Format examples
This page provide examples for format configuration.
- JSON Format 1 to Format 4
- CEF native Format 1 to Format 4
- CEF Cloud Exchange Format 3
- ELFF Format 1 to Format 4
JSON Format 1 to Format 4
Those configurations are providing mapping for legacy Format 1 to Format 4 field list.
Sample format 1 JSON
{
"name": "Sample Format 1 JSON",
"description": "From Online Help, Transaction Event Format 1 in JSON, Cloud Exchange migration",
"type": "JSON",
"definition":
{
"remove_empty_fields": true,
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}</code></pre>
<!-- /wp:code -->
Sample format 2 JSON
{
"name": "Sample Format 2 JSON",
"description": "From Online Help, Transaction Event Format 2 in JSON, Cloud Exchange migration",
"type": "JSON",
"definition":
{
"remove_empty_fields": true,
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
},
{
"name": "x-cs-ssl-ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "x-sr-ssl-ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "x-ssl-bypass",
"source": "x-ssl-bypass",
"default": ""
},
{
"name": "x-ssl-bypass-reason",
"source": "x-ssl-bypass-reason",
"default": ""
},
{
"name": "x-r-cert-subject-cn",
"source": "x-r-cert-subject-cn",
"default": ""
},
{
"name": "x-r-cert-issuer-cn",
"source": "x-r-cert-issuer-cn",
"default": ""
},
{
"name": "x-r-cert-startdate",
"source": "x-r-cert-startdate",
"default": ""
},
{
"name": "x-r-cert-enddate",
"source": "x-r-cert-enddate",
"default": ""
},
{
"name": "x-r-cert-valid",
"source": "x-r-cert-valid",
"default": ""
},
{
"name": "x-r-cert-expired",
"source": "x-r-cert-expired",
"default": ""
},
{
"name": "x-r-cert-untrusted-root",
"source": "x-r-cert-untrusted-root",
"default": ""
},
{
"name": "x-r-cert-incomplete-chain",
"source": "x-r-cert-incomplete-chain",
"default": ""
},
{
"name": "x-r-cert-self-signed",
"source": "x-r-cert-self-signed",
"default": ""
},
{
"name": "x-r-cert-revoked",
"source": "x-r-cert-revoked",
"default": ""
},
{
"name": "x-r-cert-revocation-check",
"source": "x-r-cert-revocation-check",
"default": ""
},
{
"name": "x-r-cert-mismatch",
"source": "x-r-cert-mismatch",
"default": ""
},
{
"name": "x-cs-ssl-fronting-error",
"source": "x-cs-ssl-fronting-error",
"default": ""
},
{
"name": "x-cs-ssl-handshake-error",
"source": "x-cs-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-handshake-error",
"source": "x-sr-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-client-certificate-error",
"source": "x-sr-ssl-client-certificate-error",
"default": ""
},
{
"name": "x-sr-ssl-malformed-ssl",
"source": "x-sr-ssl-malformed-ssl",
"default": ""
},
{
"name": "x-s-custom-signing-ca-error",
"source": "x-s-custom-signing-ca-error",
"default": ""
},
{
"name": "x-cs-ssl-engine-action",
"source": "x-cs-ssl-engine-action",
"default": ""
},
{
"name": "x-cs-ssl-engine-action-reason",
"source": "x-cs-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-sr-ssl-engine-action",
"source": "x-sr-ssl-engine-action",
"default": ""
},
{
"name": "x-sr-ssl-engine-action-reason",
"source": "x-sr-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-ssl-policy-src-ip",
"source": "x-ssl-policy-src-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-ip",
"source": "x-ssl-policy-dst-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-host",
"source": "x-ssl-policy-dst-host",
"default": ""
},
{
"name": "x-ssl-policy-dst-host-source",
"source": "x-ssl-policy-dst-host-source",
"default": ""
},
{
"name": "x-ssl-policy-categories",
"source": "x-ssl-policy-categories",
"default": ""
},
{
"name": "x-ssl-policy-action",
"source": "x-ssl-policy-action",
"default": ""
},
{
"name": "x-ssl-policy-name",
"source": "x-ssl-policy-name",
"default": ""
},
{
"name": "x-cs-ssl-version",
"source": "x-cs-ssl-version",
"default": ""
},
{
"name": "x-cs-ssl-cipher",
"source": "x-cs-ssl-cipher",
"default": ""
},
{
"name": "x-sr-ssl-version",
"source": "x-sr-ssl-version",
"default": ""
},
{
"name": "x-sr-ssl-cipher",
"source": "x-sr-ssl-cipher",
"default": ""
},
{
"name": "x-cs-src-ip-egress",
"source": "x-cs-src-ip-egress",
"default": ""
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
Sample format 3 JSON
{
"name": "Sample Format 3 JSON",
"description": "From Online Help, Transaction Event Format 3 in JSON, Cloud Exchange migration",
"type": "JSON",
"definition":
{
"remove_empty_fields": true,
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
},
{
"name": "x-cs-ssl-ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "x-sr-ssl-ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "x-ssl-bypass",
"source": "x-ssl-bypass",
"default": ""
},
{
"name": "x-ssl-bypass-reason",
"source": "x-ssl-bypass-reason",
"default": ""
},
{
"name": "x-r-cert-subject-cn",
"source": "x-r-cert-subject-cn",
"default": ""
},
{
"name": "x-r-cert-issuer-cn",
"source": "x-r-cert-issuer-cn",
"default": ""
},
{
"name": "x-r-cert-startdate",
"source": "x-r-cert-startdate",
"default": ""
},
{
"name": "x-r-cert-enddate",
"source": "x-r-cert-enddate",
"default": ""
},
{
"name": "x-r-cert-valid",
"source": "x-r-cert-valid",
"default": ""
},
{
"name": "x-r-cert-expired",
"source": "x-r-cert-expired",
"default": ""
},
{
"name": "x-r-cert-untrusted-root",
"source": "x-r-cert-untrusted-root",
"default": ""
},
{
"name": "x-r-cert-incomplete-chain",
"source": "x-r-cert-incomplete-chain",
"default": ""
},
{
"name": "x-r-cert-self-signed",
"source": "x-r-cert-self-signed",
"default": ""
},
{
"name": "x-r-cert-revoked",
"source": "x-r-cert-revoked",
"default": ""
},
{
"name": "x-r-cert-revocation-check",
"source": "x-r-cert-revocation-check",
"default": ""
},
{
"name": "x-r-cert-mismatch",
"source": "x-r-cert-mismatch",
"default": ""
},
{
"name": "x-cs-ssl-fronting-error",
"source": "x-cs-ssl-fronting-error",
"default": ""
},
{
"name": "x-cs-ssl-handshake-error",
"source": "x-cs-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-handshake-error",
"source": "x-sr-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-client-certificate-error",
"source": "x-sr-ssl-client-certificate-error",
"default": ""
},
{
"name": "x-sr-ssl-malformed-ssl",
"source": "x-sr-ssl-malformed-ssl",
"default": ""
},
{
"name": "x-s-custom-signing-ca-error",
"source": "x-s-custom-signing-ca-error",
"default": ""
},
{
"name": "x-cs-ssl-engine-action",
"source": "x-cs-ssl-engine-action",
"default": ""
},
{
"name": "x-cs-ssl-engine-action-reason",
"source": "x-cs-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-sr-ssl-engine-action",
"source": "x-sr-ssl-engine-action",
"default": ""
},
{
"name": "x-sr-ssl-engine-action-reason",
"source": "x-sr-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-ssl-policy-src-ip",
"source": "x-ssl-policy-src-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-ip",
"source": "x-ssl-policy-dst-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-host",
"source": "x-ssl-policy-dst-host",
"default": ""
},
{
"name": "x-ssl-policy-dst-host-source",
"source": "x-ssl-policy-dst-host-source",
"default": ""
},
{
"name": "x-ssl-policy-categories",
"source": "x-ssl-policy-categories",
"default": ""
},
{
"name": "x-ssl-policy-action",
"source": "x-ssl-policy-action",
"default": ""
},
{
"name": "x-ssl-policy-name",
"source": "x-ssl-policy-name",
"default": ""
},
{
"name": "x-cs-ssl-version",
"source": "x-cs-ssl-version",
"default": ""
},
{
"name": "x-cs-ssl-cipher",
"source": "x-cs-ssl-cipher",
"default": ""
},
{
"name": "x-sr-ssl-version",
"source": "x-sr-ssl-version",
"default": ""
},
{
"name": "x-sr-ssl-cipher",
"source": "x-sr-ssl-cipher",
"default": ""
},
{
"name": "x-cs-src-ip-egress",
"source": "x-cs-src-ip-egress",
"default": ""
},
{
"name": "x-s-dp-name",
"source": "x-s-dp-name",
"default": ""
},
{
"name": "x-cs-src-ip",
"source": "x-cs-src-ip",
"default": ""
},
{
"name": "x-cs-src-port",
"source": "x-cs-src-port",
"default": ""
},
{
"name": "x-cs-dst-ip",
"source": "x-cs-dst-ip",
"default": ""
},
{
"name": "x-cs-dst-port",
"source": "x-cs-dst-port",
"default": ""
},
{
"name": "x-sr-src-ip",
"source": "x-sr-src-ip",
"default": ""
},
{
"name": "x-sr-src-port",
"source": "x-sr-src-port",
"default": ""
},
{
"name": "x-sr-dst-ip",
"source": "x-sr-dst-ip",
"default": ""
},
{
"name": "x-sr-dst-port",
"source": "x-sr-dst-port",
"default": ""
},
{
"name": "x-cs-ip-connect-xff",
"source": "x-cs-ip-connect-xff",
"default": ""
},
{
"name": "x-cs-ip-xff",
"source": "x-cs-ip-xff",
"default": ""
},
{
"name": "x-cs-connect-host",
"source": "x-cs-connect-host",
"default": ""
},
{
"name": "x-cs-connect-port",
"source": "x-cs-connect-port",
"default": ""
},
{
"name": "x-cs-connect-user-agent",
"source": "x-cs-connect-user-agent",
"default": ""
},
{
"name": "x-cs-url",
"source": "x-cs-url",
"default": ""
},
{
"name": "x-cs-uri-path",
"source": "x-cs-uri-path",
"default": ""
},
{
"name": "x-cs-http-version",
"source": "x-cs-http-version",
"default": ""
},
{
"name": "rs-status",
"source": "rs-status",
"default": ""
},
{
