---
title: "cef0.checkPoint"
canonical: "https://docs.devo.com/space/latest/94666587/cef0.checkPoint"
format: markdown
---
> Macro (toc)

> ℹ️ Check the reference vendor documentation [here](https://support.checkpoint.com/results/sk/sk144192).

## Introduction

The tags beginning with `cef0.checkpoint` identify events in CEF format generated by [Check Point](https://community.checkpoint.com/t5/Management/Log-Exporter-CEF-Field-Mappings/td-p/41060).

## Tag structure

Events in CEF format don't have a specific tag structure, as explained in [Technologies supported in CEF syslog format](https://docs.devo.com/space/latest/94666383). They are always sent to a table with the structure **cef0.***deviceVendor*.*deviceProduct*.

In this case, the valid data tables are:

| **Tags** | **Devo tables** |
| --- | --- |
| `cef0.checkPoint.anti-malware` | `cef0.checkPoint.antiMalware` |
| `cef0.checkPoint.anti-virus` | `cef0.checkPoint.antiVirus` |
| `cef0.checkPoint.applicationControl` | `cef0.checkPoint.applicationControl` |
| `cef0.checkPoint.applicationControlAndUrlFiltering` | `cef0.checkPoint.applicationControlAndUrlFiltering` |
| `cef0.checkPoint.cli` | `cef0.checkPoint.cli` |
| `cef0.checkPoint.clustermgmt` | `cef0.checkPoint.clustermgmt` |
| `cef0.checkPoint.compliance` | `cef0.checkPoint.compliance` |
| `cef0.checkPoint.complianceBlade` | `cef0.checkPoint.complianceBlade` |
| `cef0.checkPoint.connectra` | `cef0.checkPoint.connectra` |
| `cef0.checkPoint.contentAwareness` | `cef0.checkPoint.contentAwareness` |
| `cef0.checkPoint.contract_client` | `cef0.checkPoint.contract_client` |
| `cef0.checkPoint.cpmiClient` | `cef0.checkPoint.cpmiClient` |
| `cef0.checkPoint.endpointManagement` | `cef0.checkPoint.endpointManagement` |
| `cef0.checkPoint.endpointSecurityConsole` | `cef0.checkPoint.endpointSecurityConsole` |
| `cef0.checkPoint.esod` | `cef0.checkPoint.esod` |
| `cef0.checkPoint.eventiaAnalyzerClient` | `cef0.checkPoint.eventiaAnalyzerClient` |
| `cef0.checkPoint.fde` | `cef0.checkPoint.fde` |
| `cef0.checkPoint.fg` | `cef0.checkPoint.fg` |
| `cef0.checkPoint.firewall` | `cef0.checkPoint.firewall` |
| `cef0.checkPoint.firewall1` | `cef0.checkPoint.firewall1` |
| `cef0.checkPoint.fwm` | `cef0.checkPoint.fwm` |
| `cef0.checkPoint.gcli` | `cef0.checkPoint.gcli` |
| `cef0.checkPoint.httpsInspection` | `cef0.checkPoint.httpsInspection` |
| `cef0.checkPoint.identityAwareness` | `cef0.checkPoint.identityAwareness` |
| `cef0.checkPoint.identityLogging` | `cef0.checkPoint.identityLogging` |
| `cef0.checkPoint.ips` | `cef0.checkPoint.ips` |
| `cef0.checkPoint.licenseMgmt` | `cef0.checkPoint.licenseMgmt` |
| `cef0.checkPoint.lineEditor` | `cef0.checkPoint.lineEditor` |
| `cef0.checkPoint.logSystem` | `cef0.checkPoint.logSystem` |
| `cef0.checkPoint.log-update` | `cef0.checkPoint.logUpdate` |
| `cef0.checkPoint.logsIndexer` | `cef0.checkPoint.logsIndexer` |
| `cef0.checkPoint.managementBlade` | `cef0.checkPoint.managementBlade` |
