Common Event Format (CEF) Data
Common Event Format (CEF) is a standardized logging format developed by ArcSight (now part of Micro Focus), a security information and event management (SIEM) solution provider. CEF is designed to simplify the process of logging security-related events, making it easier to integrate logs from different sources into a single system.
CEF is a text-based log format that uses Syslog as transport, which is standard for message logging, and is supported by most network devices and operating systems. The full format includes a Syslog header or "prefix," a CEF "header," and a CEF "extension." The extension contains a list of key-value pairs. Standard key names are provided, and user-defined extensions can be used for additional key names.
CEF Standard and Custom Key
This table displays CEF names along with full names for each CEF key. It is the key name that is required in events.
act
deviceAction
Standard
All
String
63
Action mentioned in the event.
dvc
deviceAddress
Standard
All
IPV4 Address
16
Identifies the device that an event refers to in an IP network. The format is an IPv4 address. Example: “192.168.10.1”
dvchost
deviceHostName
Standard
All
String
100
duid
destination UserId
Standard
Deployments
String
1023
Identifies the destination user by ID. Salesforce org user ID
duser
destination UserName
Standard
Deployments
String
1023
Identifies the destination user by name. This is the user associated with the event's destination. E-mail addresses are also mapped into the UserName fields. The recipient is a candidate to put into destinationUserName. In ARM, this should be used for the destination Salesforce Org username.
end
endTime
Standard
All
Time Stamp
The time at which the activity related to the event ended. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970). An example would be reporting the end of a session. Process end time (eg: Build end time)
fname
fileName
Standard
All (Static Code Analysis)
String
1023
Name of the file.
fsize
fileSize
Standard
Deployments
Integer
Size of the file. Metadata package ZIP size.
msg
message
Standard
All
String
1023
An arbitrary message giving more details about the event. Multi-line entries can be produced by using \n as the new-line separator.
request
requestURL
Standard
CI Jobs
String
1023
CIJobs -> post deployments external URL.
requestMethod
requestMethod
Standard
CI Jobs
String
1023
The method used to access a URL. Possible values: “POST”, “GET”
suid
sourceUserId
Standard
Deployments
String
1023
Identifies the source user by ID. This is the user associated with the source of the event. Source Salesforce org user ID
suser
sourceUserName
Standard
Deployments
String
1023
Identifies the source user by name. E-mail addresses are also mapped into the UserName fields. The sender is a candidate to put into sourceUserName. Destination Salesforce org user ID
start
startTime
Standard
All
Time Stamp
The time when the activity the event referred to started. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970).
arAuthType
authenticationType
Custom
Admin
String
50
Authentication type for Salesforce Org registration
arBType
boardType
Custom
Version Control
String
50
Board type as mentioned in Version Control commit history page
arBrowserType
browserType
Custom
Admin
String
50
User login browser name
arActor
Actor
Custom
All
String
50
arApprovedBy
Approved By
Custom
Version Control
String
50
User email who approved the Pre-validation process (Merge / EZ-Commit Pre-validation)
arAssociatedPartner
Associated Partner
Custom
nCino
String
30
By default, for Associated Partner is nCino while creating a feature
deviceProcessName
Device process Name
Standard
All
String
1023
Process name associated with the event
arDeploymentSource
Deployment Source
Custom
Deployment, nCino
String
60
arLAuthMethod
Auth Method
Custom
Login
String
40
The authentication method used during user login
arBranchName
Branch Name
Custom
All
String
32
Name that is given in AR while registering/creating the branch.
arCIJobName
CI Job Name
Custom
Deployment
String
1023
Name given in ARM while creating the Job.
arReleaseLabel
Release Label Name
Custom
Deployment
String
1023
Name given in ARM while creating the release label
arCommitLabel
Commit Label Name
Custom
Deployment
String
1023
Name that is given in AR while creating the commit label
arCIBuildNumber
CI Job Build number
Custom
Deployment
String
1023
Build number in AR
arRepoName
Repository Name
Custom
All
String
32
Name that is given in AR while registering the Repository
arCommitFP
Commit Full Profiles
Custom
Version Control
Boolean
6
Commit full profiles selection in Version Control
arCType
Commit Type
Custom
Version Control
String
30
arCommittedBy
Committed By
Custom
All
String
40
User mail who initiated the commit process
arCmpFailureCount
Failed components count
Custom
Deployment
Integer
1000
Failed components count in the deployment process
arComDeployedCount
Deployed components count
Custom
Deployment
Integer
1000
Successful components deployed count
arComSuccessCount
Success components count
Custom
Deployment
Integer
1000
Success components count
arCreateDataset
Create a dataset during the deployment process
Custom
nCino
Boolean
6
Create dataset criteria selection during the deployment process
arCredentialType
Credential type
Custom
All
String
10
Credential type refers to SSH / UWP / CA
arAccessKey
Access key name
Custom
All
String
32
Credential / Access key name used during Commit / Merge processes
arDMLType
DML Type
Custom
Dataloader, nCino
String
15
Data Manipulation type used for data migration. eg: insert/upsert
arDFrom
Deployment from
Custom
Deployment, nCino
String
50
Deployment from selection
arDeviceProcessStatus
Process status
Custom
All
String
50
eg: Deployment Status
arRepoURL
Repository URL
Custom
All
String
300
URL of the repository
arDAppliedMappings
Destination Applied Mappings
Custom
Dataloader, nCino
String
90
Applied mappings field selected for the destination.