"name": "x-cs-app-category",
"source": "x-cs-app-category",
"default": ""
},
{
"name": "x-cs-app-cci",
"source": "x-cs-app-cci",
"default": ""
},
{
"name": "x-cs-app-ccl",
"source": "x-cs-app-ccl",
"default": ""
},
{
"name": "x-cs-app-tags",
"source": "x-cs-app-tags",
"default": ""
},
{
"name": "x-cs-app-suite",
"source": "x-cs-app-suite",
"default": ""
},
{
"name": "x-cs-app-instance-id",
"source": "x-cs-app-instance-id",
"default": ""
},
{
"name": "x-cs-app-instance-name",
"source": "x-cs-app-instance-name",
"default": ""
},
{
"name": "x-cs-app-instance-tag",
"source": "x-cs-app-instance-tag",
"default": ""
},
{
"name": "x-cs-app-activity",
"source": "x-cs-app-activity",
"default": ""
},
{
"name": "x-cs-app-from-user",
"source": "x-cs-app-from-user",
"default": ""
},
{
"name": "x-cs-app-to-user",
"source": "x-cs-app-to-user",
"default": ""
},
{
"name": "x-cs-app-object-type",
"source": "x-cs-app-object-type",
"default": ""
},
{
"name": "x-cs-app-object-name",
"source": "x-cs-app-object-name",
"default": ""
},
{
"name": "x-cs-app-object-id",
"source": "x-cs-app-object-id",
"default": ""
},
{
"name": "x-rs-file-type",
"source": "x-rs-file-type",
"default": ""
},
{
"name": "x-rs-file-category",
"source": "x-rs-file-category",
"default": ""
},
{
"name": "x-rs-file-language",
"source": "x-rs-file-language",
"default": ""
},
{
"name": "x-rs-file-size",
"source": "x-rs-file-size",
"default": ""
},
{
"name": "x-rs-file-md5",
"source": "x-rs-file-md5",
"default": ""
},
{
"name": "x-rs-file-sha256",
"source": "x-rs-file-sha256",
"default": ""
},
{
"name": "x-error",
"source": "x-error",
"default": ""
},
{
"name": "x-c-local-time",
"source": "x-c-local-time",
"default": ""
},
{
"name": "x-policy-action",
"source": "x-policy-action",
"default": ""
},
{
"name": "x-policy-name",
"source": "x-policy-name",
"default": ""
},
{
"name": "x-policy-src-ip",
"source": "x-policy-src-ip",
"default": ""
},
{
"name": "x-policy-dst-ip",
"source": "x-policy-dst-ip",
"default": ""
},
{
"name": "x-policy-dst-host",
"source": "x-policy-dst-host",
"default": ""
},
{
"name": "x-policy-dst-host-source",
"source": "x-policy-dst-host-source",
"default": ""
},
{
"name": "x-policy-justification-type",
"source": "x-policy-justification-type",
"default": ""
},
{
"name": "x-policy-justification-reason",
"source": "x-policy-justification-reason",
"default": ""
},
{
"name": "x-sc-notification-name",
"source": "x-sc-notification-name",
"default": ""
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
Sample format 4 JSON
{
"name": "Sample Format 4 JSON",
"description": "From Online Help, Transaction Event Format 4 in JSON, Cloud Exchange migration",
"type": "JSON",
"definition":
{
"remove_empty_fields": true,
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
},
{
"name": "x-cs-ssl-ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "x-sr-ssl-ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "x-ssl-bypass",
"source": "x-ssl-bypass",
"default": ""
},
{
"name": "x-ssl-bypass-reason",
"source": "x-ssl-bypass-reason",
"default": ""
},
{
"name": "x-r-cert-subject-cn",
"source": "x-r-cert-subject-cn",
"default": ""
},
{
"name": "x-r-cert-issuer-cn",
"source": "x-r-cert-issuer-cn",
"default": ""
},
{
"name": "x-r-cert-startdate",
"source": "x-r-cert-startdate",
"default": ""
},
{
"name": "x-r-cert-enddate",
"source": "x-r-cert-enddate",
"default": ""
},
{
"name": "x-r-cert-valid",
"source": "x-r-cert-valid",
"default": ""
},
{
"name": "x-r-cert-expired",
"source": "x-r-cert-expired",
"default": ""
},
{
"name": "x-r-cert-untrusted-root",
"source": "x-r-cert-untrusted-root",
"default": ""
},
{
"name": "x-r-cert-incomplete-chain",
"source": "x-r-cert-incomplete-chain",
"default": ""
},
{
"name": "x-r-cert-self-signed",
"source": "x-r-cert-self-signed",
"default": ""
},
{
"name": "x-r-cert-revoked",
"source": "x-r-cert-revoked",
"default": ""
},
{
"name": "x-r-cert-revocation-check",
"source": "x-r-cert-revocation-check",
"default": ""
},
{
"name": "x-r-cert-mismatch",
"source": "x-r-cert-mismatch",
"default": ""
},
{
"name": "x-cs-ssl-fronting-error",
"source": "x-cs-ssl-fronting-error",
"default": ""
},
{
"name": "x-cs-ssl-handshake-error",
"source": "x-cs-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-handshake-error",
"source": "x-sr-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-client-certificate-error",
"source": "x-sr-ssl-client-certificate-error",
"default": ""
},
{
"name": "x-sr-ssl-malformed-ssl",
"source": "x-sr-ssl-malformed-ssl",
"default": ""
},
{
"name": "x-s-custom-signing-ca-error",
"source": "x-s-custom-signing-ca-error",
"default": ""
},
{
"name": "x-cs-ssl-engine-action",
"source": "x-cs-ssl-engine-action",
"default": ""
},
{
"name": "x-cs-ssl-engine-action-reason",
"source": "x-cs-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-sr-ssl-engine-action",
"source": "x-sr-ssl-engine-action",
"default": ""
},
{
"name": "x-sr-ssl-engine-action-reason",
"source": "x-sr-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-ssl-policy-src-ip",
"source": "x-ssl-policy-src-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-ip",
"source": "x-ssl-policy-dst-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-host",
"source": "x-ssl-policy-dst-host",
"default": ""
},
{
"name": "x-ssl-policy-dst-host-source",
"source": "x-ssl-policy-dst-host-source",
"default": ""
},
{
"name": "x-ssl-policy-categories",
"source": "x-ssl-policy-categories",
"default": ""
},
{
"name": "x-ssl-policy-action",
"source": "x-ssl-policy-action",
"default": ""
},
{
"name": "x-ssl-policy-name",
"source": "x-ssl-policy-name",
"default": ""
},
{
"name": "x-cs-ssl-version",
"source": "x-cs-ssl-version",
"default": ""
},
{
"name": "x-cs-ssl-cipher",
"source": "x-cs-ssl-cipher",
"default": ""
},
{
"name": "x-sr-ssl-version",
"source": "x-sr-ssl-version",
"default": ""
},
{
"name": "x-sr-ssl-cipher",
"source": "x-sr-ssl-cipher",
"default": ""
},
{
"name": "x-cs-src-ip-egress",
"source": "x-cs-src-ip-egress",
"default": ""
},
{
"name": "x-s-dp-name",
"source": "x-s-dp-name",
"default": ""
},
{
"name": "x-cs-src-ip",
"source": "x-cs-src-ip",
"default": ""
},
{
"name": "x-cs-src-port",
"source": "x-cs-src-port",
"default": ""
},
{
"name": "x-cs-dst-ip",
"source": "x-cs-dst-ip",
"default": ""
},
{
"name": "x-cs-dst-port",
"source": "x-cs-dst-port",
"default": ""
},
{
"name": "x-sr-src-ip",
"source": "x-sr-src-ip",
"default": ""
},
{
"name": "x-sr-src-port",
"source": "x-sr-src-port",
"default": ""
},
{
"name": "x-sr-dst-ip",
"source": "x-sr-dst-ip",
"default": ""
},
{
"name": "x-sr-dst-port",
"source": "x-sr-dst-port",
"default": ""
},
{
"name": "x-cs-ip-connect-xff",
"source": "x-cs-ip-connect-xff",
"default": ""
},
{
"name": "x-cs-ip-xff",
"source": "x-cs-ip-xff",
"default": ""
},
{
"name": "x-cs-connect-host",
"source": "x-cs-connect-host",
"default": ""
},
{
"name": "x-cs-connect-port",
"source": "x-cs-connect-port",
"default": ""
},
{
"name": "x-cs-connect-user-agent",
"source": "x-cs-connect-user-agent",
"default": ""
},
{
"name": "x-cs-url",
"source": "x-cs-url",
"default": ""
},
{
"name": "x-cs-uri-path",
"source": "x-cs-uri-path",
"default": ""
},
{
"name": "x-cs-http-version",
"source": "x-cs-http-version",
"default": ""
},
{
"name": "rs-status",
"source": "rs-status",
"default": ""
},
{
"name": "x-cs-app-category",
"source": "x-cs-app-category",
"default": ""
},
{
"name": "x-cs-app-cci",
"source": "x-cs-app-cci",
"default": ""
},
{
"name": "x-cs-app-ccl",
"source": "x-cs-app-ccl",
"default": ""
},
{
"name": "x-cs-app-tags",
"source": "x-cs-app-tags",
"default": ""
},
{
"name": "x-cs-app-suite",
"source": "x-cs-app-suite",
"default": ""
},
{
"name": "x-cs-app-instance-id",
"source": "x-cs-app-instance-id",
"default": ""
},
{
"name": "x-cs-app-instance-name",
"source": "x-cs-app-instance-name",
"default": ""
},
{
"name": "x-cs-app-instance-tag",
"source": "x-cs-app-instance-tag",
"default": ""
},
{
"name": "x-cs-app-activity",
"source": "x-cs-app-activity",
"default": ""
},
{
"name": "x-cs-app-from-user",
"source": "x-cs-app-from-user",
"default": ""
},
{
"name": "x-cs-app-to-user",
"source": "x-cs-app-to-user",
"default": ""
},
{
"name": "x-cs-app-object-type",
"source": "x-cs-app-object-type",
"default": ""
},
{
"name": "x-cs-app-object-name",
"source": "x-cs-app-object-name",
"default": ""
},
{
"name": "x-cs-app-object-id",
"source": "x-cs-app-object-id",
"default": ""
},
{
"name": "x-rs-file-type",
"source": "x-rs-file-type",
"default": ""
},
{
"name": "x-rs-file-category",
"source": "x-rs-file-category",
"default": ""
},
{
"name": "x-rs-file-language",
"source": "x-rs-file-language",
"default": ""
},
{
"name": "x-rs-file-size",
"source": "x-rs-file-size",
"default": ""
},
{
"name": "x-rs-file-md5",
"source": "x-rs-file-md5",
"default": ""
},
{
"name": "x-rs-file-sha256",
"source": "x-rs-file-sha256",
"default": ""
},
{
"name": "x-error",
"source": "x-error",
"default": ""
},
{
"name": "x-c-local-time",