| `cef0.checkPoint.mepp` | `cef0.checkPoint.mepp` |
| `cef0.checkPoint.new-anti-virus` | `cef0.checkPoint.newAntiVirus` |
| `cef0.checkPoint.noProduct` | `cef0.checkPoint.noProduct` |
| `cef0.checkPoint.none` | `cef0.checkPoint.none` |
| `cef0.checkPoint.policyServer` | `cef0.checkPoint.policyServer` |
| `cef0.checkPoint.queryDatabase` | `cef0.checkPoint.queryDatabase` |
| `cef0.checkPoint.rad` | `cef0.checkPoint.rad` |
| `cef0.checkPoint.scheduledSystemUpdate` | `cef0.checkPoint.scheduledSystemUpdate` |
| `cef0.checkPoint.securityGatewayManagement` | `cef0.checkPoint.securityGatewayManagement` |
| `cef0.checkPoint.securityManagementServer` | `cef0.checkPoint.securityManagementServer` |
| `cef0.checkPoint.smartconsole` | `cef0.checkPoint.smartconsole` |
| `cef0.checkPoint.smartdashboard` | `cef0.checkPoint.smartdashboard` |
| `cef0.checkPoint.smartdefense` | `cef0.checkPoint.smartdefense` |
| `cef0.checkPoint.smartdefenseAndVpn1Firewall1` | `cef0.checkPoint.smartdefenseAndVpn1Firewall1` |
| `cef0.checkPoint.smartdomainManager` | `cef0.checkPoint.smartdomainManager` |
| `cef0.checkPoint.smarteventClient` | `cef0.checkPoint.smarteventClient` |
| `cef0.checkPoint.smartupdate` | `cef0.checkPoint.smartupdate` |
| `cef0.checkPoint.smartview` | `cef0.checkPoint.smartview` |
| `cef0.checkPoint.smartviewMonitor` | `cef0.checkPoint.smartviewMonitor` |
| `cef0.checkPoint.smartviewTracker` | `cef0.checkPoint.smartviewTracker` |
| `cef0.checkPoint.stormagent` | `cef0.checkPoint.stormagent` |
| `cef0.checkPoint.system` | `cef0.checkPoint.system` |
| `cef0.checkPoint.system-monitor` | `cef0.checkPoint.systemMonitor` |
| `cef0.checkPoint.threatEmulation` | `cef0.checkPoint.threatEmulation` |
| `cef0.checkPoint.threatExtraction` | `cef0.checkPoint.threatExtraction` |
| `cef0.checkPoint.unknown` | `cef0.checkPoint.unknown` |
| `cef0.checkPoint.url-filtering` | `cef0.checkPoint.urlFiltering` |
| `cef0.checkPoint.vpn1` | `cef0.checkPoint.vpn1` |
| `cef0.checkPoint.vpn1EmbeddedConnector` | `cef0.checkPoint.vpn1EmbeddedConnector` |
| `cef0.checkPoint.vpn1-firewall-1` | `cef0.checkPoint.vpn1Firewall1` |
| `cef0.checkPoint.vpn-1-firewall-1-and-content-awareness` | `cef0.checkPoint.vpn1Firewall1AndContentAwareness` |
| `cef0.checkPoint.vpn1Firewall1Smartdefense` | `cef0.checkPoint.vpn1Firewall1Smartdefense` |
| `cef0.checkPoint.webUi` | `cef0.checkPoint.webUi` |
| `cef0.checkPoint.web_api` | `cef0.checkPoint.web_api` |
| `cef0.checkPoint.zeroPhishing` | `cef0.checkPoint.zeroPhishing` |

## <span style="color: #282828">How is the data sent to Devo?</span>

CEF data can be sent directly to Devo or by using a relay. To use the [CEF default relay rule](https://docs.devo.com/space/latest/96469422/The+4+predefined+relay+rules), send to the relay’s port **13000**. Learn more about CEF syslog format and how Devo tags these events in [Technologies supported in CEF syslog format](https://docs.devo.com/space/latest/94666383/Technologies+supported+in+CEF+syslog+format).