arDSFOrgName
Destination Salesforce org name
Custom
All
String
32
arEObjectFilter
Entry Object Filter
Custom
nCino
String
1000
arEObjects
Excluded objects
Custom
nCino
String
1000
arExternalId
External ID
Custom
nCino, Dataloader
String
100
arFVersion
Feature Version
Custom
nCino
String
52
arFName
Feature Name
Custom
nCino
String
52
arGGrantProfiles
Global grant profiles
Custom
All
Boolean
6
Global settings of permissions
arPermissionsAccess
Grant / Revoke access
Custom
All
String
10
Grant / Revoke
arIMVisibleSettings
Ignore missing visibility settings
Custom
All
Boolean
6
arIAttachments
Include Attachments
Custom
nCino, Dataloader
Boolean
6
arInsertNulls
Insert Nulls
Custom
nCino, Dataloader
Boolean
6
arIBackup
Is Backup
Custom
All
Boolean
6
arICommit
Is Commit
Custom
nCino
Boolean
6
arIDeploy
Is Deploy
Custom
nCino
Boolean
6
arIRollback
Is Rollback
Custom
All
Boolean
6
arISandbox
Is sandbox
Custom
All
Boolean
6
Destination SF org is Sandbox or not
arIUTF8
Is UTF8 enabled
Custom
nCino, Dataloader
Boolean
6
arLName
Login Name
Custom
Admin
String
30
arLType
Login Type
Custom
Admin
String
30
arMName
Module Name
Custom
All
String
50
arIObjects
Included Objects
Custom
nCino, Dataloader
String
1023
arPCheckDup
Pre-check duplicates
Custom
nCino, Dataloader
Boolean
6
arRFailureCount
Records Failure count
Custom
nCino, Dataloader
Integer
10000
arRExtracted
The number of records extracted
Custom
nCino, Dataloader
Integer
10000
arRSuccessCount
Success records count
Custom
nCino, Dataloader
Integer
10000
arRIPRanges
Remove IP Ranges
Custom
All
Boolean
6
arRUPerms
Remove User Permissions
Custom
All
Boolean
6
arRArtifact
Review artifact
Custom
Version Control
Boolean
6
arRevNumber
Revision number
Custom
All
String
10
arSOQLQuery
SOQL Query
Custom
nCino, Dataloader
String
1023
arSSRules
Search & Substitute rules
Custom
All
String
1023
arFDSType
Feature Deployment Source type
Custom
nCino
String
50
arStdFVersion
Standard Feature version
Custom
nCino
String
52
arStdFName
Standard Feature Name
Custom
nCino
String
52
arSubMName
Sub module name
Custom
All
String
50
arUCheckFields
Unique check fields
Custom
nCino, Dataloader
String
1023
arVRImpact
Validation rules impacted
Custom
nCino, Dataloader
String
1023
arWRImpact
Workflow rules impacted
Custom
nCino, Dataloader
String
1023
arCStatus
Commit status
Custom
All
String
50
arBulkAPI
Bulk API enabled
Custom
nCino, Dataloader
Boolean
6
arReviewedBy
Reviewed By
Custom
Version Control
String
1023
arSFAPIVersion
Salesforce API Version
Custom
Deployment
String
6
arSSFOrgName
Source Salesforce Org Name
Custom
Deployment
String
1023
Source SF org name, which is registered in ARM
arIterationNumber
Iteration Number
Custom
Deployment
String
1023
Iteration number of deployments
arRevertIterationNumber
Revert Iteration Number
Custom
Deployment
String
1023
Revert Iteration number of deployments
arTriggeredBy
Triggered By
Custom
CI
String
50
User email triggered by CI Job build
arBuildLabel
Build Label Name
Custom
CI
String
1023
Name that is given in AR while triggering the CI Build
arSRepoURL
Source Repository URL
Custom
All
String
300
URL of the repository viz. selected as Source
arSBranchName
Source branch name
Custom
All
String
32
arSRepoName
Source repository name
Custom
All
String
32
arFRevNumber
From Revision number
Custom
All
String
10
arTRevNumber
To Revision number
Custom
All
String
10
arPostActivity
Post Activity
Custom
CI
Boolean