How do I parse extension values that contain spaces?

Do not split on every space. Extension values run until the next recognised key followed by an equals sign, which is why cat=SQL Injection Attempt is one value and not three fields. A literal equals sign inside a value is escaped as \=.

Can I compare severity across different products?

No. The seventh header field is set by the sending device, and each vendor maps its own priority scale onto the 0–10 range. Rank severities within one product, and confirm with the action and category fields before escalating.

Why do some records have fields that others do not?

The extension list is per event type, not fixed. In these samples traffic events carry only addresses, ports, action and time, while threat events add request and cat. Treat a missing key as normal and make queries tolerate it rather than dropping the record.

Network & Firewall ✓ fields verified against sample logs

CEF (Common Event Format) Log Fields: Reference With Examples

Published October 29, 2026

One record is one event reported by a security device in Common Event Format: a pipe-separated header naming the vendor, product, event class, event name and severity, followed by space-separated key=value extensions describing the addresses, ports, user, action and time.

Sample record

CEF:0|Palo Alto Networks|PAN-OS|10.1|end|TRAFFIC|1|src=10.0.2.100 dst=10.0.1.50 dpt=8080 spt=44501 proto=TCP act=allow duser=svc-monitor rt=1705240920000 deviceExternalId=PA-FW-01

From the LogTriage parser test corpus — synthetic data, no real hosts or users.

Explain this record field by field →

Field reference

Field	Type	Meaning	Why it matters for security
srce.g. 10.0.2.100	IPv4/IPv6	Source address of the connection or activity the device observed.	The pivot for everything else — group events by src to separate one scanner from ordinary clients.
dste.g. 10.0.1.50	IPv4/IPv6	Destination address the traffic was aimed at.	Shows which internal host is being attacked, and in outbound events which external host your host is talking to.
spte.g. 44501	integer	Source port of the connection.	Many different spt values from one src against one dst in seconds indicate automated, not human, traffic.
dpte.g. 443	integer	Destination port of the connection.	A run of distinct dpt values from one src is scanning; odd ports on outbound sessions, such as dpt=4444 in the attack sample, are worth chasing.
protoe.g. TCP	string	Transport protocol of the flow.	Narrows which follow-up telemetry (proxy, DNS, netflow) can corroborate the event.
acte.g. reset-both	string	The action the device took, in the sending product's own vocabulary — the samples use allow, drop, reset-both and block-ip.	Separates what was stopped from what got through; an allow on a high-severity event is the one to read first.
outcomee.g. allow	string	Result of the activity, where the sender populates it; in the validation sample it duplicates act.	Senders disagree about whether the verdict goes in act or outcome, so normalize both into one field before counting blocks.
dusere.g. [email protected]	string	Destination user name — in these samples the account associated with the session.	Several duser values from one src against one login URL is credential guessing rather than one person mistyping.
requeste.g. /api/v1/auth/login	string (URL or path)	The requested URL or path for HTTP events; absent on plain traffic events.	Carries the attack payload in the SQL injection samples, URL-encoded — decode before pattern matching.
requestURLe.g. https://github.com/	string (URL)	Full URL as emitted by the validation generator, a second key carrying the same kind of value as request.	Check both keys when hunting for a URL; a parser that reads only one silently loses events from some senders.
requestMethode.g. GET	string	HTTP method of the request.	Useful for separating reads from writes when the same path appears in bulk.
requestClientApplicatione.g. curl/8.0.1	string	Client application string (the HTTP User-Agent, where the device records one).	Scripted clients such as curl against authentication endpoints point to automation.
fileHashe.g. e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	string	Hash of a file associated with the event; the key does not say which algorithm produced it.	The field to extract for threat-intelligence lookups and for matching against EDR detections.
cate.g. SQL Injection Attempt	string	Device event category, a free-text label the sending product assigns.	The quickest grouping for triage, but it is vendor text — do not build detections that assume a wording other products use.
rte.g. 1705240920000	Unix time (milliseconds) or formatted date	Device receipt time; these samples use epoch milliseconds.	Use it rather than collector arrival time when ordering an attack, and convert from milliseconds before joining with other logs.
deviceExternalIde.g. PA-FW-01	string	Identifier the sender gives for the device that produced the event.	Tells you which firewall saw the traffic, which fixes the network vantage point and the direction of src and dst.

Have one of your own records? Paste it into the log line explainer and each field is explained from this table, with times, codes and addresses decoded — in your browser.