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [cef0.checkPoint.antiMalware](#cef0.checkPoint.antiMalware)
> - [cef0.checkPoint.antiVirus](#cef0.checkPoint.antiVirus)
> - [cef0.checkPoint.applicationControl](#cef0.checkPoint.applicationControl)
> - [cef0.checkPoint.applicationControlAndUrlFiltering](#cef0.checkPoint.applicationControlAndUrlFiltering)
> - [cef0.checkPoint.firewall](#cef0.checkPoint.firewall)
> - [cef0.checkPoint.ips](#cef0.checkPoint.ips)
> - [cef0.checkPoint.logUpdate](#cef0.checkPoint.logUpdate)
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.antiMalware
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *c6a4Label* | `str` |  |  |
> | *cs1Label* | `str` |  |  |
> | *cs1* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *dvc* | `ip4` |  |  |
> | *deviceFacility* | `str` |  |  |
> | *msg* | `str` |  |  |
> | *requestClientApplication* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *shost* | `str` |  |  |
> | *src* | `ip4` |  |  |
> | *suser* | `str` |  |  |
> | *ad_action__details* | `str` |  |  |
> | *ad_am__update__proxy* | `str` |  |  |
> | *ad_am__update__source* | `str` |  |  |
> | *ad_client__version* | `str` |  |  |
> | *ad_cp__severity* | `str` |  |  |
> | *ad_engine__ver* | `str` |  |  |
> | *ad_event__type* | `str` |  |  |
> | *ad_failed__updates* | `str` |  |  |
> | *ad_host__type* | `str` |  |  |
> | *ad_installed__products* | `str` |  |  |
> | *ad_local__time* | `str` |  |  |
> | *ad_loguid* | `str` |  |  |
> | *ad_machine__guid* | `str` |  |  |
> | *ad_origin* | `str` |  |  |
> | *ad_os__name* | `str` |  |  |
> | *ad_os__version* | `str` |  |  |
> | *ad_policy__date* | `str` |  |  |
> | *ad_policy__name* | `str` |  |  |
> | *ad_policy__number* | `str` |  |  |
> | *ad_product* | `str` |  |  |
> | *ad_result* | `str` |  |  |
> | *ad_sequencenum* | `str` |  |  |
> | *ad_sig__ver* | `str` |  |  |
> | *ad_user__name* | `str` |  |  |
> | *ad_user__sid* | `str` |  |  |
> | *ad_version* | `str` |  |  |
> | *agentZoneURI* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *art* | `str` |  |  |
> | *at* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *av* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *geid* | `str` |  |  |
> | *sourceZoneURI* | `str` |  |  |
> | *act* | `str` |  |  |
> | *alert* | `str` |  |  |
> | *cnt* | `int4` |  |  |
> | *contract_name* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *cs3Label* | `str` |  |  |
> | *cs3* | `str` |  |  |
> | *cs4Label* | `str` |  |  |
> | *cs4* | `str` |  |  |
> | *cs6Label* | `str` |  |  |
> | *cs6* | `str` |  |  |
> | *db_ver* | `int8` |  |  |
> | *deviceCustomDate2Label* | `str` |  |  |
> | *spt* | `int4` |  |  |
> | *dpt* | `int4` |  |  |
> | *dst* | `ip4` |  |  |
> | *flexNumber1Label* | `str` |  |  |
> | *flexNumber1* | `int4` |  |  |
> | *flexString2Label* | `str` |  |  |
> | *flexString2* | `str` |  |  |
> | *ifname* | `str` |  |  |
> | *lastupdatetime* | `timestamp` |  |  |
> | *log_id* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *next_update_desc* | `str` |  |  |
> | *origin* | `ip4` |  |  |
> | *originsicname* | `str` |  |  |
> | *in* | `int8` |  |  |
> | *out* | `int8` |  |  |
> | *packet_capture_name* | `str` |  |  |
> | *packet_capture_time* | `timestamp` |  |  |
> | *packet_capture_unique_id* | `str` |  |  |
> | *policy* | `str` |  |  |
> | *policy_time* | `timestamp` |  |  |
> | *product* | `str` |  |  |
> | *proto* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *session_id* | `str` |  |  |
