Common Event Format (CEF) Data

Common Event Format (CEF) is a standardized logging format developed by ArcSight (now part of Micro Focus), a security information and event management (SIEM) solution provider. CEF is designed to simplify the process of logging security-related events, making it easier to integrate logs from different sources into a single system.

CEF is a text-based log format that uses Syslog as transport, which is standard for message logging, and is supported by most network devices and operating systems. The full format includes a Syslog header or "prefix," a CEF "header," and a CEF "extension." The extension contains a list of key-value pairs. Standard key names are provided, and user-defined extensions can be used for additional key names.

CEF Standard and Custom Key

This table displays CEF names along with full names for each CEF key. It is the key name that is required in events.

Key Name
Full Name
Key Type
Module
Data Type
Length
Description

act

deviceAction

Standard

All

String

63

Action mentioned in the event.

dvc

deviceAddress

Standard

All

IPV4 Address

16

Identifies the device that an event refers to in an IP network. The format is an IPv4 address. Example: “192.168.10.1”

dvchost

deviceHostName

Standard

All

String

100

duid

destination UserId

Standard

Deployments

String

1023

Identifies the destination user by ID. Salesforce org user ID

duser

destination UserName

Standard

Deployments

String

1023

Identifies the destination user by name. This is the user associated with the event's destination. E-mail addresses are also mapped into the UserName fields. The recipient is a candidate to put into destinationUserName. In ARM, this should be used for the destination Salesforce Org username.

end

endTime

Standard

All

Time Stamp

The time at which the activity related to the event ended. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970). An example would be reporting the end of a session. Process end time (eg: Build end time)

fname

fileName

Standard

All (Static Code Analysis)

String

1023

Name of the file.

fsize

fileSize

Standard

Deployments

Integer

Size of the file. Metadata package ZIP size.

msg

message

Standard

All

String

1023

An arbitrary message giving more details about the event. Multi-line entries can be produced by using \n as the new-line separator.

request

requestURL

Standard

CI Jobs

String

1023

CIJobs -> post deployments external URL.

requestMethod

requestMethod

Standard

CI Jobs

String

1023

The method used to access a URL. Possible values: “POST”, “GET”

suid

sourceUserId

Standard

Deployments

String

1023

Identifies the source user by ID. This is the user associated with the source of the event. Source Salesforce org user ID

suser

sourceUserName

Standard

Deployments

String

1023

Identifies the source user by name. E-mail addresses are also mapped into the UserName fields. The sender is a candidate to put into sourceUserName. Destination Salesforce org user ID

start

startTime

Standard

All

Time Stamp

The time when the activity the event referred to started. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970).

arAuthType

authenticationType

Custom

Admin

String

50

Authentication type for Salesforce Org registration

arBType

boardType

Custom

Version Control

String

50

Board type as mentioned in Version Control commit history page

arBrowserType

browserType

Custom

Admin

String

50

User login browser name

arActor

Actor

Custom

All

String

50

arApprovedBy

Approved By

Custom

Version Control

String

50

User email who approved the Pre-validation process (Merge / EZ-Commit Pre-validation)

arAssociatedPartner

Associated Partner

Custom

nCino

String

30

By default, for Associated Partner is nCino while creating a feature

deviceProcessName

Device process Name

Standard

All

String

1023

Process name associated with the event

arDeploymentSource

Deployment Source

Custom

Deployment, nCino

String

60

arLAuthMethod

Auth Method

Custom

Login

String

40

The authentication method used during user login

arBranchName

Branch Name

Custom

All

String

32

Name that is given in AR while registering/creating the branch.

arCIJobName

CI Job Name

Custom

Deployment

String

1023

Name given in ARM while creating the Job.

arReleaseLabel

Release Label Name

Custom

Deployment

String

1023

Name given in ARM while creating the release label

arCommitLabel

Commit Label Name

Custom

Deployment

String

1023

Name that is given in AR while creating the commit label

arCIBuildNumber

CI Job Build number

Custom

Deployment

String

1023

Build number in AR

arRepoName

Repository Name

Custom

All

String

32

Name that is given in AR while registering the Repository

arCommitFP

Commit Full Profiles

Custom

Version Control

Boolean

6

Commit full profiles selection in Version Control

arCType

Commit Type

Custom

Version Control

String

30

arCommittedBy

Committed By

Custom

All

String

40

User mail who initiated the commit process

arCmpFailureCount

Failed components count

Custom

Deployment

Integer

1000

Failed components count in the deployment process

arComDeployedCount

Deployed components count

Custom

Deployment

Integer

1000

Successful components deployed count

arComSuccessCount

Success components count

Custom

Deployment

Integer

1000

Success components count

arCreateDataset

Create a dataset during the deployment process

Custom

nCino

Boolean

6

Create dataset criteria selection during the deployment process

arCredentialType

Credential type

Custom

All

String

10

Credential type refers to SSH / UWP / CA

arAccessKey

Access key name

Custom

All

String

32

Credential / Access key name used during Commit / Merge processes

arDMLType

DML Type

Custom

Dataloader, nCino

String

15

Data Manipulation type used for data migration. eg: insert/upsert

arDFrom

Deployment from

Custom

Deployment, nCino

String

50

Deployment from selection

arDeviceProcessStatus

Process status

Custom

All

String

50

eg: Deployment Status

arRepoURL

Repository URL

Custom

All

String

300

URL of the repository

arDAppliedMappings

Destination Applied Mappings

Custom

Dataloader, nCino

String

90

Applied mappings field selected for the destination.