"source": "x-c-local-time",
"default": ""
},
{
"name": "x-policy-action",
"source": "x-policy-action",
"default": ""
},
{
"name": "x-policy-name",
"source": "x-policy-name",
"default": ""
},
{
"name": "x-policy-src-ip",
"source": "x-policy-src-ip",
"default": ""
},
{
"name": "x-policy-dst-ip",
"source": "x-policy-dst-ip",
"default": ""
},
{
"name": "x-policy-dst-host",
"source": "x-policy-dst-host",
"default": ""
},
{
"name": "x-policy-dst-host-source",
"source": "x-policy-dst-host-source",
"default": ""
},
{
"name": "x-policy-justification-type",
"source": "x-policy-justification-type",
"default": ""
},
{
"name": "x-policy-justification-reason",
"source": "x-policy-justification-reason",
"default": ""
},
{
"name": "x-sc-notification-name",
"source": "x-sc-notification-name",
"default": ""
},
{
"name": "sr-bytes",
"source": "sr-bytes",
"default": ""
},
{
"name": "rs-bytes",
"source": "rs-bytes",
"default": ""
},
{
"name": "x-action",
"source": "x-action",
"default": ""
},
{
"name": "x-action-reason",
"source": "x-action-reason",
"default": ""
},
{
"name": "x-c-authn-user",
"source": "x-c-authn-user",
"default": ""
},
{
"name": "x-c-authn-source",
"source": "x-c-authn-source",
"default": ""
},
{
"name": "x-c-authn-surrogate",
"source": "x-c-authn-surrogate",
"default": ""
},
{
"name": "x-c-authn-surrogate-status",
"source": "x-c-authn-surrogate-status",
"default": ""
},
{
"name": "x-c-authz-groups",
"source": "x-c-authz-groups",
"default": ""
},
{
"name": "x-c-authz-ou",
"source": "x-c-authz-ou",
"default": ""
},
{
"name": "x-cs-xau",
"source": "x-cs-xau",
"default": ""
},
{
"name": "x-cs-connect-xau",
"source": "x-cs-connect-xau",
"default": ""
},
{
"name": "x-c-user-confidence-index",
"source": "x-c-user-confidence-index",
"default": ""
},
{
"name": "x-c-hostname",
"source": "x-c-hostname",
"default": ""
},
{
"name": "x-c-device-uid",
"source": "x-c-device-uid",
"default": ""
},
{
"name": "x-c-os-family",
"source": "x-c-os-family",
"default": ""
},
{
"name": "x-c-os-version",
"source": "x-c-os-version",
"default": ""
},
{
"name": "x-c-nsclient-version",
"source": "x-c-nsclient-version",
"default": ""
},
{
"name": "x-c-nsclient-client-profile",
"source": "x-c-nsclient-client-profile",
"default": ""
},
{
"name": "x-c-nsclient-steering-profile",
"source": "x-c-nsclient-steering-profile",
"default": ""
},
{
"name": "x-c-device-classification",
"source": "x-c-device-classification",
"default": ""
},
{
"name": "x-cs-nsclient-tunnel-type",
"source": "x-cs-nsclient-tunnel-type",
"default": ""
},
{
"name": "x-cs-process",
"source": "x-cs-process",
"default": ""
},
{
"name": "x-cs-pid",
"source": "x-cs-pid",
"default": ""
},
{
"name": "x-cs-parent-process",
"source": "x-cs-parent-process",
"default": ""
},
{
"name": "x-cs-ppid",
"source": "x-cs-ppid",
"default": ""
},
{
"name": "x-tp-result",
"source": "x-tp-result",
"default": ""
},
{
"name": "x-tp-engine",
"source": "x-tp-engine",
"default": ""
},
{
"name": "x-tp-malware-name",
"source": "x-tp-malware-name",
"default": ""
},
{
"name": "x-tp-severity",
"source": "x-tp-severity",
"default": ""
},
{
"name": "x-sr-forward-dest",
"source": "x-sr-forward-dest",
"default": ""
},
{
"name": "x-ssl-policy-issuer",
"source": "x-ssl-policy-issuer",
"default": ""
},
{
"name": "x-eip-policy-name",
"source": "x-eip-policy-name",
"default": ""
},
{
"name": "x-eip-policy-footprint",
"source": "x-eip-policy-footprint",
"default": ""
},
{
"name": "x-policy-categories",
"source": "x-policy-categories",
"default": ""
},
{
"name": "x-c-timezone",
"source": "x-c-timezone",
"default": ""
},
{
"name": "x-support",
"source": "x-support",
"default": ""
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
CEF Native Format 1 to Format 4
Those configurations are providing mapping for legacy Format 1 to Format 4 field list in CEF format without any field rename.
Sample Format 1 CEF Native
{
"name": "Sample Format 1 CEF native",
"description": "From Online Help, Transaction Event Format 1 in CEF, fields not renamed",
"type": "CEF",
"definition":
{
"remove_empty_fields": true,
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
}
],
"header":
[
{
"name": "device_vendor",
"source": "",
"default": "Netskope"
},
{
"name": "device_product",
"source": "",
"default": "WebTX"
},
{
"name": "device_version",
"source": "",
"default": "NULL"
},
{
"name": "signature_id",
"source": "",
"default": "webtx"
},
{
"name": "name",
"source": "",
"default": "webtx"
},
{
"name": "severity",
"source": "",
"default": "Unknown"
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
Sample Format 2 CEF Native
{
"name": "Sample Format 2 CEF native",
"description": "From Online Help, Transaction Event Format 2 in CEF, fields not renamed",
"type": "CEF",
"definition":
{
"remove_empty_fields": true,
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
},
{
"name": "x-cs-ssl-ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "x-sr-ssl-ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "x-ssl-bypass",
"source": "x-ssl-bypass",
"default": ""
},
{
"name": "x-ssl-bypass-reason",
"source": "x-ssl-bypass-reason",
"default": ""
},
{
"name": "x-r-cert-subject-cn",
"source": "x-r-cert-subject-cn",
"default": ""
},
{
"name": "x-r-cert-issuer-cn",
"source": "x-r-cert-issuer-cn",
"default": ""
},
{
"name": "x-r-cert-startdate",
"source": "x-r-cert-startdate",
"default": ""
},
{
"name": "x-r-cert-enddate",
"source": "x-r-cert-enddate",
"default": ""
},
{
"name": "x-r-cert-valid",
"source": "x-r-cert-valid",
"default": ""
},
{
"name": "x-r-cert-expired",
"source": "x-r-cert-expired",
"default": ""
},
{
"name": "x-r-cert-untrusted-root",
"source": "x-r-cert-untrusted-root",
"default": ""
},
{
"name": "x-r-cert-incomplete-chain",
"source": "x-r-cert-incomplete-chain",
"default": ""
},
{
"name": "x-r-cert-self-signed",
"source": "x-r-cert-self-signed",
"default": ""
},
{
"name": "x-r-cert-revoked",
"source": "x-r-cert-revoked",
"default": ""
},
{
"name": "x-r-cert-revocation-check",
"source": "x-r-cert-revocation-check",
"default": ""
},
{
"name": "x-r-cert-mismatch",
"source": "x-r-cert-mismatch",
"default": ""
},
{
"name": "x-cs-ssl-fronting-error",
"source": "x-cs-ssl-fronting-error",
"default": ""
},
{
"name": "x-cs-ssl-handshake-error",
"source": "x-cs-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-handshake-error",
"source": "x-sr-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-client-certificate-error",
"source": "x-sr-ssl-client-certificate-error",
"default": ""
},
{
"name": "x-sr-ssl-malformed-ssl",
"source": "x-sr-ssl-malformed-ssl",
"default": ""
},
{
"name": "x-s-custom-signing-ca-error",
"source": "x-s-custom-signing-ca-error",
"default": ""
},
{
"name": "x-cs-ssl-engine-action",
"source": "x-cs-ssl-engine-action",
"default": ""
},
{
"name": "x-cs-ssl-engine-action-reason",
"source": "x-cs-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-sr-ssl-engine-action",
"source": "x-sr-ssl-engine-action",
"default": ""
},
{
"name": "x-sr-ssl-engine-action-reason",
"source": "x-sr-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-ssl-policy-src-ip",
"source": "x-ssl-policy-src-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-ip",
"source": "x-ssl-policy-dst-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-host",
"source": "x-ssl-policy-dst-host",
"default": ""
},
{
"name": "x-ssl-policy-dst-host-source",
"source": "x-ssl-policy-dst-host-source",
"default": ""
},
{
"name": "x-ssl-policy-categories",
"source": "x-ssl-policy-categories",
"default": ""
},
{
"name": "x-ssl-policy-action",
"source": "x-ssl-policy-action",
"default": ""
},
{
"name": "x-ssl-policy-name",
"source": "x-ssl-policy-name",
"default": ""
},
{
"name": "x-cs-ssl-version",
"source": "x-cs-ssl-version",
"default": ""
},
{
"name": "x-cs-ssl-cipher",
"source": "x-cs-ssl-cipher",
"default": ""
},
{
"name": "x-sr-ssl-version",
"source": "x-sr-ssl-version",
"default": ""
},
{
"name": "x-sr-ssl-cipher",
"source": "x-sr-ssl-cipher",
"default": ""
},
{
"name": "x-cs-src-ip-egress",
"source": "x-cs-src-ip-egress",
"default": ""
}
],
"header":
[
{
"name": "device_vendor",
"source": "",
"default": "Netskope"
},
{
"name": "device_product",
"source": "",
"default": "WebTX"
},
{
"name": "device_version",
"source": "",
"default": "NULL"
},
{
"name": "signature_id",
"source": "",
"default": "webtx"
},
{
"name": "name",
"source": "",
"default": "webtx"
},
{
"name": "severity",
"source": "",
"default": "Unknown"
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
Sample Format 3 CEF Native
{
"name": "Sample Format 3 CEF native",
"description": "From Online Help, Transaction Event Format 3 in CEF, fields not renamed",
"type": "CEF",
"definition":
{
"remove_empty_fields": true,
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
},
{
"name": "x-cs-ssl-ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "x-sr-ssl-ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "x-ssl-bypass",
