tenzir-cef
Common Event Format
CEF (Common Event Format) is ArcSight's text-based event interchange format, now maintained by OpenText. A CEF event is a single line consisting of an optional syslog prefix, a pipe-delimited header, and a flat list of space-separated key=value extensions:
CEF:Version|Device Vendor|Device Product|Device Version|Device Event Class ID|Name|Severity|[Extension]
Use extensions.yaml as the authoritative reference for the predefined extension keys: exact key spelling, expanded full name, data type, length, producer/consumer audience, and the CEF specification version that introduced the key. If a key is not present there, it is not a predefined CEF extension.
Behind CEF sits the ArcSight ESM event schema: every CEF full name is an ESM script alias (for example act expands to deviceAction in the Device group). Use catalog.yaml to pick a schema group and groups/<group>.yaml for its fields.