arDSFOrgName

Destination Salesforce org name

Custom

All

String

32

arEObjectFilter

Entry Object Filter

Custom

nCino

String

1000

arEObjects

Excluded objects

Custom

nCino

String

1000

arExternalId

External ID

Custom

nCino, Dataloader

String

100

arFVersion

Feature Version

Custom

nCino

String

52

arFName

Feature Name

Custom

nCino

String

52

arGGrantProfiles

Global grant profiles

Custom

All

Boolean

6

Global settings of permissions

arPermissionsAccess

Grant / Revoke access

Custom

All

String

10

Grant / Revoke

arIMVisibleSettings

Ignore missing visibility settings

Custom

All

Boolean

6

arIAttachments

Include Attachments

Custom

nCino, Dataloader

Boolean

6

arInsertNulls

Insert Nulls

Custom

nCino, Dataloader

Boolean

6

arIBackup

Is Backup

Custom

All

Boolean

6

arICommit

Is Commit

Custom

nCino

Boolean

6

arIDeploy

Is Deploy

Custom

nCino

Boolean

6

arIRollback

Is Rollback

Custom

All

Boolean

6

arISandbox

Is sandbox

Custom

All

Boolean

6

Destination SF org is Sandbox or not

arIUTF8

Is UTF8 enabled

Custom

nCino, Dataloader

Boolean

6

arLName

Login Name

Custom

Admin

String

30

arLType

Login Type

Custom

Admin

String

30

arMName

Module Name

Custom

All

String

50

arIObjects

Included Objects

Custom

nCino, Dataloader

String

1023

arPCheckDup

Pre-check duplicates

Custom

nCino, Dataloader

Boolean

6

arRFailureCount

Records Failure count

Custom

nCino, Dataloader

Integer

10000

arRExtracted

The number of records extracted

Custom

nCino, Dataloader

Integer

10000

arRSuccessCount

Success records count

Custom

nCino, Dataloader

Integer

10000

arRIPRanges

Remove IP Ranges

Custom

All

Boolean

6

arRUPerms

Remove User Permissions

Custom

All

Boolean

6

arRArtifact

Review artifact

Custom

Version Control

Boolean

6

arRevNumber

Revision number

Custom

All

String

10

arSOQLQuery

SOQL Query

Custom

nCino, Dataloader

String

1023

arSSRules

Search & Substitute rules

Custom

All

String

1023

arFDSType

Feature Deployment Source type

Custom

nCino

String

50

arStdFVersion

Standard Feature version

Custom

nCino

String

52

arStdFName

Standard Feature Name

Custom

nCino

String

52

arSubMName

Sub module name

Custom

All

String

50

arUCheckFields

Unique check fields

Custom

nCino, Dataloader

String

1023

arVRImpact

Validation rules impacted

Custom

nCino, Dataloader

String

1023

arWRImpact

Workflow rules impacted

Custom

nCino, Dataloader

String

1023

arCStatus

Commit status

Custom

All

String

50

arBulkAPI

Bulk API enabled

Custom

nCino, Dataloader

Boolean

6

arReviewedBy

Reviewed By

Custom

Version Control

String

1023

arSFAPIVersion

Salesforce API Version

Custom

Deployment

String

6

arSSFOrgName

Source Salesforce Org Name

Custom

Deployment

String

1023

Source SF org name, which is registered in ARM

arIterationNumber

Iteration Number

Custom

Deployment

String

1023

Iteration number of deployments

arRevertIterationNumber

Revert Iteration Number

Custom

Deployment

String

1023

Revert Iteration number of deployments

arTriggeredBy

Triggered By

Custom

CI

String

50

User email triggered by CI Job build

arBuildLabel

Build Label Name

Custom

CI

String

1023

Name that is given in AR while triggering the CI Build

arSRepoURL

Source Repository URL

Custom

All

String

300

URL of the repository viz. selected as Source

arSBranchName

Source branch name

Custom

All

String

32

arSRepoName

Source repository name

Custom

All

String

32

arFRevNumber

From Revision number

Custom

All

String

10

arTRevNumber

To Revision number

Custom

All

String

10

arPostActivity

Post Activity

Custom

CI

Boolean