戻る
-
タイトル
Specific log message formats CEF amd LEEF. -
説明
This document describes specific log message formats Common Event Format (CEF) and LEEF. -
対策
Notes
- Log messages that use any syslog format with specific message part can be received and forwarded with the network() or syslog() driver.
- Specific log messages can be generated by using template() function at the destination configuration. The implementation is out of the scope of support.
CEF
- BSD syslog format
Jan 18 11:07:53 host message
- Specific message part
CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension
- Example log
SYSLOG HEADER CEF SPECIFIC MESSAGE PART
Sep 19 08:26:10 host CEF:0|security|threatmanager|1.0|100|worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2 spt=1232
For more information see attached format guide for Common Event Format (CEF).
LEEF
- BSD syslog format
Jan 18 11:07:53 host message
- Specific message part
LEEF:Version|Vendor|Product|Version|EventID|Event attributes
- Example log
SYSLOG HEADER LEEF SPECIFIC MESSAGE PART
Sep 19 08:26:10 host LEEF:1.0|Microsoft|Exchange|2013|Login Event|cat=Failed
For more information see attached format guide QRadar Leef.
-
添付ファイル