Common Event Format Certification Guide - Imperva

Event Interoperability StandardEventsCEF fields are added in the message field of System Log properties. Thesefields are used to create a syslog message that can be read by ArcSoft. Thereare two categories of CEF fields that can be used in syslog messages: Standard Fields Extended FieldsStandard Event FieldsThe following are the supported CEF standard event fields and the corresponding values to configure inSecureSphere:CEF Field NameVersionCEF DefinitionVersion is an integer that identifies the version of the CEF format. Eventconsumers use this information to determine the following fields. Currentlyonly version 0 (zero) is established in the CEF format. The other fields mightneed to be added to the “prefix” and therefore require a version numberchange. Adding new formats is handled through the standards body.Configuration inSecureSphere0SecureSphere DefinitionN/RCEF Field NameDeviceVendorCEF DefinitionDevice Vendor, Device Product, and Device Version are strings that uniquelyidentify the type of device that sends events. Two products cannot use thesame device-vendor and device product pair. There is no central authoritymanaging these pairs. Event producers have to ensure that they assign aunique name to each pair.Configuration inSecureSphereImperva Inc.SecureSphere DefinitionCompany NameArcSight Technical Note – Contains Confidential and Proprietary Information11

Event Interoperability StandardCEF Field NameDeviceProductCEF DefinitionDevice Vendor, Device Product, and Device Version are strings that uniquelyidentify the type of device that sends events. Two products cannot use thesame device-vendor and device product pair. There is no central authoritymanaging these pairs. Event producers have to ensure that they assign aunique name to each pair.Configuration inSecureSphereSecureSphereSecureSphere DefinitionProduct NameCEF Field NameDeviceVersionCEF DefinitionDevice Vendor, Device Product and Device Version are strings that identifythe type of device that sends events. Two products cannot use the samedevice-vendor and device product pair. There is no central authoritymanaging these pairs. Event producers have to ensure that they assign aunique name to each pair.Configuration inSecureSphereVersions 6.2 through 8.5SecureSphere DefinitionProduct VersionCEF Field NamedeviceEventClassIdCEF DefinitionDeviceEventClassId is a unique identifier for each event type. This can be astring or an integer. DeviceEventClassId represents the type of eventreported. In the intrusion detection system (IDS) world, each signature orrule that detects certain activity has a unique deviceEventClassId assigned.This is a requirement for other types of devices as well, and helpscorrelation engines deal with the events.Configuration inSecureSphere {Alert.alertType} for security alerts other than custom policy alerts {Rule.parent.displayName} for custom policy security alerts {Event.eventType} for system eventsSecureSphere Definition {Alert.alertType} is the alert type (firewall, signature, protocol, profile, orcorrelation) {Rule.parent.displayName} is the name of the custom policy {Event.eventType} is the type of system eventArcSight Technical Note – Contains Confidential and Proprietary Information12

Event Interoperability StandardCEF Field NameNameCEF DefinitionName is a string that represents a human-readable and understandabledescription of the event. The event name must not contain information thatis specifically mentioned in other fields. For example, “Port scan from10.0.0.1 targeting 20.1.1.1” is not a good event name. The name should be:“Port scan”. The rest of information is redundant and can be picked up fromthe other fields.Configuration inSecureSphere {Alert.alertMetadata.alertName} for security alerts other than custompolicy alerts {Rule.parent.displayName} for custom policy security alerts {Event.message} for system eventsSecureSphere Definition {Alert.alertMetadata.alertName} is the alert name {Event.message} is the message of the event {Rule.parent.displayName} is the name of the custom policyCEF Field NameSeverityCEF Definition as appearsin CEF documentationSeverity reflects the importance of the event.Configuration inSecureSphere {Alert. severity} for alerts {Event.severity.displayName} for system eventsSecureSphere Definition {Alert.severity} is the severity of the alert in text format: Low, Medium,High. {Event.severity.displayName} is the severity of the event in text format:Low, Medium, High. Severity should not be set to Informative when CEF isused. Use Low instead.ArcSight Technical Note – Contains Confidential and Proprietary Information13

