Syslog Content Mapping - CEF

Header (logVer)

CEF format version

String

CEF:0

Header (vendor)

Appliance product vendor

String

Trend Micro

Header (pname)

Product name

String

Zero Trust Secure Access - Internet Access

Header (pver)

Appliance version

String

Example: 1.0.0.2000

Header (eventid)

Unique identifier per event type

String

Example: 100000

Header (eventName)

Category of the event

String

Activity Log

Header (severity)

Risk level

Integer

• 0: act=allow/analyze

• 1: act=monitor/warn/override

• 2: act=block

rt

UTC timestamp of log generation

Timestamp

Example: Jul 05 2018 07:54:15 +0000

act

Action taken for the violation

String

• allow

• monitor

• block

• warn

• override

• analyze

app

Application protocol

String

Example: HTTP

cat

URL category

String

Example: Search Engines/Portals

customerExternalId

Company ID

String

Example: 7800fcab-7611-416c-9ab4-721b7bd6b076

suser

User Principal Name

String

Example: user_name@example.com

devicePayloadId

GUID of this event log

String

Example: aabb2233-a1b1-41dc-9abc-3f45ab290b0a

deviceExternalId

GUID of the endpoint with the Secure Access Module installed

String

Example: 66f0cb71-4150-4437-ba8b-91151bb12345

shost

Hostname of the endpoint with the Secure Access Module installed

String

Example: my laptop

dvchost

Host name of the serving on-premises gateway

String

Example: US_Office_on_premise_GW

dst

Destination IP address of a request

String

Example: 54.231.184.240

src

Source IP address of a request

String

Example: 10.204.214.188

out

Size of a request

Integer

Unit: bytes

Example: 501

in

Size of a response

Integer

Unit: bytes

Example: 220529

dproc

Application name

String

Example: Google

destinationServiceName

App & action name of granular access control

String

Example: OneDrive download file

cn1

Malware type

Integer

• 1: Virus

• 2: Spyware

• 3: Joke

• 4: Trojan

• 5: Test_Virus

• 6: Packer

• 7: Generic

• 8: Other

• 9: Botnet

cn1Label

Corresponding label for the "cn1" field

String

malwareType

cn2

Web Reputation Services score

Integer

Example: 81

cn2Label

Corresponding label for the "cn2" field

String

wrsScore

cn3

Detection type

Integer

• 0: No matched Zero Trust Secure Access rule

• 1: Missing or invalid client certificate

• 2: Untrusted server certificate

• 3: Zero Trust Secure Access

• 4: HTTPS inspection exception

• 5: HTTPS inspection failure

• 6: HTTPS bypass at inspection failure

• 9: Approved URLs

• 10: Blocked URLs

• 15: Private IP address access

• 20: Web Reputation

• 21: URL Filtering

• 30: Restricted file type

• 33: Restricted MIME type

• 34: Restricted file extension type

• 40: Anti-malware scan

• 41: File scan exception

• 45: Predictive Machine Learning

• 50: Botnet

• 60: Application Control

• 70: Virtual Analyzer submission

• 90: Suspicious Object Blocked List

• 100: Data Loss Prevention

• 110: Ransomware

• 120: Risk Control

• 130: Non-compliant device