Contents and properties of syslog messages in the CEF format

Information about each detected event is sent immediately after the occurrence of the event as a separate syslog message in the CEF format in UTF-8 encoding.

A CEF message consists of the message body and header.

The CEF message header consists of the following parts:

• Syslog prefix: <event date and time> <name of the host on which the event occurred>.
• A sequence of fields separated by "|" characters and separated from the syslog prefix by a space. All fields are required.
  • Format version. Currently, the version number is 0, so the field looks like "CEF:0".
  • Vendor. The value of this field is AO Kaspersky Lab.
  • Application name. The value of this field is Kaspersky Web Traffic Security.
  • Product version. The value of this field is the current version of the product (6.1.0.xxxx).
  • Event class.
  • Event name.
  • Severity level. Can be Low, Medium, or High.

    Example: Oct 30, 2021 10:34:23 host.domain.com CEF:0|AO Kaspersky Lab|Kaspersky Web Traffic Security|6.1.0.1234|LMS_EV_SETTINGS_CHANGED|task settings changed|Low|…

Fields of the syslog message about an event, which are defined by application options, have the format <key>="<value>". If a key has multiple values, these values are separated with a comma. A colon is used as the separator between keys.

The keys and their values contained in the message depend on the class of the event.

The maximum size of a syslog message about a detected event depends on the values of the syslog settings on the server on which Kaspersky Web Traffic Security is installed. You can only configure syslog messages to a single external syslog server.

Character encoding rules in CEF messages:

• Spaces do not need to be escaped.
• In the header, the vertical bar character ("|") is used as a separator. If you need to use this character in one of the header fields, you must escape it with a backslash ("\|"). In the message body, you do not need to escape the "|" character.
• Single backslashes are not allowed in the message header or message body. If you need to use it in a header field, duplicate the character ("\\").
• In the message body, the "=" character is used as a separator for the "key-value" pair. If you need to use this character in one of the message body fields, you must escape it with a backslash ("\="). In the header, the "=" character does not require escaping.
• Multi-line values are only allowed for the values in key/value pairs. To indicate a line break, use the "\n" or "\r" characters.