"source": "x-ssl-bypass",
"default": ""
},
{
"name": "x-ssl-bypass-reason",
"source": "x-ssl-bypass-reason",
"default": ""
},
{
"name": "x-r-cert-subject-cn",
"source": "x-r-cert-subject-cn",
"default": ""
},
{
"name": "x-r-cert-issuer-cn",
"source": "x-r-cert-issuer-cn",
"default": ""
},
{
"name": "x-r-cert-startdate",
"source": "x-r-cert-startdate",
"default": ""
},
{
"name": "x-r-cert-enddate",
"source": "x-r-cert-enddate",
"default": ""
},
{
"name": "x-r-cert-valid",
"source": "x-r-cert-valid",
"default": ""
},
{
"name": "x-r-cert-expired",
"source": "x-r-cert-expired",
"default": ""
},
{
"name": "x-r-cert-untrusted-root",
"source": "x-r-cert-untrusted-root",
"default": ""
},
{
"name": "x-r-cert-incomplete-chain",
"source": "x-r-cert-incomplete-chain",
"default": ""
},
{
"name": "x-r-cert-self-signed",
"source": "x-r-cert-self-signed",
"default": ""
},
{
"name": "x-r-cert-revoked",
"source": "x-r-cert-revoked",
"default": ""
},
{
"name": "x-r-cert-revocation-check",
"source": "x-r-cert-revocation-check",
"default": ""
},
{
"name": "x-r-cert-mismatch",
"source": "x-r-cert-mismatch",
"default": ""
},
{
"name": "x-cs-ssl-fronting-error",
"source": "x-cs-ssl-fronting-error",
"default": ""
},
{
"name": "x-cs-ssl-handshake-error",
"source": "x-cs-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-handshake-error",
"source": "x-sr-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-client-certificate-error",
"source": "x-sr-ssl-client-certificate-error",
"default": ""
},
{
"name": "x-sr-ssl-malformed-ssl",
"source": "x-sr-ssl-malformed-ssl",
"default": ""
},
{
"name": "x-s-custom-signing-ca-error",
"source": "x-s-custom-signing-ca-error",
"default": ""
},
{
"name": "x-cs-ssl-engine-action",
"source": "x-cs-ssl-engine-action",
"default": ""
},
{
"name": "x-cs-ssl-engine-action-reason",
"source": "x-cs-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-sr-ssl-engine-action",
"source": "x-sr-ssl-engine-action",
"default": ""
},
{
"name": "x-sr-ssl-engine-action-reason",
"source": "x-sr-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-ssl-policy-src-ip",
"source": "x-ssl-policy-src-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-ip",
"source": "x-ssl-policy-dst-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-host",
"source": "x-ssl-policy-dst-host",
"default": ""
},
{
"name": "x-ssl-policy-dst-host-source",
"source": "x-ssl-policy-dst-host-source",
"default": ""
},
{
"name": "x-ssl-policy-categories",
"source": "x-ssl-policy-categories",
"default": ""
},
{
"name": "x-ssl-policy-action",
"source": "x-ssl-policy-action",
"default": ""
},
{
"name": "x-ssl-policy-name",
"source": "x-ssl-policy-name",
"default": ""
},
{
"name": "x-cs-ssl-version",
"source": "x-cs-ssl-version",
"default": ""
},
{
"name": "x-cs-ssl-cipher",
"source": "x-cs-ssl-cipher",
"default": ""
},
{
"name": "x-sr-ssl-version",
"source": "x-sr-ssl-version",
"default": ""
},
{
"name": "x-sr-ssl-cipher",
"source": "x-sr-ssl-cipher",
"default": ""
},
{
"name": "x-cs-src-ip-egress",
"source": "x-cs-src-ip-egress",
"default": ""
},
{
"name": "x-s-dp-name",
"source": "x-s-dp-name",
"default": ""
},
{
"name": "x-cs-src-ip",
"source": "x-cs-src-ip",
"default": ""
},
{
"name": "x-cs-src-port",
"source": "x-cs-src-port",
"default": ""
},
{
"name": "x-cs-dst-ip",
"source": "x-cs-dst-ip",
"default": ""
},
{
"name": "x-cs-dst-port",
"source": "x-cs-dst-port",
"default": ""
},
{
"name": "x-sr-src-ip",
"source": "x-sr-src-ip",
"default": ""
},
{
"name": "x-sr-src-port",
"source": "x-sr-src-port",
"default": ""
},
{
"name": "x-sr-dst-ip",
"source": "x-sr-dst-ip",
"default": ""
},
{
"name": "x-sr-dst-port",
"source": "x-sr-dst-port",
"default": ""
},
{
"name": "x-cs-ip-connect-xff",
"source": "x-cs-ip-connect-xff",
"default": ""
},
{
"name": "x-cs-ip-xff",
"source": "x-cs-ip-xff",
"default": ""
},
{
"name": "x-cs-connect-host",
"source": "x-cs-connect-host",
"default": ""
},
{
"name": "x-cs-connect-port",
"source": "x-cs-connect-port",
"default": ""
},
{
"name": "x-cs-connect-user-agent",
"source": "x-cs-connect-user-agent",
"default": ""
},
{
"name": "x-cs-url",
"source": "x-cs-url",
"default": ""
},
{
"name": "x-cs-uri-path",
"source": "x-cs-uri-path",
"default": ""
},
{
"name": "x-cs-http-version",
"source": "x-cs-http-version",
"default": ""
},
{
"name": "rs-status",
"source": "rs-status",
"default": ""
},
{
"name": "x-cs-app-category",
"source": "x-cs-app-category",
"default": ""
},
{
"name": "x-cs-app-cci",
"source": "x-cs-app-cci",
"default": ""
},
{
"name": "x-cs-app-ccl",
"source": "x-cs-app-ccl",
"default": ""
},
{
"name": "x-cs-app-tags",
"source": "x-cs-app-tags",
"default": ""
},
{
"name": "x-cs-app-suite",
"source": "x-cs-app-suite",
"default": ""
},
{
"name": "x-cs-app-instance-id",
"source": "x-cs-app-instance-id",
"default": ""
},
{
"name": "x-cs-app-instance-name",
"source": "x-cs-app-instance-name",
"default": ""
},
{
"name": "x-cs-app-instance-tag",
"source": "x-cs-app-instance-tag",
"default": ""
},
{
"name": "x-cs-app-activity",
"source": "x-cs-app-activity",
"default": ""
},
{
"name": "x-cs-app-from-user",
"source": "x-cs-app-from-user",
"default": ""
},
{
"name": "x-cs-app-to-user",
"source": "x-cs-app-to-user",
"default": ""
},
{
"name": "x-cs-app-object-type",
"source": "x-cs-app-object-type",
"default": ""
},
{
"name": "x-cs-app-object-name",
"source": "x-cs-app-object-name",
"default": ""
},
{
"name": "x-cs-app-object-id",
"source": "x-cs-app-object-id",
"default": ""
},
{
"name": "x-rs-file-type",
"source": "x-rs-file-type",
"default": ""
},
{
"name": "x-rs-file-category",
"source": "x-rs-file-category",
"default": ""
},
{
"name": "x-rs-file-language",
"source": "x-rs-file-language",
"default": ""
},
{
"name": "x-rs-file-size",
"source": "x-rs-file-size",
"default": ""
},
{
"name": "x-rs-file-md5",
"source": "x-rs-file-md5",
"default": ""
},
{
"name": "x-rs-file-sha256",
"source": "x-rs-file-sha256",
"default": ""
},
{
"name": "x-error",
"source": "x-error",
"default": ""
},
{
"name": "x-c-local-time",
"source": "x-c-local-time",
"default": ""
},
{
"name": "x-policy-action",
"source": "x-policy-action",
"default": ""
},
{
"name": "x-policy-name",
"source": "x-policy-name",
"default": ""
},
{
"name": "x-policy-src-ip",
"source": "x-policy-src-ip",
"default": ""
},
{
"name": "x-policy-dst-ip",
"source": "x-policy-dst-ip",
"default": ""
},
{
"name": "x-policy-dst-host",
"source": "x-policy-dst-host",
"default": ""
},
{
"name": "x-policy-dst-host-source",
"source": "x-policy-dst-host-source",
"default": ""
},
{
"name": "x-policy-justification-type",
"source": "x-policy-justification-type",
"default": ""
},
{
"name": "x-policy-justification-reason",
"source": "x-policy-justification-reason",
"default": ""
},
{
"name": "x-sc-notification-name",
"source": "x-sc-notification-name",
"default": ""
}
],
"header":
[
{
"name": "device_vendor",
"source": "",
"default": "Netskope"
},
{
"name": "device_product",
"source": "",
"default": "WebTX"
},
{
"name": "device_version",
"source": "",
"default": "NULL"
},
{
"name": "signature_id",
"source": "",
"default": "webtx"
},
{
"name": "name",
"source": "",
"default": "webtx"
},
{
"name": "severity",
"source": "",
"default": "Unknown"
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
Sample Format 4 CEF Native
{
"name": "Sample Format 4 CEF native",
"description": "From Online Help, Transaction Event Format 4 in CEF, fields not renamed",
"type": "CEF",
"definition":
{
"remove_empty_fields": true,
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
},
{
"name": "x-cs-ssl-ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "x-sr-ssl-ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "x-ssl-bypass",
"source": "x-ssl-bypass",
"default": ""
},
{
"name": "x-ssl-bypass-reason",
"source": "x-ssl-bypass-reason",
"default": ""
},
{
"name": "x-r-cert-subject-cn",
"source": "x-r-cert-subject-cn",
"default": ""
},
{
"name": "x-r-cert-issuer-cn",
"source": "x-r-cert-issuer-cn",
"default": ""
},
{
"name": "x-r-cert-startdate",
"source": "x-r-cert-startdate",
"default": ""
},
{
"name": "x-r-cert-enddate",
"source": "x-r-cert-enddate",
"default": ""
},
{
"name": "x-r-cert-valid",
"source": "x-r-cert-valid",
"default": ""
},
{
"name": "x-r-cert-expired",
"source": "x-r-cert-expired",
"default": ""
},
{
"name": "x-r-cert-untrusted-root",
"source": "x-r-cert-untrusted-root",
"default": ""
},
{
"name": "x-r-cert-incomplete-chain",
"source": "x-r-cert-incomplete-chain",
"default": ""
},
{
"name": "x-r-cert-self-signed",
"source": "x-r-cert-self-signed",
"default": ""
},
{
"name": "x-r-cert-revoked",
"source": "x-r-cert-revoked",
"default": ""
},
{
"name": "x-r-cert-revocation-check",
"source": "x-r-cert-revocation-check",
"default": ""
},
{
"name": "x-r-cert-mismatch",
"source": "x-r-cert-mismatch",
"default": ""
},
{
"name": "x-cs-ssl-fronting-error",
"source": "x-cs-ssl-fronting-error",
"default": ""
},
{
"name": "x-cs-ssl-handshake-error",
