For details on cookie usage on our site, read our Privacy Policy
Which log format is best for syslog , CEF or LEEF
- LIVEcommunity
- Discussions
- General Topics
- Which log format is best for syslog , CEF or LEEF
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
05-14-2019 11:37 PM
Anyone please explain the diference between CEF and LEEF and which one is best for 8.0.*.
Accepted Solutions
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
05-15-2019 06:43 AM
Hi @karthikeyanB ,
- LEEF (Log Event Extended Format)—The LEEF event format is a proprietary event format, which allows hardware manufacturers and software product manufacturers to read and map device events specifically designed for IBM QRadar integration.
- CEF (Common Event Format)—The CEF standard format is an open log management standard that simplifies log management. CEF allows third parties to create their own device schemas that are compatible with a standard thatis used industry-wide for normalizing security events.
I wouldn't be able to tell you which one would be better over the other. Maybe other users can help you make a better comparison between the 2.
If you're not using an IBM QRadar SIEM then I'm guessing that you will go with CEF 😉
Cheers !
-Kiwi.
Cheers,
Kiwi
Don't forget to hit that Like button if a post is helpful to you!
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
05-15-2019 06:43 AM
Hi @karthikeyanB ,
- LEEF (Log Event Extended Format)—The LEEF event format is a proprietary event format, which allows hardware manufacturers and software product manufacturers to read and map device events specifically designed for IBM QRadar integration.
- CEF (Common Event Format)—The CEF standard format is an open log management standard that simplifies log management. CEF allows third parties to create their own device schemas that are compatible with a standard thatis used industry-wide for normalizing security events.
I wouldn't be able to tell you which one would be better over the other. Maybe other users can help you make a better comparison between the 2.
If you're not using an IBM QRadar SIEM then I'm guessing that you will go with CEF 😉
Cheers !
-Kiwi.
Cheers,
Kiwi
Don't forget to hit that Like button if a post is helpful to you!
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
05-15-2019 08:37 AM
Hello,
I would say it really depends on your SIEM and what it can ingest better.
Regards,
- Migration Issue from PA-500 (HA-Active/passive) to PA-3220 with HA-Active/Passive in General Topics
- DTRH: CIS Benchmarking - 3rd Party Data Ingestion | Data Parsing | Widgets & Dashboards in Cortex XDR Discussions
- Someone school me on Syslog and Panorama in General Topics
- Rasterize PDF format queries in Cortex XSOAR Discussions
- Logvolume difference between Palo Format to Splunk and CEF Format to Azure Sentinel in General Topics
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