> | *sourceServiceName* | `str` |  |  |
> | *sourceTranslatedAddress* | `ip4` |  |  |
> | *special_properties* | `str` |  |  |
> | *version* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.antiVirus
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *msg* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *alert* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *ifname* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *origin* | `str` |  |  |
> | *product* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *version* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | cefTag | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.applicationControl
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *proto* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *start* | `timestamp` |  |  |
> | *dst* | `ip4` |  |  |
> | *cnt* | `int4` |  |  |
> | *dvc* | `ip4` |  |  |
> | *src* | `ip4` |  |  |
> | *act* | `str` |  |  |
> | *cs5* | `str` |  |  |
> | *in* | `int8` |  |  |
> | *app* | `str` |  |  |
> | *cs6* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *cs6Label* | `str` |  |  |
> | *out* | `int8` |  |  |
> | *cs2Label* | `str` |  |  |
> | *cs5Label* | `str` |  |  |
> | *destinationGeoCountryCode* | `str` |  |  |
> | *categoryDeviceGroup* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *sourceZoneID* | `str` |  |  |
> | *flexString1Label* | `str` |  |  |
> | *deviceZoneID* | `str` |  |  |
> | *slong* | `str` |  |  |
> | *categoryObject* | `str` |  |  |
> | *eventAnnotationAuditTrail* | `str` |  |  |
> | *eventAnnotationVersion* | `str` |  |  |
> | *eventAnnotationModificationTime* | `str` |  |  |
> | *art* | `str` |  |  |
> | *categorySignificance* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *originalAgentAddress* | `str` |  |  |
> | *dpt* | `str` |  |  |
> | *at* | `str` |  |  |
> | *mrt* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *originalAgentZoneURI* | `str` |  |  |
> | *dlat* | `str` |  |  |
> | *sourceZoneURI* | `str` |  |  |
> | *assetCriticality* | `str` |  |  |
> | *destinationZoneID* | `str` |  |  |
> | *eventAnnotationFlags* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *categoryBehavior* | `str` |  |  |
> | *modelConfidence* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *deviceZoneExternalID* | `str` |  |  |
> | *slat* | `str` |  |  |
> | *Severity* | `str` |  |  |
> | *relevance* | `str` |  |  |
> | *av* | `str` |  |  |
> | *eventAnnotationStageUpdateTime* | `str` |  |  |
> | *categoryOutcome* | `str` |  |  |
> | *catdt* | `str` |  |  |
> | *locality* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *originalAgentVersion* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *dlong* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *originalAgentMacAddress* | `str` |  |  |
> | *type* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *originalAgentType* | `str` |  |  |
> | *flexString1* | `str` |  |  |
> | *originalAgentId* | `str` |  |  |
> | *eventAnnotationManagerReceiptTime* | `str` |  |  |
> | *originalAgentHostName* | `str` |  |  |
> | *priority* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *eventAnnotationEndTime* | `str` |  |  |
> | *destinationZoneURI* | `str` |  |  |
> | *appCategory* | `str` |  |  |
> | *appProperties* | `str` |  |  |
> | *layerName* | `str` |  |  |
> | *layerUUID* | `str` |  |  |
> | *matchID* | `int8` |  |  |
> | *parentRule* | `int8` |  |  |
> | *ruleAction* | `str` |  |  |
> | *ruleUID* | `str` |  |  |