Event Interoperability StandardCEF Field NameExtensionCEF Definition as appearsin CEF documentationExtension is a collection of key-value pairs. Each key is a part of apredefined set. The standard allows including additional keys as outlinedlater. An event can contain any number of key-value pairs in any orderseparated by spaces (“ “). A field can include spaces, i.e. in case of filename.Configuration inSecureSphereSecurity Event (Alert):act {Alert.immediateAction} dst {Event.destInfo.serverIp}dpt {Event.destInfo.serverPort} duser {Alert.username}src {Event.sourceInfo.sourceIp} spt {Event.sourceInfo.sourcePort}proto {Event.sourceInfo.ipProtocol} rt #arcsightDate( {Alert.createTime}) cat Alert cs1 {Rule.parent.displayName}cs1Label Policy cs2 {Alert.serverGroupName}cs2Label ServerGroup cs3 {Alert.serviceName} cs3Label ServiceNamecs4 {Alert.applicationName} cs4Label ApplicationNamecs5 {Alert.description} cs5Label DescriptionFirewall Event (Alert):act {Alert.immediateAction} dst {Event.destInfo.serverIp}dpt {Event.destInfo.serverPort} duser {Alert.username}src {Event.sourceInfo.sourceIp} spt {Event.sourceInfo.sourcePort}proto {Event.sourceInfo.ipProtocol} rt #arcsightDate( {Alert.createTime}) cat Alert cs1 {Rule.parent.displayName}cs1Label Policy cs2 {Alert.serverGroupName} cs2Label ServerGroupcs3 {Alert.description} cs3Label DescriptionSystem Event:User: {Event.username} Creation Time: #arcsightDate( {Event.createTime}) cat SystemEventSecureSphere DefinitionThe definition of each placeholder is listed under the Extension FieldDictionary.Extended Event FieldsThe extension field provides the ability to use the CEF key-value pairs for additional informationon the event. The following table details a CEF key and its corresponding SecureSphereplaceholder:CEF KeydeviceFacilityCEF DefinitionThe facility generating the event.SecureSphere PlaceholderN/RSecureSphere DefinitionChoose the desired facility.SecureSphere Event TypeAll eventsArcSight Technical Note – Contains Confidential and Proprietary Information14

Event Interoperability StandardCEF KeyactCEF DefinitionAction mentioned in the event.SecureSphere Placeholder {Alert.immediateAction}SecureSphere DefinitionThe immediate action performed, either block transaction (event) or noaction.SecureSphere Event TypeSecurity event.CEF KeydstCEF DefinitionIdentifies destination an event refers to in an IP network in IPv4 format. Forexample: “192.168.10.1”.SecureSphere Placeholder {Event.destInfo.serverIp}SecureSphere DefinitionThe destination IP address.SecureSphere Event TypeSecurity events.CEF KeydptCEF DefinitionThe valid port numbers are between 0 and 65535.SecureSphere Placeholder {Event.destInfo.serverPort}SecureSphere DefinitionThe destination port.SecureSphere Event TypeSecurity events.CEF KeyduserCEF DefinitionIdentifies the destination user by name. This parameter represents the userassociated with event's destination.SecureSphere Placeholder {Alert.username}SecureSphere DefinitionThe destination user. In web applications it refers to the application userlogged into the application. In database applications it refers to thedatabase user.SecureSphere Event TypeSecurity events.CEF KeysrcCEF DefinitionIdentifies source an event refers to in an IP network in IPv4 format. Forexample: “192.168.10.1”.SecureSphere Placeholder {Event.sourceInfo.sourceIp}SecureSphere DefinitionThe source IP address.SecureSphere Event TypeSecurity events.ArcSight Technical Note – Contains Confidential and Proprietary Information15

Event Interoperability StandardCEF KeysptCEF DefinitionThe valid port numbers are between 0 and 65535.SecureSphere Placeholder {Event.sourceInfo.sourcePort}SecureSphere DefinitionThe source port.SecureSphere Event TypeSecurity events.CEF KeyProtoCEF DefinitionIdentifies the Layer-4 protocol used. The possible values are protocolnames, i.e. TCP or UDP.SecureSphere Placeholder {Event.sourceInfo.ipProtocol}SecureSphere DefinitionThe protocol used.SecureSphere Event TypeSecurity events.CEF KeyRtCEF DefinitionThe time when the activity of the event referred to started. The format isMMM dd yyyy HH:mm:ss.SecureSphere Placeholder dateTool.format(‘date.arcsight’, {Alert.createTime})SecureSphere DefinitionThe alert time.SecureSphere Event TypeSecurity events.CEF KeyCatCEF DefinitionRepresents the category assigned to the originating device. Usually devicesuse their own categorization schema to classify events.SecureSphere PlaceholderAlertSecureSphere DefinitionThe type of the event.SecureSphere Event TypeSecurity events.CEF Keycs1CEF DefinitionCustom field is used to map fields that do not fit into any other fieldavailable in the CEF dictionary.SecureSphere Placeholder {Rule.parent.displayName}SecureSphere DefinitionThe violated policy’s name.SecureSphere Event TypeSecurity events.ArcSight Technical Note – Contains Confidential and Proprietary Information16

