Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/unifiInstalls 5 parsers and 2 scenarios.
View UniFi →Installation
sudo cscli parsers install crowdsecurity/cef-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
filter: "evt.Line.Labels.type == 'cef'"onsuccess: next_stagepattern_syntax:CEF_HEADER: '(CEF:)?%{SPACE}%{INT:cef_version}\|%{DATA:cef_device_vendor}\|%{DATA:cef_device_product}\|%{DATA:cef_device_version}\|%{DATA:cef_signature_id}\|%{DATA:cef_event_name}\|%{INT:cef_severity}'CEF_SYSLOG_OPTIONAL: '(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601})(?: %{DATA:hostname})? ?'name: crowdsecurity/cef-logsdescription: CEF (Common Event Format) logs parsernodes:- grok:pattern: "^%{CEF_SYSLOG_OPTIONAL}?%{CEF_HEADER}%{SPACE}\\|?%{GREEDYDATA:message}"apply_on: Line.Rawstatics:- parsed: "program"expression: evt.Parsed.cef_device_vendor- parsed: "logsource"value: "cef"# syslog timestamp can be in two different fields (one of the assignment will fail)- target: evt.StrTimeexpression: evt.Parsed.timestamp- target: evt.StrTimeexpression: evt.Parsed.timestamp8601- meta: datasource_pathexpression: evt.Line.Src- meta: datasource_typeexpression: evt.Line.Module
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
CEF parser
This parser handles logs in the Common Event Format (CEF), a standardized logging format used by various security devices and applications.
The parser extracts key CEF fields including the device vendor (manufacturer), product, version, signature ID, event name, and severity level.
CEF Format
The parser handles the standard CEF format:
1CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension
Requirements
When using this parser, you need to specify type: cef in your acquis.yaml configuration. The parser will automatically extract the manufacturer from the Device Vendor field and set it as the program field for downstream processing.
Example configuration
1source: file2filenames:3 - /var/log/cef/*.log4labels:5 type: cef
Extracted fields
The parser extracts the following CEF fields:
cef_device_vendor- The device manufacturer/vendorcef_device_product- The product namecef_device_version- The product versioncef_signature_id- Unique event signature identifiercef_event_name- Human-readable event namecef_severity- Event severity level (0-10)message- Any additional extension data or message content
The cef_device_vendor field is also mapped to the program field for compatibility with other parsers.