> | *cpAppRisk* | `str` |  |  |
> | *connDirection* | `str` |  |  |
> | *ifname* | `str` |  |  |
> | *logid* | `int8` |  |  |
> | *loguid* | `str` |  |  |
> | *origin* | `ip4` |  |  |
> | *originsicname* | `str` |  |  |
> | *sequencenum* | `int8` |  |  |
> | *version* | `int8` |  |  |
> | *aggregatedLogCount* | `int8` |  |  |
> | *browseTime* | `int8` |  |  |
> | *bytes* | `int8` |  |  |
> | *clientInboundPackets* | `int8` |  |  |
> | *clientOutboundPackets* | `int8` |  |  |
> | *clientTypeOS* | `str` |  |  |
> | *connectionCount* | `int8` |  |  |
> | *appID* | `int8` |  |  |
> | *creationTime* | `int8` |  |  |
> | *duration* | `int8` |  |  |
> | *hllKey* | `int8` |  |  |
> | *inzone* | `str` |  |  |
> | *lastHitTime* | `int8` |  |  |
> | *outzone* | `str` |  |  |
> | *packets* | `int8` |  |  |
> | *product* | `str` |  |  |
> | *serverInboundBytes* | `int8` |  |  |
> | *serverInboundPackets* | `int8` |  |  |
> | *serverOutboundBytes* | `int8` |  |  |
> | *serverOutboundPackets* | `int8` |  |  |
> | *serviceID* | `str` |  |  |
> | *sigID* | `int8` |  |  |
> | *updateCount* | `int8` |  |  |
> | *requestMethod* | `str` |  |  |
> | *request* | `str` |  |  |
> | *connectionLUUID* | `str` |  |  |
> | *requestClientApplication* | `str` |  |  |
> | *lastupdatetime* | `int8` |  |  |
> | *msg* | `str` |  |  |
> | *db_ver* | `str` |  |  |
> | *deviceCustomDate2Label* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *appDesc* | `str` |  |  |
> | *tag* | `str` | *cefTag* | **✓** |
> | *hostchain* | `str` |  | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.applicationControlAndUrlFiltering
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *act* | `str` |  |  |
> | *app* | `str` |  |  |
> | *c6a4Label* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *cs5Label* | `str` |  |  |
> | *cs5* | `str` |  |  |
> | *cs6Label* | `str` |  |  |
> | *cs6* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *dst* | `ip4` |  |  |
> | *dpt* | `int4` |  |  |
> | *duser* | `str` |  |  |
> | *dvc* | `ip4` |  |  |
> | *in* | `int8` |  |  |
> | *out* | `int8` |  |  |
> | *proto* | `str` |  |  |
> | *requestClientApplication* | `str` |  |  |
> | *requestMethod* | `str` |  |  |
> | *request* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *shost* | `str` |  |  |
> | *src* | `ip4` |  |  |
> | *suser* | `str` |  |  |
> | *ad_aggregated__log__count* | `str` |  |  |
> | *ad_app__category* | `str` |  |  |
> | *ad_app__desc* | `str` |  |  |
> | *ad_app__id* | `str` |  |  |
> | *ad_app__properties* | `str` |  |  |
> | *ad_browse__time* | `str` |  |  |
> | *ad_bytes* | `str` |  |  |
> | *ad_client__inbound__packets* | `str` |  |  |
> | *ad_client__outbound__packets* | `str` |  |  |
> | *ad_conn__direction* | `str` |  |  |
> | *ad_connection__count* | `str` |  |  |
> | *ad_cp__app__risk* | `str` |  |  |
> | *ad_creation__time* | `str` |  |  |
> | *ad_duration* | `str` |  |  |
> | *ad_hll__key* | `str` |  |  |
> | *ad_https__inspection__action* | `str` |  |  |
> | *ad_ifname* | `str` |  |  |
> | *ad_last__hit__time* | `str` |  |  |
> | *ad_layer__name* | `str` |  |  |
> | *ad_layer__uuid* | `str` |  |  |
> | *ad_logid* | `str` |  |  |
> | *ad_loguid* | `str` |  |  |
> | *ad_match__id* | `str` |  |  |
> | *ad_origin* | `str` |  |  |
> | *ad_originsicname* | `str` |  |  |
> | *ad_packets* | `str` |  |  |
> | *ad_parent__rule* | `str` |  |  |
> | *ad_product* | `str` |  |  |
> | *ad_rule__action* | `str` |  |  |
> | *ad_rule__uid* | `str` |  |  |
