CEFParser

Parse CEF data into the context. Please notice that outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields.

javascript · Common Scripts

Details

ID	`CEFParser`
Language	javascript
From Version	5.0.0
Tags	Utility

README

Parses CEF data into the context. Outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields.

Script Data

Name	Description
Script Type	javascript
Tags	Utility

Inputs

Argument Name	Description
data	The data that contains the CEF rows.

Outputs

Path	Description	Type
CEFEvent.cefVersion	The CEF version.	Unknown
CEFEvent.vendor	The product vendor.	Unknown
CEFEvent.product	The product name.	Unknown
CEFEvent.version	The product version.	Unknown
CEFEvent.signatureID	The signature ID for the alert, if relevant.	Unknown
CEFEvent.name	The alert name.	Unknown
CEFEvent.severity	The alert severity.	Unknown

Source

CEFParser.js CEFParser.yml

Download History Raw

commonfields:
  id: CEFParser
  version: -1
name: CEFParser
script: ''
type: javascript
tags:
- Utility
comment: Parse CEF data into the context. Please notice that outputs will display
  only the 7 mandatory fields even if the CEF event includes many other custom or
  extended fields.
enabled: true
args:
- name: data
  required: true
  default: true
  description: The data that contains the CEF rows
outputs:
- contextPath: CEFEvent.cefVersion
  description: The CEF version
- contextPath: CEFEvent.vendor
  description: The product vendor
- contextPath: CEFEvent.product
  description: The product name
- contextPath: CEFEvent.version
  description: The product version
- contextPath: CEFEvent.signatureID
  description: The signature ID for the alert, if relevant
- contextPath: CEFEvent.name
  description: The alert name
- contextPath: CEFEvent.severity
  description: The alert severity
scripttarget: 0
fromversion: 5.0.0
tests:
- No tests