---
title: "cef0.infoblox"
canonical: "https://docs.devo.com/space/latest/397475847/cef0.infoblox"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `cef0.infoblox` identify events in CEF format generated by [Infoblox](https://www.infoblox.com/).

## Tag structure

Events in CEF format don't have a specific tag structure, as explained in [Technologies supported in CEF syslog format](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94666383). They are always sent to a table with the structure **cef0.***deviceVendor*.*deviceProduct*.

In this case, the valid data tables are:

| **Tags** | **Data tables** |
| --- | --- |
| `cef0.infoblox.dataConnector` | `cef0.infoblox.dataConnector` |
| `cef0.infoblox.nios` | `cef0.infoblox.nios` |
| `cef0.infoblox.niosThreat` | `cef0.infoblox.niosThreat` |

## How is the data sent to Devo?

CEF data can be sent directly to Devo or by using a relay. To use the [CEF default relay rule](https://docs.devo.com/space/latest/96469422/The+4+predefined+relay+rules), send to the relay’s port **13000**. Learn more about CEF syslog format and how Devo tags these events in [Technologies supported in CEF syslog format](https://docs.devo.com/space/latest/94666383/Technologies+supported+in+CEF+syslog+format).

## Table structure

These are the fields displayed in this table:

- [cef0.infoblox.dataConnector](#tag1)
- [cef0.infoblox.nios](#tag2)
- [cef0.infoblox.niosThreat](#tag3)