> | *ad_sequencenum* | `str` |  |  |
> | *ad_server__inbound__bytes* | `str` |  |  |
> | *ad_server__inbound__packets* | `str` |  |  |
> | *ad_server__outbound__bytes* | `str` |  |  |
> | *ad_server__outbound__packets* | `str` |  |  |
> | *ad_service__id* | `str` |  |  |
> | *ad_sig__id* | `str` |  |  |
> | *ad_src__user__dn* | `str` |  |  |
> | *ad_update__count* | `str` |  |  |
> | *ad_version* | `str` |  |  |
> | *agentZoneURI* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *art* | `str` |  |  |
> | *at* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *av* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *destinationZoneURI* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *flexString1* | `str` |  |  |
> | *flexString1Label* | `str` |  |  |
> | *geid* | `str` |  |  |
> | *inzone* | `str` |  |  |
> | *lastupdatetime* | `str` |  |  |
> | *sourceZoneURI* | `str` |  |  |
> | *outzone* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.firewall
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *c6a4Label* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *dvc* | `ip4` |  |  |
> | *msg* | `str` |  |  |
> | *outcome* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *ad_loguid* | `str` |  |  |
> | *ad_origin* | `str` |  |  |
> | *ad_originsicname* | `str` |  |  |
> | *ad_product* | `str` |  |  |
> | *ad_sequencenum* | `str` |  |  |
> | *ad_update__service* | `str` |  |  |
> | *ad_version* | `str` |  |  |
> | *agentZoneURI* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *art* | `str` |  |  |
> | *at* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *av* | `str` |  |  |
> | *catdt* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *geid* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.ips
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *msg* | `str` |  |  |
> | *dvc* | `ip4` |  |  |
> | *in* | `int8` |  |  |
> | *rt* | `timestamp` |  |  |
> | *out* | `int8` |  |  |
> | *deviceCustomDate2Label* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *deviceZoneID* | `str` |  |  |
> | *eventAnnotationAuditTrail* | `str` |  |  |
> | *eventAnnotationVersion* | `str` |  |  |
> | *eventAnnotationModificationTime* | `str` |  |  |
> | *art* | `str` |  |  |
> | *originalAgentAddress* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *at* | `str` |  |  |
> | *mrt* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *originalAgentZoneURI* | `str` |  |  |
> | *assetCriticality* | `str` |  |  |
> | *eventAnnotationFlags* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *modelConfidence* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *Severity* | `str` |  |  |
> | *relevance* | `str` |  |  |
> | *av* | `str` |  |  |
> | *eventAnnotationStageUpdateTime* | `str` |  |  |
> | *locality* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *originalAgentVersion* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *originalAgentMacAddress* | `str` |  |  |
> | *originalAgentType* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *originalAgentId* | `str` |  |  |
> | *eventAnnotationManagerReceiptTime* | `str` |  |  |
> | *originalAgentHostName* | `str` |  |  |
> | *priority* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *eventAnnotationEndTime* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *db_ver* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *origin* | `ip4` |  |  |
> | *loguid* | `str` |  |  |
> | *originsicname* | `str` |  |  |