"source": "x-cs-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-handshake-error",
"source": "x-sr-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-client-certificate-error",
"source": "x-sr-ssl-client-certificate-error",
"default": ""
},
{
"name": "x-sr-ssl-malformed-ssl",
"source": "x-sr-ssl-malformed-ssl",
"default": ""
},
{
"name": "x-s-custom-signing-ca-error",
"source": "x-s-custom-signing-ca-error",
"default": ""
},
{
"name": "x-cs-ssl-engine-action",
"source": "x-cs-ssl-engine-action",
"default": ""
},
{
"name": "x-cs-ssl-engine-action-reason",
"source": "x-cs-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-sr-ssl-engine-action",
"source": "x-sr-ssl-engine-action",
"default": ""
},
{
"name": "x-sr-ssl-engine-action-reason",
"source": "x-sr-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-ssl-policy-src-ip",
"source": "x-ssl-policy-src-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-ip",
"source": "x-ssl-policy-dst-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-host",
"source": "x-ssl-policy-dst-host",
"default": ""
},
{
"name": "x-ssl-policy-dst-host-source",
"source": "x-ssl-policy-dst-host-source",
"default": ""
},
{
"name": "x-ssl-policy-categories",
"source": "x-ssl-policy-categories",
"default": ""
},
{
"name": "x-ssl-policy-action",
"source": "x-ssl-policy-action",
"default": ""
},
{
"name": "x-ssl-policy-name",
"source": "x-ssl-policy-name",
"default": ""
},
{
"name": "x-cs-ssl-version",
"source": "x-cs-ssl-version",
"default": ""
},
{
"name": "x-cs-ssl-cipher",
"source": "x-cs-ssl-cipher",
"default": ""
},
{
"name": "x-sr-ssl-version",
"source": "x-sr-ssl-version",
"default": ""
},
{
"name": "x-sr-ssl-cipher",
"source": "x-sr-ssl-cipher",
"default": ""
},
{
"name": "x-cs-src-ip-egress",
"source": "x-cs-src-ip-egress",
"default": ""
},
{
"name": "x-s-dp-name",
"source": "x-s-dp-name",
"default": ""
},
{
"name": "x-cs-src-ip",
"source": "x-cs-src-ip",
"default": ""
},
{
"name": "x-cs-src-port",
"source": "x-cs-src-port",
"default": ""
},
{
"name": "x-cs-dst-ip",
"source": "x-cs-dst-ip",
"default": ""
},
{
"name": "x-cs-dst-port",
"source": "x-cs-dst-port",
"default": ""
},
{
"name": "x-sr-src-ip",
"source": "x-sr-src-ip",
"default": ""
},
{
"name": "x-sr-src-port",
"source": "x-sr-src-port",
"default": ""
},
{
"name": "x-sr-dst-ip",
"source": "x-sr-dst-ip",
"default": ""
},
{
"name": "x-sr-dst-port",
"source": "x-sr-dst-port",
"default": ""
},
{
"name": "x-cs-ip-connect-xff",
"source": "x-cs-ip-connect-xff",
"default": ""
},
{
"name": "x-cs-ip-xff",
"source": "x-cs-ip-xff",
"default": ""
},
{
"name": "x-cs-connect-host",
"source": "x-cs-connect-host",
"default": ""
},
{
"name": "x-cs-connect-port",
"source": "x-cs-connect-port",
"default": ""
},
{
"name": "x-cs-connect-user-agent",
"source": "x-cs-connect-user-agent",
"default": ""
},
{
"name": "x-cs-url",
"source": "x-cs-url",
"default": ""
},
{
"name": "x-cs-uri-path",
"source": "x-cs-uri-path",
"default": ""
},
{
"name": "x-cs-http-version",
"source": "x-cs-http-version",
"default": ""
},
{
"name": "rs-status",
"source": "rs-status",
"default": ""
},
{
"name": "x-cs-app-category",
"source": "x-cs-app-category",
"default": ""
},
{
"name": "x-cs-app-cci",
"source": "x-cs-app-cci",
"default": ""
},
{
"name": "x-cs-app-ccl",
"source": "x-cs-app-ccl",
"default": ""
},
{
"name": "x-cs-app-tags",
"source": "x-cs-app-tags",
"default": ""
},
{
"name": "x-cs-app-suite",
"source": "x-cs-app-suite",
"default": ""
},
{
"name": "x-cs-app-instance-id",
"source": "x-cs-app-instance-id",
"default": ""
},
{
"name": "x-cs-app-instance-name",
"source": "x-cs-app-instance-name",
"default": ""
},
{
"name": "x-cs-app-instance-tag",
"source": "x-cs-app-instance-tag",
"default": ""
},
{
"name": "x-cs-app-activity",
"source": "x-cs-app-activity",
"default": ""
},
{
"name": "x-cs-app-from-user",
"source": "x-cs-app-from-user",
"default": ""
},
{
"name": "x-cs-app-to-user",
"source": "x-cs-app-to-user",
"default": ""
},
{
"name": "x-cs-app-object-type",
"source": "x-cs-app-object-type",
"default": ""
},
{
"name": "x-cs-app-object-name",
"source": "x-cs-app-object-name",
"default": ""
},
{
"name": "x-cs-app-object-id",
"source": "x-cs-app-object-id",
"default": ""
},
{
"name": "x-rs-file-type",
"source": "x-rs-file-type",
"default": ""
},
{
"name": "x-rs-file-category",
"source": "x-rs-file-category",
"default": ""
},
{
"name": "x-rs-file-language",
"source": "x-rs-file-language",
"default": ""
},
{
"name": "x-rs-file-size",
"source": "x-rs-file-size",
"default": ""
},
{
"name": "x-rs-file-md5",
"source": "x-rs-file-md5",
"default": ""
},
{
"name": "x-rs-file-sha256",
"source": "x-rs-file-sha256",
"default": ""
},
{
"name": "x-error",
"source": "x-error",
"default": ""
},
{
"name": "x-c-local-time",
"source": "x-c-local-time",
"default": ""
},
{
"name": "x-policy-action",
"source": "x-policy-action",
"default": ""
},
{
"name": "x-policy-name",
"source": "x-policy-name",
"default": ""
},
{
"name": "x-policy-src-ip",
"source": "x-policy-src-ip",
"default": ""
},
{
"name": "x-policy-dst-ip",
"source": "x-policy-dst-ip",
"default": ""
},
{
"name": "x-policy-dst-host",
"source": "x-policy-dst-host",
"default": ""
},
{
"name": "x-policy-dst-host-source",
"source": "x-policy-dst-host-source",
"default": ""
},
{
"name": "x-policy-justification-type",
"source": "x-policy-justification-type",
"default": ""
},
{
"name": "x-policy-justification-reason",
"source": "x-policy-justification-reason",
"default": ""
},
{
"name": "x-sc-notification-name",
"source": "x-sc-notification-name",
"default": ""
},
{
"name": "sr-bytes",
"source": "sr-bytes",
"default": ""
},
{
"name": "rs-bytes",
"source": "rs-bytes",
"default": ""
},
{
"name": "x-action",
"source": "x-action",
"default": ""
},
{
"name": "x-action-reason",
"source": "x-action-reason",
"default": ""
},
{
"name": "x-c-authn-user",
"source": "x-c-authn-user",
"default": ""
},
{
"name": "x-c-authn-source",
"source": "x-c-authn-source",
"default": ""
},
{
"name": "x-c-authn-surrogate",
"source": "x-c-authn-surrogate",
"default": ""
},
{
"name": "x-c-authn-surrogate-status",
"source": "x-c-authn-surrogate-status",
"default": ""
},
{
"name": "x-c-authz-groups",
"source": "x-c-authz-groups",
"default": ""
},
{
"name": "x-c-authz-ou",
"source": "x-c-authz-ou",
"default": ""
},
{
"name": "x-cs-xau",
"source": "x-cs-xau",
"default": ""
},
{
"name": "x-cs-connect-xau",
"source": "x-cs-connect-xau",
"default": ""
},
{
"name": "x-c-user-confidence-index",
"source": "x-c-user-confidence-index",
"default": ""
},
{
"name": "x-c-hostname",
"source": "x-c-hostname",
"default": ""
},
{
"name": "x-c-device-uid",
"source": "x-c-device-uid",
"default": ""
},
{
"name": "x-c-os-family",
"source": "x-c-os-family",
"default": ""
},
{
"name": "x-c-os-version",
"source": "x-c-os-version",
"default": ""
},
{
"name": "x-c-nsclient-version",
"source": "x-c-nsclient-version",
"default": ""
},
{
"name": "x-c-nsclient-client-profile",
"source": "x-c-nsclient-client-profile",
"default": ""
},
{
"name": "x-c-nsclient-steering-profile",
"source": "x-c-nsclient-steering-profile",
"default": ""
},
{
"name": "x-c-device-classification",
"source": "x-c-device-classification",
"default": ""
},
{
"name": "x-cs-nsclient-tunnel-type",
"source": "x-cs-nsclient-tunnel-type",
"default": ""
},
{
"name": "x-cs-process",
"source": "x-cs-process",
"default": ""
},
{
"name": "x-cs-pid",
"source": "x-cs-pid",
"default": ""
},
{
"name": "x-cs-parent-process",
"source": "x-cs-parent-process",
"default": ""
},
{
"name": "x-cs-ppid",
"source": "x-cs-ppid",
"default": ""
},
{
"name": "x-tp-result",
"source": "x-tp-result",
"default": ""
},
{
"name": "x-tp-engine",
"source": "x-tp-engine",
"default": ""
},
{
"name": "x-tp-malware-name",
"source": "x-tp-malware-name",
"default": ""
},
{
"name": "x-tp-severity",
"source": "x-tp-severity",
"default": ""
},
{
"name": "x-sr-forward-dest",
"source": "x-sr-forward-dest",
"default": ""
},
{
"name": "x-ssl-policy-issuer",
"source": "x-ssl-policy-issuer",
"default": ""
},
{
"name": "x-eip-policy-name",
"source": "x-eip-policy-name",
"default": ""
},
{
"name": "x-eip-policy-footprint",
"source": "x-eip-policy-footprint",
"default": ""
},
{
"name": "x-policy-categories",
"source": "x-policy-categories",
"default": ""
},
{
"name": "x-c-timezone",
"source": "x-c-timezone",
"default": ""
},
{
"name": "x-support",
"source": "x-support",
"default": ""
}
],
"header":
[
{
"name": "device_vendor",
"source": "",
"default": "Netskope"
},
{
"name": "device_product",
"source": "",
"default": "WebTX"
},
{
"name": "device_version",
"source": "",
"default": "NULL"
},
{
"name": "signature_id",
"source": "",
"default": "webtx"
},
{
"name": "name",
"source": "",
"default": "webtx"
},
{
"name": "severity",
"source": "",
"default": "Unknown"
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
CEF Cloud Exchange Format 3
This configuration reproduces the default mapping for Cloud Exchange.
