Reference: Format types

CEF

Common Event Format (CEF) is the default format for HP ArcSight. When you define CEF format for your destination, you can include Advanced Settings such as the device vendor, product and version, product name, version, source, and the end of entry separator character. For the separator, you can use escape characters such as: \t (tab), \n (new line), and \r (carriage return). Select the columns that you want to pass through to the destination. Some fields also support variable substitution, as listed in Reference: Variables.

Default destinations: HP ArcSight

CSV

Comma-separated values. Select whether you want to include column headers in the output. Select the columns that you want to pass through to the destination.

Default destinations: AWS S3, File, ServiceNow

Delimiter separated values

To create a delimiter separated values format, enter the characters that you want to use for column and row delimiters. In addition to single characters, you can use escape characters such as: \t (tab), \n (new line), and \r (carriage return). Select the columns that you want to pass through to the destination.

Elasticsearch

The Elasticsearch format is the only valid format when Elasticsearch is selected as the destination. If a saved question is selected as a source, you can expand Advanced Settings and select Group columns by sensor to return the results as an array of objects instead of an array of simple value types. You cannot customize the columns with this option. Select the columns that you want to pass through to the destination. For more information, see Configuring an Elasticsearch destination.

Default destinations: Elasticsearch

HTML

Select whether you want to include column headers in the output. Select the columns that you want to pass through to the destination.

Default destinations: Email

JSON

JavaScript Object Notation (JSON) is lightweight data-interchange format. If a saved question is selected as a source, you can select Group columns by sensor to return the results as an array of objects instead of an array of simple value types. You cannot customize the columns with this option. You can specify the row delimiter that goes between the individual entries. In addition to single characters, you can use escape characters such as: \t (tab), \n (new line), and \r (carriage return). Select the columns that you want to pass through to the destination.

Default destinations: HTTP

LEEF

Log Event Extended Format (LEEF) is the default format for: IBM QRadar, LogRhythm, and McAfee SIEM. When you define LEEF format for your destination, you can include Advanced Settings such as the LEEF version, product name, version, source, and the end of entry separator character. In addition to single characters, you can use escape characters such as: \t (tab), \n (new line), and \r (carriage return) for the separator. Some fields also support variable substitution, as listed in Reference: Variables.

Default destinations: IBM QRadar, LogRhythm, and McAfee SIEM

SQL server

When you are exporting data to SQL server, you can map the columns from the source to the columns in the database table. For more information, see Configuring an SQL Server destination.

Syslog (deprecated)

A standard for message logging. You can define the syslog message components, including the facility code, severity, message identifier, and separator. For the separator, you can use escape characters such as: \t (tab), \n (new line), and \r (carriage return). Select the columns that you want to pass through to the destination. Some fields also support variable substitution, as listed in Reference: Variables.

Syslog RFC 5424

A standard for message logging. You can define the syslog message components, including the facility code, severity, message identifier, and separator. For the separator, you can use escape characters such as: \t (tab), \n (new line), and \r (carriage return). If the source is a saved question, you can also select whether you want to send the question source to the output or not. The default for new connections is to send the question source. Select the columns that you want to pass through to the destination. Some fields also support variable substitution, as listed in Reference: Variables.

Default destinations: Socket Receiver, Splunk

Last updated: 4/30/2019 4:29 PM | Feedback