> | *product* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *version* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.logUpdate
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *dst* | `ip4` |  |  |
> | *start* | `timestamp` |  |  |
> | *cnt* | `int4` |  |  |
> | *spt* | `int4` |  |  |
> | *src* | `ip4` |  |  |
> | *act* | `str` |  |  |
> | *dvc* | `ip4` |  |  |
> | *in* | `int8` |  |  |
> | *proto* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *out* | `int8` |  |  |
> | *cs2Label* | `str` |  |  |
> | *categoryDeviceGroup* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *sourceZoneID* | `str` |  |  |
> | *slong* | `str` |  |  |
> | *deviceZoneID* | `str` |  |  |
> | *sourceGeoRegionCode* | `str` |  |  |
> | *categoryObject* | `str` |  |  |
> | *eventAnnotationAuditTrail* | `str` |  |  |
> | *eventAnnotationVersion* | `str` |  |  |
> | *eventAnnotationModificationTime* | `str` |  |  |
> | *art* | `str` |  |  |
> | *categorySignificance* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *dpt* | `str` |  |  |
> | *originalAgentAddress* | `str` |  |  |
> | *sourceGeoPostalCode* | `str` |  |  |
> | *at* | `str` |  |  |
> | *mrt* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *dlat* | `str` |  |  |
> | *originalAgentZoneURI* | `str` |  |  |
> | *sourceZoneURI* | `str` |  |  |
> | *assetCriticality* | `str` |  |  |
> | *destinationZoneID* | `str` |  |  |
> | *eventAnnotationFlags* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *categoryBehavior* | `str` |  |  |
> | *sourceGeoCountryCode* | `str` |  |  |
> | *modelConfidence* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *deviceZoneExternalID* | `str` |  |  |
> | *slat* | `str` |  |  |
> | *Severity* | `str` |  |  |
> | *destinationZoneExternalID* | `str` |  |  |
> | *relevance* | `str` |  |  |
> | *av* | `str` |  |  |
> | *eventAnnotationStageUpdateTime* | `str` |  |  |
> | *categoryOutcome* | `str` |  |  |
> | *locality* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *originalAgentVersion* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *dlong* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *originalAgentMacAddress* | `str` |  |  |
> | *originalAgentType* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *type* | `str` |  |  |
> | *originalAgentId* | `str` |  |  |
> | *eventAnnotationManagerReceiptTime* | `str` |  |  |
> | *originalAgentHostName* | `str` |  |  |
> | *priority* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *eventAnnotationEndTime* | `str` |  |  |
> | *sourceGeoLocationInfo* | `str` |  |  |
> | *destinationZoneURI* | `str` |  |  |
> | *cn1Label* | `str` |  |  |
> | *cn1* | `int8` |  |  |
> | *deviceInboundInterface* | `str` |  |  |
> | *__pos* | `str` |  |  |
> | *__nsons* | `str` |  |  |
> | *__p_dport* | `str` |  |  |
> | *contextnum* | `str` |  |  |
> | *context_num* | `str` |  |  |
> | *hll_key* | `str` |  |  |
> | *ifname* | `str` |  |  |
> | *logid* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *origin* | `ip4` |  |  |
> | *originsicname* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *bytes* | `int8` |  |  |
> | *packets* | `int8` |  |  |
> | *product* | `str` |  |  |
> | *client_inbound_packets* | `int8` |  |  |
> | *client_outbound_packets* | `int8` |  |  |
> | *server_inbound_bytes* | `int8` |  |  |
> | *server_inbound_packets* | `int8` |  |  |
> | *server_outbound_bytes* | `int8` |  |  |
> | *server_outbound_packets* | `int8` |  |  |
> | *server_outbound_interface* | `str` |  |  |
> | *segment_time* | `timestamp` |  |  |