Sample Format 3 CEF CLS
{
"name": "Sample Format 3 CEF CLS",
"description": "From Online Help, Transaction Event Format 3 in CEF, field mapping with Cloud Exchange default syslog mapping",
"type": "CEF",
"definition":
{
"remove_empty_fields": true,
"customize": true,
"custom_fields":
[
{
"name": "NetskopeJustificationReason",
"source": "x-policy-justification-reason",
"default": ""
},
{
"name": "NetskopeJustificationType",
"source": "x-policy-justification-type",
"default": ""
},
{
"name": "act",
"source": "x-policy-action",
"default": ""
},
{
"name": "app",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cat",
"source": "x-category",
"default": ""
},
{
"name": "cn1",
"source": "time-taken",
"default": ""
},
{
"name": "cn1Label",
"source": "",
"default": "time-taken"
},
{
"name": "cn2",
"source": "bytes",
"default": ""
},
{
"name": "cn2Label",
"source": "",
"default": "bytes"
},
{
"name": "cn3",
"source": "x-transaction-id",
"default": ""
},
{
"name": "cn3Label",
"source": "",
"default": "transaction-id"
},
{
"name": "cs1",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs1Label",
"source": "",
"default": "uri-query"
},
{
"name": "cs2",
"source": "cs-content-type",
"default": ""
},
{
"name": "cs2Label",
"source": "",
"default": "content-type"
},
{
"name": "cs3",
"source": "x-c-device",
"default": ""
},
{
"name": "cs3Label",
"source": "",
"default": "client-device"
},
{
"name": "cs4",
"source": "x-other-category",
"default": ""
},
{
"name": "cs4Label",
"source": "",
"default": "other-category"
},
{
"name": "cs5",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "cs5Label",
"source": "",
"default": "server-ssl-error"
},
{
"name": "cs6",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "cs6Label",
"source": "",
"default": "client-ssl-err"
},
{
"name": "destinationTranslatedPort",
"source": "x-cs-connect-port",
"default": ""
},
{
"name": "deviceCustomDate1",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "deviceCustomDate1Label",
"source": "",
"default": "x-cs-timestamp"
},
{
"name": "deviceDnsDomain",
"source": "x-cs-app-instance-id",
"default": ""
},
{
"name": "devicePayloadId",
"source": "x-cs-app-object-id",
"default": ""
},
{
"name": "dhost",
"source": "x-policy-dst-host",
"default": ""
},
{
"name": "dlat",
"source": "x-s-latitude",
"default": ""
},
{
"name": "dlong",
"source": "x-s-longitude",
"default": ""
},
{
"name": "dpt",
"source": "cs-uri-port",
"default": ""
},
{
"name": "dst",
"source": "s-ip",
"default": ""
},
{
"name": "duid",
"source": "x-cs-app-from-user",
"default": ""
},
{
"name": "duser",
"source": "cs-username",
"default": ""
},
{
"name": "dvchost",
"source": "cs-host",
"default": ""
},
{
"name": "fileHash",
"source": "x-rs-file-md5",
"default": ""
},
{
"name": "fileType",
"source": "sc-content-type",
"default": ""
},
{
"name": "flexString1",
"source": "x-cs-site",
"default": ""
},
{
"name": "flexString1Label",
"source": "",
"default": "client-site"
},
{
"name": "flexString2",
"source": "x-type",
"default": ""
},
{
"name": "flexString2Label",
"source": "",
"default": "type"
},
{
"name": "fname",
"source": "x-cs-app-object-name",
"default": ""
},
{
"name": "in",
"source": "cs-bytes",
"default": ""
},
{
"name": "ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "out",
"source": "sc-bytes",
"default": ""
},
{
"name": "reason",
"source": "x-error",
"default": ""
},
{
"name": "request",
"source": "cs-uri",
"default": ""
},
{
"name": "requestClientApplication",
"source": "cs-user-agent",
"default": ""
},
{
"name": "requestContext",
"source": "cs-referer",
"default": ""
},
{
"name": "requestMethod",
"source": "cs-method",
"default": ""
},
{
"name": "shost",
"source": "x-cs-connect-host",
"default": ""
},
{
"name": "slat",
"source": "x-c-latitude",
"default": ""
},
{
"name": "slong",
"source": "x-c-longitude",
"default": ""
},
{
"name": "sourceDnsDomain",
"source": "cs-dns",
"default": ""
},
{
"name": "sourceServiceName",
"source": "x-cs-app",
"default": ""
},
{
"name": "sourceTranslatedAddress",
"source": "x-cs-src-ip-egress",
"default": ""
},
{
"name": "sproc",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "spt",
"source": "x-cs-src-port",
"default": ""
},
{
"name": "src",
"source": "c-ip",
"default": ""
},
{
"name": "suser",
"source": "x-cs-app-to-user",
"default": ""
}
],
"header":
[
{
"name": "device_vendor",
"source": "",
"default": "Netskope"
},
{
"name": "device_product",
"source": "",
"default": "WebTX"
},
{
"name": "device_version",
"source": "",
"default": "NULL"
},
{
"name": "signature_id",
"source": "",
"default": "webtx"
},
{
"name": "name",
"source": "",
"default": "webtx"
},
{
"name": "severity",
"source": "",
"default": "Unknown"
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
ELFF Format 1 to Format 4
Those configurations provide a mapping for legacy Format 1 to Format 4 field lists in ELFF format, this reproduces previous SplunkTA event.
Sample Format 1 ELFF
{
"name": "Sample Format 1 ELFF",
"description": "From Online Help, Transaction Event Format 1 in ELFF, Splunk TA migration",
"type": "ELFF",
"definition":
{
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
Sample Format 2 ELFF
{
"name": "Sample Format 2 ELFF",
"description": "From Online Help, Transaction Event Format 2 in ELFF, Splunk TA migration",
"type": "ELFF",
"definition":
{
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
},
{
"name": "x-cs-ssl-ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "x-sr-ssl-ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "x-ssl-bypass",
"source": "x-ssl-bypass",
"default": ""
},
{
"name": "x-ssl-bypass-reason",
"source": "x-ssl-bypass-reason",
"default": ""
},
{
"name": "x-r-cert-subject-cn",
"source": "x-r-cert-subject-cn",
"default": ""
},
{
"name": "x-r-cert-issuer-cn",
"source": "x-r-cert-issuer-cn",
"default": ""
},
{
"name": "x-r-cert-startdate",
"source": "x-r-cert-startdate",
"default": ""
},
{
"name": "x-r-cert-enddate",
"source": "x-r-cert-enddate",
"default": ""
},
{
"name": "x-r-cert-valid",
"source": "x-r-cert-valid",
"default": ""
},
{
"name": "x-r-cert-expired",
"source": "x-r-cert-expired",
"default": ""
},
{
"name": "x-r-cert-untrusted-root",
"source": "x-r-cert-untrusted-root",
"default": ""
},
{
"name": "x-r-cert-incomplete-chain",
"source": "x-r-cert-incomplete-chain",
"default": ""
},
{
"name": "x-r-cert-self-signed",
"source": "x-r-cert-self-signed",
"default": ""
},
{
"name": "x-r-cert-revoked",
"source": "x-r-cert-revoked",
"default": ""
},
{
"name": "x-r-cert-revocation-check",
"source": "x-r-cert-revocation-check",
"default": ""
},
{
"name": "x-r-cert-mismatch",
"source": "x-r-cert-mismatch",
"default": ""
},
{
"name": "x-cs-ssl-fronting-error",
"source": "x-cs-ssl-fronting-error",
"default": ""
},
{
"name": "x-cs-ssl-handshake-error",
"source": "x-cs-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-handshake-error",
"source": "x-sr-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-client-certificate-error",
"source": "x-sr-ssl-client-certificate-error",
"default": ""
},
{
"name": "x-sr-ssl-malformed-ssl",
"source": "x-sr-ssl-malformed-ssl",
"default": ""
},
{
"name": "x-s-custom-signing-ca-error",
"source": "x-s-custom-signing-ca-error",
"default": ""
},
{
"name": "x-cs-ssl-engine-action",
"source": "x-cs-ssl-engine-action",
"default": ""
},
{
"name": "x-cs-ssl-engine-action-reason",
"source": "x-cs-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-sr-ssl-engine-action",
"source": "x-sr-ssl-engine-action",
"default": ""
},
{
"name": "x-sr-ssl-engine-action-reason",
"source": "x-sr-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-ssl-policy-src-ip",
"source": "x-ssl-policy-src-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-ip",
"source": "x-ssl-policy-dst-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-host",
"source": "x-ssl-policy-dst-host",
"default": ""
},
{
"name": "x-ssl-policy-dst-host-source",
"source": "x-ssl-policy-dst-host-source",
"default": ""
},
{
"name": "x-ssl-policy-categories",
"source": "x-ssl-policy-categories",
"default": ""
},
{
"name": "x-ssl-policy-action",
"source": "x-ssl-policy-action",
"default": ""
},
{
"name": "x-ssl-policy-name",
"source": "x-ssl-policy-name",
"default": ""
},
{
"name": "x-cs-ssl-version",
"source": "x-cs-ssl-version",
"default": ""
},
{
"name": "x-cs-ssl-cipher",
"source": "x-cs-ssl-cipher",
"default": ""
},
{
"name": "x-sr-ssl-version",
"source": "x-sr-ssl-version",
"default": ""
},
{
"name": "x-sr-ssl-cipher",
"source": "x-sr-ssl-cipher",
"default": ""
},
{
"name": "x-cs-src-ip-egress",
"source": "x-cs-src-ip-egress",
"default": ""
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
Sample Format 3 ELFF
{
"name": "Sample Format 3 ELFF",
"description": "From Online Help, Transaction Event Format 3 in ELFF, Splunk TA migration",
"type": "ELFF",
"definition":
{
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
},
{
"name": "x-cs-ssl-ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "x-sr-ssl-ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "x-ssl-bypass",
"source": "x-ssl-bypass",
"default": ""
},
{
"name": "x-ssl-bypass-reason",
"source": "x-ssl-bypass-reason",
"default": ""
},
{
"name": "x-r-cert-subject-cn",
"source": "x-r-cert-subject-cn",
"default": ""
},
{
"name": "x-r-cert-issuer-cn",
"source": "x-r-cert-issuer-cn",
"default": ""
},
{
"name": "x-r-cert-startdate",
"source": "x-r-cert-startdate",
"default": ""
},
{
"name": "x-r-cert-enddate",
"source": "x-r-cert-enddate",
"default": ""
},
{
"name": "x-r-cert-valid",
"source": "x-r-cert-valid",
"default": ""
},
{
"name": "x-r-cert-expired",
"source": "x-r-cert-expired",
"default": ""
},
{
"name": "x-r-cert-untrusted-root",
"source": "x-r-cert-untrusted-root",
"default": ""
},
{
"name": "x-r-cert-incomplete-chain",
"source": "x-r-cert-incomplete-chain",
"default": ""
},
{
"name": "x-r-cert-self-signed",
"source": "x-r-cert-self-signed",
"default": ""
},
{
"name": "x-r-cert-revoked",
"source": "x-r-cert-revoked",
"default": ""
},
{
"name": "x-r-cert-revocation-check",