### > Macro (anchor)

cef0.infoblox.dataConnector

| **Field** | **Type** | **Field Transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |  |
| *hostname* | `str` |  |  |  |
| *priorityCode* | `str` |  |  |  |
| *cefTag* | `str` |  |  |  |
| *cefVersion* | `str` |  |  |  |
| *embDeviceVendor* | `str` |  |  |  |
| *embDeviceProduct* | `str` |  |  |  |
| *deviceVersion* | `str` |  |  |  |
| *signatureID* | `str` |  |  |  |
| *name* | `str` |  |  |  |
| *severity* | `str` |  |  |  |
| *_cefVer* | `str` |  |  |  |
| *app* | `str` |  |  |  |
| *destinationDnsDomain* | `str` |  |  |  |
| *dst* | `ip4` |  |  |  |
| *proto* | `str` |  |  |  |
| *src* | `ip4` |  |  |  |
| *spt* | `int4` |  |  |  |
| *InfobloxAnCount* | `str` |  |  |  |
| *InfobloxArCount* | `str` |  |  |  |
| *InfobloxDNSQClass* | `str` |  |  |  |
| *InfobloxDNSQFlags* | `str` |  |  |  |
| *InfobloxDNSQType* | `str` |  |  |  |
| *InfobloxDNSRCode* | `str` |  |  |  |
| *InfobloxDNSView* | `str` |  |  |  |
| *InfobloxNsCount* | `str` |  |  |  |
| *msg* | `str` |  |  |  |
| *msg_host* | `[str]` |  |  |  |
| *msg_record_type* | `[str]` |  |  |  |
| *msg_resolved_ip* | `[str]` |  |  |  |
| *msg_resolved_hostname* | `[str]` |  |  |  |
| *msg_other_message* | `[str]` |  |  |  |
| *msg_host_str* | `str` | ```
join(msg_host, ", ")
``` | *msg_host* |  |
| *msg_record_type_str* | `str` | ```
join(msg_record_type, ", ")
``` | *msg_record_type* |  |
| *msg_resolved_hostname_str* | `str` | ```
join(msg_resolved_hostname, ", ")
``` | *msg_resolved_hostname* |  |
| *msg_resolved_ip_str* | `str` | ```
join(msg_resolved_ip, ", ")
``` | *msg_resolved_ip* |  |
| *msg_other_message_str* | `str` | ```
join(msg_other_message, ", ")
``` | *msg_other_message* |  |
| *hostchain* | `str` |  | * * | **✓** |
| *tag* | `str` |  | *cefTag* | **✓** |
| *rawMessage* | `str` |  |  | **✓** |

### > Macro (anchor)

cef0.infoblox.nios

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *priorityCode* | `str` |  |  |
| *cefTag* | `str` |  |  |
| *cefVersion* | `str` |  |  |
| *embDeviceVendor* | `str` |  |  |
| *embDeviceProduct* | `str` |  |  |
| *deviceVersion* | `str` |  |  |
| *signatureID* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *_cefVer* | `str` |  |  |
| *cat* | `str` |  |  |
| *cs4Label* | `str` |  |  |
| *cs4* | `str` |  |  |
| *cs5Label* | `str` |  |  |
| *cs5* | `str` |  |  |
| *dhost* | `str` |  |  |
| *dmac* | `str` |  |  |
| *dst* | `ip4` |  |  |
| *dvchost* | `str` |  |  |
| *dvc* | `ip4` |  |  |
| *deviceFacility* | `str` |  |  |
| *msg* | `str` |  |  |
| *rt* | `timestamp` |  |  |
| *src* | `ip4` |  |  |
| *agt* | `ip4` |  |  |
| *ahost* | `str` |  |  |
| *aid* | `str` |  |  |
| *arcSightEventPath* | `str` |  |  |
| *art* | `str` |  |  |
| *assetCriticality* | `int4` |  |  |
| *at* | `str` |  |  |
| *atz* | `str` |  |  |
| *av* | `str` |  |  |
| *catdt* | `str` |  |  |
| *customerID* | `str` |  |  |
| *customerURI* | `str` |  |  |
| *destinationZoneExternalID* | `str` |  |  |
| *destinationZoneID* | `str` |  |  |
| *destinationZoneURI* | `str` |  |  |
| *deviceAssetId* | `str` |  |  |
| *deviceSeverity* | `str` |  |  |
| *deviceZoneID* | `str` |  |  |
| *deviceZoneURI* | `str` |  |  |
| *dtz* | `str` |  |  |
| *eventAnnotationAuditTrail* | `str` |  |  |
| *eventAnnotationEndTime* | `timestamp` |  |  |
| *eventAnnotationEventId* | `str` |  |  |
| *eventAnnotationFlags* | `str` |  |  |
| *eventAnnotationManagerReceiptTime* | `timestamp` |  |  |
| *eventAnnotationModificationTime* | `timestamp` |  |  |
| *eventAnnotationStageID* | `str` |  |  |
| *eventAnnotationStageUpdateTime* | `timestamp` |  |  |
| *eventAnnotationStageURI* | `str` |  |  |
| *eventAnnotationVersion* | `int4` |  |  |
| *eventId* | `str` |  |  |
| *locality* | `int4` |  |  |
| *modelConfidence* | `int4` |  |  |
| *mrt* | `timestamp` |  |  |
| *priority* | `int4` |  |  |
| *qtype* | `str` |  |  |
| *relevance* | `int4` |  |  |
| *slat* | `float8` |  |  |
| *slong* | `float8` |  |  |
| *sourceAssetId* | `str` |  |  |
| *sourceGeoCountryCode* | `str` |  |  |
| *sourceGeoLocationInfo* | `str` |  |  |
| *sourceGeoRegionCode* | `str` |  |  |
| *sourceZoneExternalID* | `str` |  |  |
| *sourceZoneID* | `str` |  |  |
| *sourceZoneURI* | `str` |  |  |
| *view* | `str` |  |  |
| *tag* | `str` | *cefTag* | **✓** |
| *rawMessage* | `str` |  | **✓** |
| *hostchain* | `str` |  | **✓** |

### > Macro (anchor)

cef0.infoblox.niosThreat

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *hostname* | `str` |  |  |
| *priorityCode* | `str` |  |  |
| *cefTag* | `str` |  |  |
| *cefVersion* | `str` |  |  |
| *embDeviceVendor* | `str` |  |  |
| *embDeviceProduct* | `str` |  |  |
| *deviceVersion* | `str` |  |  |
| *signatureID* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *act* | `str` |  |  |
| *cat* | `str` |  |  |
| *dst* | `ip4` |  |  |
| *dpt* | `int4` |  |  |
| *src* | `ip4` |  |  |
| *spt* | `int4` |  |  |
| *fqdn* | `str` |  |  |
| *hit_count* | `str` |  |  |
| *nat* | `str` |  |  |
| *nfpt* | `str` |  |  |
| *nlpt* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` | *cefTag* | **✓** |
| *rawMessage* | `str` |  |  |