Kaspersky Security Center 14.2 Windows

Converting events to the CEF or LEEF format

Before sending events to the SIEM system (QRadar, ArcSight, or Splunk), it is necessary to interpret Kaspersky Security Center events to events in the CEF and LEEF format by using the rules specified in the siem_conversion_rules.xml file. This file is included in the Kaspersky Security Center distribution kit.

The siem_conversion_rules.xml file contains the predefined interpretation rules to convert events to the CEF and LEEF format. If you want to use additional event interpretation rules, you can add them to the file manually.

The siem_conversion_rules.xml file includes the <product name="SP_QRADAR" vendor="IBM"> and <product name="SP_QRADAR" vendor="IBM"> sections. The <product name="SP_QRADAR" vendor="IBM"> section contains rules for generating events in the LEEF format, which can be exported to the QRadar SIEM system. The <product name="SP_ARCSIGHT" vendor="HP"> section contains rules for generating events in the CEF format, which can be exported to the ArcSight or Splunk SIEM system.

Each section has the <common> subsection, in which Kaspersky Security Center event attributes and corresponding attributes of events in the LEEF format are located. These common attributes are used for all types of events that can be exported.

Also, each section has the <event> subsections. Each <event> subsection contains additional attributes that are added to those listed in the <common> section.

You can add a new event generation rule to the siem_conversion_rules.xml file manually.

To add a new event generation rule,

Add a new <event> subsection to the <product name="SP_QRADAR" vendor="IBM"> or <product name="SP_QRADAR" vendor="IBM"> section, and then specify the additional event attributes, if needed.

If an event consist only of common attributes, the <event> subsection will be empty.

siem_conversion_rules.xml