"source": "x-r-cert-revocation-check",
"default": ""
},
{
"name": "x-r-cert-mismatch",
"source": "x-r-cert-mismatch",
"default": ""
},
{
"name": "x-cs-ssl-fronting-error",
"source": "x-cs-ssl-fronting-error",
"default": ""
},
{
"name": "x-cs-ssl-handshake-error",
"source": "x-cs-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-handshake-error",
"source": "x-sr-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-client-certificate-error",
"source": "x-sr-ssl-client-certificate-error",
"default": ""
},
{
"name": "x-sr-ssl-malformed-ssl",
"source": "x-sr-ssl-malformed-ssl",
"default": ""
},
{
"name": "x-s-custom-signing-ca-error",
"source": "x-s-custom-signing-ca-error",
"default": ""
},
{
"name": "x-cs-ssl-engine-action",
"source": "x-cs-ssl-engine-action",
"default": ""
},
{
"name": "x-cs-ssl-engine-action-reason",
"source": "x-cs-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-sr-ssl-engine-action",
"source": "x-sr-ssl-engine-action",
"default": ""
},
{
"name": "x-sr-ssl-engine-action-reason",
"source": "x-sr-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-ssl-policy-src-ip",
"source": "x-ssl-policy-src-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-ip",
"source": "x-ssl-policy-dst-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-host",
"source": "x-ssl-policy-dst-host",
"default": ""
},
{
"name": "x-ssl-policy-dst-host-source",
"source": "x-ssl-policy-dst-host-source",
"default": ""
},
{
"name": "x-ssl-policy-categories",
"source": "x-ssl-policy-categories",
"default": ""
},
{
"name": "x-ssl-policy-action",
"source": "x-ssl-policy-action",
"default": ""
},
{
"name": "x-ssl-policy-name",
"source": "x-ssl-policy-name",
"default": ""
},
{
"name": "x-cs-ssl-version",
"source": "x-cs-ssl-version",
"default": ""
},
{
"name": "x-cs-ssl-cipher",
"source": "x-cs-ssl-cipher",
"default": ""
},
{
"name": "x-sr-ssl-version",
"source": "x-sr-ssl-version",
"default": ""
},
{
"name": "x-sr-ssl-cipher",
"source": "x-sr-ssl-cipher",
"default": ""
},
{
"name": "x-cs-src-ip-egress",
"source": "x-cs-src-ip-egress",
"default": ""
},
{
"name": "x-s-dp-name",
"source": "x-s-dp-name",
"default": ""
},
{
"name": "x-cs-src-ip",
"source": "x-cs-src-ip",
"default": ""
},
{
"name": "x-cs-src-port",
"source": "x-cs-src-port",
"default": ""
},
{
"name": "x-cs-dst-ip",
"source": "x-cs-dst-ip",
"default": ""
},
{
"name": "x-cs-dst-port",
"source": "x-cs-dst-port",
"default": ""
},
{
"name": "x-sr-src-ip",
"source": "x-sr-src-ip",
"default": ""
},
{
"name": "x-sr-src-port",
"source": "x-sr-src-port",
"default": ""
},
{
"name": "x-sr-dst-ip",
"source": "x-sr-dst-ip",
"default": ""
},
{
"name": "x-sr-dst-port",
"source": "x-sr-dst-port",
"default": ""
},
{
"name": "x-cs-ip-connect-xff",
"source": "x-cs-ip-connect-xff",
"default": ""
},
{
"name": "x-cs-ip-xff",
"source": "x-cs-ip-xff",
"default": ""
},
{
"name": "x-cs-connect-host",
"source": "x-cs-connect-host",
"default": ""
},
{
"name": "x-cs-connect-port",
"source": "x-cs-connect-port",
"default": ""
},
{
"name": "x-cs-connect-user-agent",
"source": "x-cs-connect-user-agent",
"default": ""
},
{
"name": "x-cs-url",
"source": "x-cs-url",
"default": ""
},
{
"name": "x-cs-uri-path",
"source": "x-cs-uri-path",
"default": ""
},
{
"name": "x-cs-http-version",
"source": "x-cs-http-version",
"default": ""
},
{
"name": "rs-status",
"source": "rs-status",
"default": ""
},
{
"name": "x-cs-app-category",
"source": "x-cs-app-category",
"default": ""
},
{
"name": "x-cs-app-cci",
"source": "x-cs-app-cci",
"default": ""
},
{
"name": "x-cs-app-ccl",
"source": "x-cs-app-ccl",
"default": ""
},
{
"name": "x-cs-app-tags",
"source": "x-cs-app-tags",
"default": ""
},
{
"name": "x-cs-app-suite",
"source": "x-cs-app-suite",
"default": ""
},
{
"name": "x-cs-app-instance-id",
"source": "x-cs-app-instance-id",
"default": ""
},
{
"name": "x-cs-app-instance-name",
"source": "x-cs-app-instance-name",
"default": ""
},
{
"name": "x-cs-app-instance-tag",
"source": "x-cs-app-instance-tag",
"default": ""
},
{
"name": "x-cs-app-activity",
"source": "x-cs-app-activity",
"default": ""
},
{
"name": "x-cs-app-from-user",
"source": "x-cs-app-from-user",
"default": ""
},
{
"name": "x-cs-app-to-user",
"source": "x-cs-app-to-user",
"default": ""
},
{
"name": "x-cs-app-object-type",
"source": "x-cs-app-object-type",
"default": ""
},
{
"name": "x-cs-app-object-name",
"source": "x-cs-app-object-name",
"default": ""
},
{
"name": "x-cs-app-object-id",
"source": "x-cs-app-object-id",
"default": ""
},
{
"name": "x-rs-file-type",
"source": "x-rs-file-type",
"default": ""
},
{
"name": "x-rs-file-category",
"source": "x-rs-file-category",
"default": ""
},
{
"name": "x-rs-file-language",
"source": "x-rs-file-language",
"default": ""
},
{
"name": "x-rs-file-size",
"source": "x-rs-file-size",
"default": ""
},
{
"name": "x-rs-file-md5",
"source": "x-rs-file-md5",
"default": ""
},
{
"name": "x-rs-file-sha256",
"source": "x-rs-file-sha256",
"default": ""
},
{
"name": "x-error",
"source": "x-error",
"default": ""
},
{
"name": "x-c-local-time",
"source": "x-c-local-time",
"default": ""
},
{
"name": "x-policy-action",
"source": "x-policy-action",
"default": ""
},
{
"name": "x-policy-name",
"source": "x-policy-name",
"default": ""
},
{
"name": "x-policy-src-ip",
"source": "x-policy-src-ip",
"default": ""
},
{
"name": "x-policy-dst-ip",
"source": "x-policy-dst-ip",
"default": ""
},
{
"name": "x-policy-dst-host",
"source": "x-policy-dst-host",
"default": ""
},
{
"name": "x-policy-dst-host-source",
"source": "x-policy-dst-host-source",
"default": ""
},
{
"name": "x-policy-justification-type",
"source": "x-policy-justification-type",
"default": ""
},
{
"name": "x-policy-justification-reason",
"source": "x-policy-justification-reason",
"default": ""
},
{
"name": "x-sc-notification-name",
"source": "x-sc-notification-name",
"default": ""
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}
Sample Format 4 ELFF
{
"name": "Sample Format 4 ELFF",
"description": "From Online Help, Transaction Event Format 4 in ELFF, Splunk TA migration",
"type": "ELFF",
"definition":
{
"customize": true,
"custom_fields":
[
{
"name": "date",
"source": "date",
"default": ""
},
{
"name": "time",
"source": "time",
"default": ""
},
{
"name": "time-taken",
"source": "time-taken",
"default": ""
},
{
"name": "cs-bytes",
"source": "cs-bytes",
"default": ""
},
{
"name": "sc-bytes",
"source": "sc-bytes",
"default": ""
},
{
"name": "bytes",
"source": "bytes",
"default": ""
},
{
"name": "c-ip",
"source": "c-ip",
"default": ""
},
{
"name": "s-ip",
"source": "s-ip",
"default": ""
},
{
"name": "cs-username",
"source": "cs-username",
"default": ""
},
{
"name": "cs-method",
"source": "cs-method",
"default": ""
},
{
"name": "cs-uri-scheme",
"source": "cs-uri-scheme",
"default": ""
},
{
"name": "cs-uri-query",
"source": "cs-uri-query",
"default": ""
},
{
"name": "cs-user-agent",
"source": "cs-user-agent",
"default": ""
},
{
"name": "cs-content-type",
"source": "cs-content-type",
"default": ""
},
{
"name": "sc-status",
"source": "sc-status",
"default": ""
},
{
"name": "sc-content-type",
"source": "sc-content-type",
"default": ""
},
{
"name": "cs-dns",
"source": "cs-dns",
"default": ""
},
{
"name": "cs-host",
"source": "cs-host",
"default": ""
},
{
"name": "cs-uri",
"source": "cs-uri",
"default": ""
},
{
"name": "cs-uri-port",
"source": "cs-uri-port",
"default": ""
},
{
"name": "cs-referer",
"source": "cs-referer",
"default": ""
},
{
"name": "x-cs-session-id",
"source": "x-cs-session-id",
"default": ""
},
{
"name": "x-cs-access-method",
"source": "x-cs-access-method",
"default": ""
},
{
"name": "x-cs-app",
"source": "x-cs-app",
"default": ""
},
{
"name": "x-s-country",
"source": "x-s-country",
"default": ""
},
{
"name": "x-s-latitude",
"source": "x-s-latitude",
"default": ""
},
{
"name": "x-s-longitude",
"source": "x-s-longitude",
"default": ""
},
{
"name": "x-s-location",
"source": "x-s-location",
"default": ""
},
{
"name": "x-s-region",
"source": "x-s-region",
"default": ""
},
{
"name": "x-s-zipcode",
"source": "x-s-zipcode",
"default": ""
},
{
"name": "x-c-country",
"source": "x-c-country",
"default": ""
},
{
"name": "x-c-latitude",
"source": "x-c-latitude",
"default": ""
},
{
"name": "x-c-longitude",
"source": "x-c-longitude",
"default": ""
},
{
"name": "x-c-location",
"source": "x-c-location",
"default": ""
},
{
"name": "x-c-region",
"source": "x-c-region",
"default": ""
},
{
"name": "x-c-zipcode",
"source": "x-c-zipcode",
"default": ""
},
{
"name": "x-c-os",
"source": "x-c-os",
"default": ""
},
{
"name": "x-c-browser",
"source": "x-c-browser",
"default": ""
},
{
"name": "x-c-browser-version",
"source": "x-c-browser-version",
"default": ""
},
{
"name": "x-c-device",
"source": "x-c-device",
"default": ""
},
{
"name": "x-cs-site",
"source": "x-cs-site",
"default": ""
},
{
"name": "x-cs-timestamp",
"source": "x-cs-timestamp",
"default": ""
},
{
"name": "x-cs-page-id",
"source": "x-cs-page-id",
"default": ""
},
{
"name": "x-cs-userip",
"source": "x-cs-userip",
"default": ""
},
{
"name": "x-cs-traffic-type",
"source": "x-cs-traffic-type",
"default": ""
},
{
"name": "x-cs-tunnel-id",
"source": "x-cs-tunnel-id",
"default": ""
},
{
"name": "x-category",
"source": "x-category",
"default": ""
},
{
"name": "x-other-category",
"source": "x-other-category",
"default": ""
},
{
"name": "x-type",
"source": "x-type",
"default": ""
},
{
"name": "x-server-ssl-err",
"source": "x-server-ssl-err",
"default": ""
},
{
"name": "x-client-ssl-err",
"source": "x-client-ssl-err",
"default": ""
},
{
"name": "x-transaction-id",
"source": "x-transaction-id",
"default": ""
},
{
"name": "x-request-id",
"source": "x-request-id",
"default": ""
},
{
"name": "x-cs-sni",
"source": "x-cs-sni",
"default": ""
},
{
"name": "x-cs-domain-fronted-sni",
"source": "x-cs-domain-fronted-sni",
"default": ""
},
{
"name": "x-category-id",
"source": "x-category-id",
"default": ""
},
{
"name": "x-other-category-id",
"source": "x-other-category-id",
"default": ""
},
{
"name": "x-sr-headers-name",