What it records

A CEF record is a single line describing one event a security device observed. It begins with the literal CEF: and a format version, then seven pipe-separated header fields, then the extensions:

The header fields are, in order: version (0), device vendor, device product, device version, device event class ID, event name and severity. The class ID and name are chosen by the sender — the firewall samples use end/TRAFFIC for session records and vulnerability, scan, spyware or data with the name THREAT for threat-prevention records, while the validation generator uses ti-test-ip with the descriptive name Clean IP Lookup (Google DNS).

Everything after the seventh pipe is the extension dictionary. Common Event Format, originally defined by ArcSight, publishes standard key names — src, dst, spt, dpt, proto, act, duser, cat, rt, fileHash and others documented above — so events from different products can be read with one parser. Products also add keys of their own, and there is nothing in the line that marks which is which.

Where to get it

CEF is a transport-neutral text format, and most products emit it over syslog (UDP, TCP or TLS) to a collector. In production a line therefore usually starts with a syslog priority, timestamp and hostname before CEF:0; the samples here have that prefix stripped. Other routes are an ArcSight-style connector writing CEF files, a SIEM syslog forwarder, or plain log files as shown here. In Microsoft Sentinel, CEF collected through the Common Event Format connector lands in the CommonSecurityLog table with the header and extension keys mapped to columns.

Parsing pitfalls

Escaping. A literal pipe inside a header field is written \|, a literal equals sign inside an extension value is \=, a backslash is \\ and an embedded newline is \n. Splitting naively on | or = corrupts exactly the events that matter.
Spaces in values. cat=SQL Injection Attempt is one field. Tokenise on the next valid key followed by =, not on whitespace.
The key set varies by event type. Traffic records in the benign sample have no request or cat; threat records do. Absent keys are normal.
Two keys for the same idea. The firewall sends request, the validation generator sends requestURL, and the verdict appears as act in one place and as both act and outcome in another. Normalise before you count.
rt is epoch milliseconds here. 1705240920000 is a millisecond timestamp; the field also allows a formatted date, so handle both and do not divide by 1000 twice.
URL-encoded payloads. request=/api/v1/users?id=1%27%20OR%20%271%27%3D%271 only matches injection patterns after decoding.
Severity is the sender’s opinion. It is a header field, not a normalised risk score.

Detection ideas

Blocked exploits and malware: high header severity with act of reset-both, block-ip or drop — the basis of the CEF firewall threat-prevention rule. These are the attacks you survived; count them per src and per dst.
High severity that was allowed: the same events with act=allow are the ones that reached the host.
Credential attacks: one src repeating request=/api/v1/auth/login seconds apart across several duser values, as in the attack sample.
Scanning: one src with many distinct dpt values and act=drop, or a category such as TCP Port Scan.
Outbound sessions: an internal src to an external dst, especially on an unusual dpt, and especially when that external address already appeared as the source of inbound threats — that pairing links the intrusion to the callback.
Hash and URL pivots: extract fileHash, request and requestURL for intelligence lookups.

The free browser analyzer reads CEF files like these without uploading them.

Sending CEF (Common Event Format) to an LLM

One megabyte of this format is about 610,968 tokens on current Claude models and 412,976 on GPT models, measured with the models' own tokenizers — so a gigabyte sent raw to Claude Sonnet 5.5 costs about $1,222 in input tokens alone (prices of 2026-10-24). Estimate your own volume →

Detections and guides for CEF (Common Event Format)

Sigma rule LTR-0024: Detect Blocked Exploits, Spyware and Malware in Palo Alto PAN-OS CEF Logs →

Frequently Asked Questions

What are the seven fields before the extensions?: They are the CEF header, pipe-separated and positional: version, device vendor, device product, device version, device event class ID, event name and severity. In the sample line that is CEF:0, Palo Alto Networks, PAN-OS, 10.1, end, TRAFFIC and 1.
How do I parse extension values that contain spaces?: Do not split on every space. Extension values run until the next recognised key followed by an equals sign, which is why cat=SQL Injection Attempt is one value and not three fields. A literal equals sign inside a value is escaped as \=.
Can I compare severity across different products?: No. The seventh header field is set by the sending device, and each vendor maps its own priority scale onto the 0–10 range. Rank severities within one product, and confirm with the action and category fields before escalating.
Why do some records have fields that others do not?: The extension list is per event type, not fixed. In these samples traffic events carry only addresses, ports, action and time, while threat events add request and cat. Treat a missing key as normal and make queries tolerate it rather than dropping the record.

Analyze a CEF (Common Event Format) file in your browser

The free analyzer detects this format, parses every field above and flags attack patterns — the file never leaves your machine. For threat-intel enrichment and an AI-written incident report, run it through LogTriage.

Open the free analyzer → Analyze your own logs

Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing