—Sends a notification in TEXT EXTENDED format containing detailed information and abstracts including data-theft information (if any) and static analysis details. TEXT Extended provides all details about files and objects modified during analysis.text-normal—Delivery in TEXT NORMAL format containing detailed information and abstracts such as Alert type, ID, src_IP, malware name, hostname, and Alert URL without any redundant information.xml-concise—Sends a notification in XML CONCISE format containing basic information such as Alert type, ID, src_IP, malware name, hostname, and Alert URL.xml-extended—Sends a notification in XML EXTENDED format containing detailed information and abstracts including data-theft information (if any) and static analysis details. XML Extended provides all details about files and objects modified during analysis.xml-normal—Sends a notification in XML NORMAL format containing detailed information and abstracts such as Alert type, ID, src_IP, malware name, hostname, and Alert URL without any redundant information.secureworks—Sends a notification in SecureWorks format.
Example
The following example selects CEF as the the default delivery format for rsyslog notifications:
hostname (config) # fenotify rsyslog trap-sink rk prefer message format cef
User role
Admin and Operator
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Email Security — Server: Before release 7.6
Endpoint Security (HX): Release 3.5.0
File Protect: Before release 7.6
Malware Analysis: Before release 7.6
Network Security: Before release 7.6