"source": "x-sr-headers-name",
"default": ""
},
{
"name": "x-sr-headers-value",
"source": "x-sr-headers-value",
"default": ""
},
{
"name": "x-cs-ssl-ja3",
"source": "x-cs-ssl-ja3",
"default": ""
},
{
"name": "x-sr-ssl-ja3s",
"source": "x-sr-ssl-ja3s",
"default": ""
},
{
"name": "x-ssl-bypass",
"source": "x-ssl-bypass",
"default": ""
},
{
"name": "x-ssl-bypass-reason",
"source": "x-ssl-bypass-reason",
"default": ""
},
{
"name": "x-r-cert-subject-cn",
"source": "x-r-cert-subject-cn",
"default": ""
},
{
"name": "x-r-cert-issuer-cn",
"source": "x-r-cert-issuer-cn",
"default": ""
},
{
"name": "x-r-cert-startdate",
"source": "x-r-cert-startdate",
"default": ""
},
{
"name": "x-r-cert-enddate",
"source": "x-r-cert-enddate",
"default": ""
},
{
"name": "x-r-cert-valid",
"source": "x-r-cert-valid",
"default": ""
},
{
"name": "x-r-cert-expired",
"source": "x-r-cert-expired",
"default": ""
},
{
"name": "x-r-cert-untrusted-root",
"source": "x-r-cert-untrusted-root",
"default": ""
},
{
"name": "x-r-cert-incomplete-chain",
"source": "x-r-cert-incomplete-chain",
"default": ""
},
{
"name": "x-r-cert-self-signed",
"source": "x-r-cert-self-signed",
"default": ""
},
{
"name": "x-r-cert-revoked",
"source": "x-r-cert-revoked",
"default": ""
},
{
"name": "x-r-cert-revocation-check",
"source": "x-r-cert-revocation-check",
"default": ""
},
{
"name": "x-r-cert-mismatch",
"source": "x-r-cert-mismatch",
"default": ""
},
{
"name": "x-cs-ssl-fronting-error",
"source": "x-cs-ssl-fronting-error",
"default": ""
},
{
"name": "x-cs-ssl-handshake-error",
"source": "x-cs-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-handshake-error",
"source": "x-sr-ssl-handshake-error",
"default": ""
},
{
"name": "x-sr-ssl-client-certificate-error",
"source": "x-sr-ssl-client-certificate-error",
"default": ""
},
{
"name": "x-sr-ssl-malformed-ssl",
"source": "x-sr-ssl-malformed-ssl",
"default": ""
},
{
"name": "x-s-custom-signing-ca-error",
"source": "x-s-custom-signing-ca-error",
"default": ""
},
{
"name": "x-cs-ssl-engine-action",
"source": "x-cs-ssl-engine-action",
"default": ""
},
{
"name": "x-cs-ssl-engine-action-reason",
"source": "x-cs-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-sr-ssl-engine-action",
"source": "x-sr-ssl-engine-action",
"default": ""
},
{
"name": "x-sr-ssl-engine-action-reason",
"source": "x-sr-ssl-engine-action-reason",
"default": ""
},
{
"name": "x-ssl-policy-src-ip",
"source": "x-ssl-policy-src-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-ip",
"source": "x-ssl-policy-dst-ip",
"default": ""
},
{
"name": "x-ssl-policy-dst-host",
"source": "x-ssl-policy-dst-host",
"default": ""
},
{
"name": "x-ssl-policy-dst-host-source",
"source": "x-ssl-policy-dst-host-source",
"default": ""
},
{
"name": "x-ssl-policy-categories",
"source": "x-ssl-policy-categories",
"default": ""
},
{
"name": "x-ssl-policy-action",
"source": "x-ssl-policy-action",
"default": ""
},
{
"name": "x-ssl-policy-name",
"source": "x-ssl-policy-name",
"default": ""
},
{
"name": "x-cs-ssl-version",
"source": "x-cs-ssl-version",
"default": ""
},
{
"name": "x-cs-ssl-cipher",
"source": "x-cs-ssl-cipher",
"default": ""
},
{
"name": "x-sr-ssl-version",
"source": "x-sr-ssl-version",
"default": ""
},
{
"name": "x-sr-ssl-cipher",
"source": "x-sr-ssl-cipher",
"default": ""
},
{
"name": "x-cs-src-ip-egress",
"source": "x-cs-src-ip-egress",
"default": ""
},
{
"name": "x-s-dp-name",
"source": "x-s-dp-name",
"default": ""
},
{
"name": "x-cs-src-ip",
"source": "x-cs-src-ip",
"default": ""
},
{
"name": "x-cs-src-port",
"source": "x-cs-src-port",
"default": ""
},
{
"name": "x-cs-dst-ip",
"source": "x-cs-dst-ip",
"default": ""
},
{
"name": "x-cs-dst-port",
"source": "x-cs-dst-port",
"default": ""
},
{
"name": "x-sr-src-ip",
"source": "x-sr-src-ip",
"default": ""
},
{
"name": "x-sr-src-port",
"source": "x-sr-src-port",
"default": ""
},
{
"name": "x-sr-dst-ip",
"source": "x-sr-dst-ip",
"default": ""
},
{
"name": "x-sr-dst-port",
"source": "x-sr-dst-port",
"default": ""
},
{
"name": "x-cs-ip-connect-xff",
"source": "x-cs-ip-connect-xff",
"default": ""
},
{
"name": "x-cs-ip-xff",
"source": "x-cs-ip-xff",
"default": ""
},
{
"name": "x-cs-connect-host",
"source": "x-cs-connect-host",
"default": ""
},
{
"name": "x-cs-connect-port",
"source": "x-cs-connect-port",
"default": ""
},
{
"name": "x-cs-connect-user-agent",
"source": "x-cs-connect-user-agent",
"default": ""
},
{
"name": "x-cs-url",
"source": "x-cs-url",
"default": ""
},
{
"name": "x-cs-uri-path",
"source": "x-cs-uri-path",
"default": ""
},
{
"name": "x-cs-http-version",
"source": "x-cs-http-version",
"default": ""
},
{
"name": "rs-status",
"source": "rs-status",
"default": ""
},
{
"name": "x-cs-app-category",
"source": "x-cs-app-category",
"default": ""
},
{
"name": "x-cs-app-cci",
"source": "x-cs-app-cci",
"default": ""
},
{
"name": "x-cs-app-ccl",
"source": "x-cs-app-ccl",
"default": ""
},
{
"name": "x-cs-app-tags",
"source": "x-cs-app-tags",
"default": ""
},
{
"name": "x-cs-app-suite",
"source": "x-cs-app-suite",
"default": ""
},
{
"name": "x-cs-app-instance-id",
"source": "x-cs-app-instance-id",
"default": ""
},
{
"name": "x-cs-app-instance-name",
"source": "x-cs-app-instance-name",
"default": ""
},
{
"name": "x-cs-app-instance-tag",
"source": "x-cs-app-instance-tag",
"default": ""
},
{
"name": "x-cs-app-activity",
"source": "x-cs-app-activity",
"default": ""
},
{
"name": "x-cs-app-from-user",
"source": "x-cs-app-from-user",
"default": ""
},
{
"name": "x-cs-app-to-user",
"source": "x-cs-app-to-user",
"default": ""
},
{
"name": "x-cs-app-object-type",
"source": "x-cs-app-object-type",
"default": ""
},
{
"name": "x-cs-app-object-name",
"source": "x-cs-app-object-name",
"default": ""
},
{
"name": "x-cs-app-object-id",
"source": "x-cs-app-object-id",
"default": ""
},
{
"name": "x-rs-file-type",
"source": "x-rs-file-type",
"default": ""
},
{
"name": "x-rs-file-category",
"source": "x-rs-file-category",
"default": ""
},
{
"name": "x-rs-file-language",
"source": "x-rs-file-language",
"default": ""
},
{
"name": "x-rs-file-size",
"source": "x-rs-file-size",
"default": ""
},
{
"name": "x-rs-file-md5",
"source": "x-rs-file-md5",
"default": ""
},
{
"name": "x-rs-file-sha256",
"source": "x-rs-file-sha256",
"default": ""
},
{
"name": "x-error",
"source": "x-error",
"default": ""
},
{
"name": "x-c-local-time",
"source": "x-c-local-time",
"default": ""
},
{
"name": "x-policy-action",
"source": "x-policy-action",
"default": ""
},
{
"name": "x-policy-name",
"source": "x-policy-name",
"default": ""
},
{
"name": "x-policy-src-ip",
"source": "x-policy-src-ip",
"default": ""
},
{
"name": "x-policy-dst-ip",
"source": "x-policy-dst-ip",
"default": ""
},
{
"name": "x-policy-dst-host",
"source": "x-policy-dst-host",
"default": ""
},
{
"name": "x-policy-dst-host-source",
"source": "x-policy-dst-host-source",
"default": ""
},
{
"name": "x-policy-justification-type",
"source": "x-policy-justification-type",
"default": ""
},
{
"name": "x-policy-justification-reason",
"source": "x-policy-justification-reason",
"default": ""
},
{
"name": "x-sc-notification-name",
"source": "x-sc-notification-name",
"default": ""
},
{
"name": "sr-bytes",
"source": "sr-bytes",
"default": ""
},
{
"name": "rs-bytes",
"source": "rs-bytes",
"default": ""
},
{
"name": "x-action",
"source": "x-action",
"default": ""
},
{
"name": "x-action-reason",
"source": "x-action-reason",
"default": ""
},
{
"name": "x-c-authn-user",
"source": "x-c-authn-user",
"default": ""
},
{
"name": "x-c-authn-source",
"source": "x-c-authn-source",
"default": ""
},
{
"name": "x-c-authn-surrogate",
"source": "x-c-authn-surrogate",
"default": ""
},
{
"name": "x-c-authn-surrogate-status",
"source": "x-c-authn-surrogate-status",
"default": ""
},
{
"name": "x-c-authz-groups",
"source": "x-c-authz-groups",
"default": ""
},
{
"name": "x-c-authz-ou",
"source": "x-c-authz-ou",
"default": ""
},
{
"name": "x-cs-xau",
"source": "x-cs-xau",
"default": ""
},
{
"name": "x-cs-connect-xau",
"source": "x-cs-connect-xau",
"default": ""
},
{
"name": "x-c-user-confidence-index",
"source": "x-c-user-confidence-index",
"default": ""
},
{
"name": "x-c-hostname",
"source": "x-c-hostname",
"default": ""
},
{
"name": "x-c-device-uid",
"source": "x-c-device-uid",
"default": ""
},
{
"name": "x-c-os-family",
"source": "x-c-os-family",
"default": ""
},
{
"name": "x-c-os-version",
"source": "x-c-os-version",
"default": ""
},
{
"name": "x-c-nsclient-version",
"source": "x-c-nsclient-version",
"default": ""
},
{
"name": "x-c-nsclient-client-profile",
"source": "x-c-nsclient-client-profile",
"default": ""
},
{
"name": "x-c-nsclient-steering-profile",
"source": "x-c-nsclient-steering-profile",
"default": ""
},
{
"name": "x-c-device-classification",
"source": "x-c-device-classification",
"default": ""
},
{
"name": "x-cs-nsclient-tunnel-type",
"source": "x-cs-nsclient-tunnel-type",
"default": ""
},
{
"name": "x-cs-process",
"source": "x-cs-process",
"default": ""
},
{
"name": "x-cs-pid",
"source": "x-cs-pid",
"default": ""
},
{
"name": "x-cs-parent-process",
"source": "x-cs-parent-process",
"default": ""
},
{
"name": "x-cs-ppid",
"source": "x-cs-ppid",
"default": ""
},
{
"name": "x-tp-result",
"source": "x-tp-result",
"default": ""
},
{
"name": "x-tp-engine",
"source": "x-tp-engine",
"default": ""
},
{
"name": "x-tp-malware-name",
"source": "x-tp-malware-name",
"default": ""
},
{
"name": "x-tp-severity",
"source": "x-tp-severity",
"default": ""
},
{
"name": "x-sr-forward-dest",
"source": "x-sr-forward-dest",
"default": ""
},
{
"name": "x-ssl-policy-issuer",
"source": "x-ssl-policy-issuer",
"default": ""
},
{
"name": "x-eip-policy-name",
"source": "x-eip-policy-name",
"default": ""
},
{
"name": "x-eip-policy-footprint",
"source": "x-eip-policy-footprint",
"default": ""
},
{
"name": "x-policy-categories",
"source": "x-policy-categories",
"default": ""
},
{
"name": "x-c-timezone",
"source": "x-c-timezone",
"default": ""
},
{
"name": "x-support",
"source": "x-support",
"default": ""
}
],
"syslog_header": "<%priority%>%timestamp% netskope"
}
}