---
title: "cef0.netskope"
canonical: "https://docs.devo.com/space/latest/411336737/cef0.netskope"
format: markdown
---
[ [Introduction](https://devodocs.atlassian.net/wiki/spaces/latest/pages/397901825/cef0.forcepoint#Introduction) ] [ [Tag structure](https://devodocs.atlassian.net/wiki/spaces/latest/pages/397901825/cef0.forcepoint#Tag-structure) ] [ [How is the data sent to Devo?](https://devodocs.atlassian.net/wiki/spaces/latest/pages/397901825/cef0.forcepoint#How-is-the-data-sent-to-Devo?) ] [ [Table structure](https://devodocs.atlassian.net/wiki/spaces/latest/pages/397901825/cef0.forcepoint#Table-structure) ]

## Introduction

The tags beginning with `cef0.netskope` identify events in CEF format generated by [Netskope](https://www.netskope.com/).

## Tag structure

Events in CEF format don't have a specific tag structure, as explained in [Technologies supported in CEF syslog format](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94666383). They are always sent to a table with the structure **cef0.***deviceVendor*.*deviceProduct*.

In this case, the valid data tables are:

| **Tags** | **Data tables** |
| --- | --- |
| `cef0.netskope.casb` | `cef0.netskope.casb` |

## How is the data sent to Devo?

CEF data can be sent directly to Devo or by using a relay. To use the [CEF default relay rule](https://docs.devo.com/space/latest/96469422/The+4+predefined+relay+rules), send to the relay’s port **13000**. Learn more about CEF syslog format and how Devo tags these events in [Technologies supported in CEF syslog format](https://docs.devo.com/space/latest/94666383/Technologies+supported+in+CEF+syslog+format).

## Table structure

These are the fields displayed in this table:

### cef0.netskope.casb

| **Field** | **Type** | ***Extra***** field** | **Source field name** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *machine* | `str` |  |  |
| *priority_code* | `str` |  |  |
| *cef_tag* | `str` |  |  |
| *cef_version* | `str` |  |  |
| *emb_device_vendor* | `str` |  |  |
| *emb_device_product* | `str` |  |  |
| *device_version* | `str` |  |  |
| *signature_id* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *device_action* | `str` |  |  |
| *device_external_id* | `str` |  |  |
| *destination_ip* | `ip4` |  |  |
| *request_client_application* | `str` |  |  |
| *source_service_name* | `str` |  |  |
| *source_ip* | `ip4` |  |  |
| *source_username* | `str` |  |  |
| *access_method* | `str` |  |  |
| *action* | `str` |  |  |
| *app_session_id* | `str` |  |  |
| *appcategory* | `str` |  |  |
| *application_type* | `str` |  |  |
| *browser* | `str` |  |  |
| *cc_breach_date* | `timestamp` |  |  |
| *cc_breach_media_references* | `str` |  |  |
| *cc_breach_score* | `str` |  |  |
| *cc_email_source* | `str` |  |  |
| *cc_matched_username* | `str` |  |  |
| *cci* | `str` |  |  |
| *ccl* | `str` |  |  |
| *client_bytes* | `str` |  |  |
| *device* | `str` |  |  |
| *device_classification* | `str` |  |  |
| *event_type* | `str` |  |  |
| *hostname* | `str` |  |  |
| *management_id* | `str` |  |  |
| *netskope_justification_reason* | `str` |  |  |
| *netskope_justification_type* | `str` |  |  |
| *object* | `str` |  |  |
| *os* | `str` |  |  |
| *page* | `str` |  |  |
| *policy* | `str` |  |  |
| *policy_actions* | `str` |  |  |
| *server_bytes* | `str` |  |  |
| *timestamp* | `timestamp` |  |  |
| *url* | `str` |  |  |
| *audit_log_event* | `str` |  |  |
| *audit_type* | `str` |  |  |
| *hostchain* | `str` | **✓** |  |
| *tag* | `str` | **✓** | *cef_tag* |
| *rawMessage* | `str` |  |  |