cscli parsers install crowdsecurity/cef-logsThis parser handles logs in the Common Event Format (CEF), a standardized logging format used by various security devices and applications.
The parser extracts key CEF fields including the device vendor (manufacturer), product, version, signature ID, event name, and severity level.
The parser handles the standard CEF format:
1CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension
When using this parser, you need to specify type: cef in your acquis.yaml configuration. The parser will automatically extract the manufacturer from the Device Vendor field and set it as the program field for downstream processing.
1source: file2filenames:3 - /var/log/cef/*.log4labels:5 type: cef
The parser extracts the following CEF fields:
cef_device_vendor - The device manufacturer/vendorcef_device_product - The product namecef_device_version - The product versioncef_signature_id - Unique event signature identifiercef_event_name - Human-readable event namecef_severity - Event severity level (0-10)message - Any additional extension data or message contentThe cef_device_vendor field is also mapped to the program field for compatibility with other parsers.
1filter: "evt.Line.Labels.type == 'cef'"2onsuccess: next_stage3pattern_syntax:4 CEF_HEADER: '(CEF:)?%{SPACE}%{INT:cef_version}\|%{DATA:cef_device_vendor}\|%{DATA:cef_device_product}\|%{DATA:cef_device_version}\|%{DATA:cef_signature_id}\|%{DATA:cef_event_name}\|%{INT:cef_severity}'5 CEF_SYSLOG_OPTIONAL: '(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601})(?: %{DATA:hostname})? ?'6name: crowdsecurity/cef-logs7description: CEF (Common Event Format) logs parser8nodes:9 - grok:10 pattern: "^%{CEF_SYSLOG_OPTIONAL}?%{CEF_HEADER}%{SPACE}\\|?%{GREEDYDATA:message}"11 apply_on: Line.Raw12statics:13 - parsed: "program"14 expression: evt.Parsed.cef_device_vendor15 - parsed: "logsource"16 value: "cef"17 # syslog timestamp can be in two different fields (one of the assignment will fail)18 - target: evt.StrTime19 expression: evt.Parsed.timestamp20 - target: evt.StrTime21 expression: evt.Parsed.timestamp860122 - meta: datasource_path23 expression: evt.Line.Src24 - meta: datasource_type25 expression: evt.Line.Module26