Log Event Extended Format

LEEF (Log Event Extended Format) is IBM's event format for QRadar. A LEEF event is a single line consisting of an optional syslog header, a pipe-delimited LEEF header, and a flat list of key=value event attributes.

The latest LEEF version is 2.0, which this skill documents. LEEF 2.0 adds one optional header field to LEEF 1.0: a delimiter character for the event attributes. Both header layouts are covered in LEEF event components.

Use attributes.yaml as the authoritative reference for the predefined event attributes: exact key spelling, value type, normalization behavior, limits, and reserved status. If an attribute is not present there, it is not a predefined LEEF attribute.

Data files

• Use attributes.yaml to look up predefined event attributes.
• Use docs/overview.md for what LEEF is and how QRadar discovers LEEF event sources.
• Use docs/event-components.md for the syslog header, the LEEF 1.0/2.0 header fields, and delimiter rules.
• Use docs/custom-keys.md and docs/best-practices.md for non-predefined keys.
• Use docs/date-format.md for devTime/devTimeFormat patterns.
• Use source.md for upstream provenance and counts.

Format rules