Event Interoperability StandardCEF Keycs2CEF DefinitionCustom field is used to map fields that do not fit into any other fieldavailable in the CEF dictionary.SecureSphere Placeholder {Alert.serverGroupName}SecureSphere DefinitionThe server group name.SecureSphere Event TypeSecurity events.CEF Keycs3CEF DefinitionCustom field is used to map fields that do not fit into any other fieldavailable in the CEF dictionary.SecureSphere PlaceholderFor Firewall events: {Alert.description}For other security events: {Alert.serviceName}SecureSphere Definition {Alert.description} is the alert description {Alert.applicationName} is the service name.SecureSphere Event TypeSecurity events.CEF Keycs4CEF DefinitionCustom field is used to map fields that do not fit into any other fieldavailable in the CEF dictionary.SecureSphere PlaceholderFor non firewall security events: {Alert.applicationName}SecureSphere Definition {Alert.applicationName} is the application name.SecureSphere Event TypeSecurity events.CEF Keycs5CEF DefinitionCustom field is used to map fields that do not fit into any other fieldavailable in the CEF dictionary.SecureSphere PlaceholderFor non firewall security events: {Alert.description}SecureSphere Definition {Alert.description} is the alert descriptionSecureSphere Event TypeSecurity events.ArcSight Technical Note – Contains Confidential and Proprietary Information17

Event Interoperability StandardCEF Keycs1LabelCEF DefinitionAll custom fields have a corresponding label field for the description of thefield.SecureSphere PlaceholderPolicy.SecureSphere DefinitionPolicy label.SecureSphere Event TypeSecurity events.CEF Keycs2LabelCEF DefinitionAll custom fields have a corresponding label field for the description of thefield.SecureSphere PlaceholderServerGroup.SecureSphere DefinitionServerGroup Label.SecureSphere Event TypeSecurity events.CEF Keycs3LabelCEF DefinitionAll custom fields have a corresponding label field for the description of thefield.SecureSphere PlaceholderFor non Firewall alertsService.For Firewall Alerts:DescriptionSecureSphere DefinitionApplication is Service Label.Description is Description LabelSecureSphere Event TypeSecurity events.CEF Keycs4LabelCEF DefinitionAll custom fields have a corresponding label field for the description of thefield.SecureSphere PlaceholderFor non Firewall alertsApplication.SecureSphere DefinitionApplication is Service Label.SecureSphere Event TypeSecurity events.ArcSight Technical Note – Contains Confidential and Proprietary Information18

Event Interoperability StandardCEF Keycs5LabelCEF DefinitionAll custom fields have a corresponding label field for the description of thefield.SecureSphere PlaceholderFor non Firewall alertsDescriptionSecureSphere DefinitionDescription is Description LabelSecureSphere Event TypeSecurity events.CEF KeySuserCEF DefinitionIdentifies the source user by name. This field represents the user associatedwith the event's source.SecureSphere Placeholder {Event.username}SecureSphere DefinitionThe system user who caused the event. It can be specific user who loggedinto the system or a system user.SecureSphere Event TypeSystem events.CEF KeycatCEF DefinitionRepresents the category assigned to the originating device. Usually devicesuse their own categorization schema to classify events.SecureSphere PlaceholderSystem Event.SecureSphere DefinitionThe type of the event.SecureSphere Event TypeSystem events.CEF KeyrtCEF DefinitionThe time when the activity the event referred to started. The format is MMMdd yyyy HH:mm:ss.SecureSphere Placeholder dateTool.formatToArcsight( {Event.createTime})SecureSphere DefinitionThe system event time.SecureSphere Event TypeSystem events.Device Event Mapping to ArcSight Data FieldsInformation contained within vendor-specific event definitions is sent to theArcSight SmartConnector, then mapped to an ArcSight data field.The following table lists the mappings from ArcSight data fields to thesupported vendor-specific event definitions.Imperva SecureSphere Connector Field MappingsArcSight Technical Note – Contains Confidential and Proprietary Information19

Event Interoperability StandardVendor-Specific Event DefinitionArcSight Event Data FieldArcSight Technical Note – Contains Confidential and Proprietary Information20

Event Interoperability StandardVendor-Specific Event DefinitionArcSight Event Data FieldArcSight Technical Note – Contains Confidential and Proprietary Information21

The ArcSight Common Event Format (CEF) defines a syslog based event format to be used by other vendors. The CEF standard addresses the need to define core fields for event correlation for all vendors integrating with ArcSight. SecureSphere versions 6.2 through 8.5 have the ability to integrate with ArcSight using the CEF standard.