> | *version* | `str` |  |  |
> | *administrator* | `str` |  |  |
> | *alert* | `str` |  |  |
> | *blade_name* | `str` |  |  |
> | *deviceOutboundInterface* | `str` |  |  |
> | *feature_name* | `str` |  |  |
> | *fieldschanges* | `str` |  |  |
> | *lastupdatetime* | `timestamp` |  |  |
> | *log_sys_message* | `str` |  |  |
> | *msg* | `str` |  |  |
> | *operation* | `str` |  |  |
> | *sam_error* | `str` |  |  |
> | *sam_log_type* | `str` |  |  |
> | *sendtotrackerasadvancedauditlog* | `str` |  |  |
> | *server_inbound_interface* | `str` |  |  |
> | *session_description* | `str` |  |  |
> | *session_name* | `str` |  |  |
> | *session_uid* | `str` |  |  |
> | *sntdom* | `str` |  |  |
> | *stormagentaction* | `str` |  |  |
> | *stormagentname* | `str` |  |  |
> | *subject* | `str` |  |  |
> | *sys_message* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [cef0.checkPoint.newAntiVirus](#cef0.checkPoint.newAntiVirus)
> - [cef0.checkPoint.rad](#cef0.checkPoint.rad)
> - [cef0.checkPoint.securityGatewayManagement](#cef0.checkPoint.securityGatewayManagement)
> - [cef0.checkPoint.smartdefense](#cef0.checkPoint.smartdefense)
> - [cef0.checkPoint.smarteventClient](#cef0.checkPoint.smarteventClient)
> - [cef0.checkPoint.systemMonitor](#cef0.checkPoint.systemMonitor)
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.newAntiVirus
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *act* | `str` |  |  |
> | *c6a4Label* | `str` |  |  |
> | *cs1Label* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *cs3Label* | `str` |  |  |
> | *cs3* | `str` |  |  |
> | *cs4Label* | `str` |  |  |
> | *cs4* | `str` |  |  |
> | *cs6Label* | `str` |  |  |
> | *cs6* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *dst* | `ip4` |  |  |
> | *dpt* | `int4` |  |  |
> | *dvc* | `ip4` |  |  |
> | *in* | `int8` |  |  |
> | *msg* | `str` |  |  |
> | *out* | `int8` |  |  |
> | *proto* | `str` |  |  |
> | *request* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *shost* | `str` |  |  |
> | *sourceTranslatedAddress* | `ip4` |  |  |
> | *src* | `ip4` |  |  |
> | *spt* | `int4` |  |  |
> | *ad_action__details* | `str` |  |  |
> | *ad_cp__severity* | `str` |  |  |
> | *ad_ifname* | `str` |  |  |
> | *ad_layer__name* | `str` |  |  |
> | *ad_layer__uuid* | `str` |  |  |
> | *ad_log__id* | `str` |  |  |
> | *ad_loguid* | `str` |  |  |
> | *ad_origin* | `str` |  |  |
> | *ad_originsicname* | `str` |  |  |
> | *ad_policy* | `str` |  |  |
> | *ad_policy__time* | `str` |  |  |
> | *ad_product* | `str` |  |  |
> | *ad_sequencenum* | `str` |  |  |
> | *ad_session__id* | `str` |  |  |
> | *ad_smartdefense__profile* | `str` |  |  |
> | *ad_snid* | `str` |  |  |
> | *ad_vendor__list* | `str` |  |  |
> | *ad_version* | `str` |  |  |
> | *agentZoneURI* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *art* | `str` |  |  |
> | *at* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *av* | `str` |  |  |
> | *catdt* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *destinationZoneURI* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *flexNumber1* | `str` |  |  |
> | *flexNumber1Label* | `str` |  |  |
> | *flexString2* | `str` |  |  |
> | *flexString2Label* | `str` |  |  |
> | *geid* | `str` |  |  |
> | *sourceTranslatedZoneURI* | `str` |  |  |
> | *sourceZoneURI* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *db_ver* | `str` |  |  |
> | *deviceCustomDate2Label* | `str` |  |  |
> | *next_update_desc* | `str` |  |  |
> | *contract_name* | `str` |  |  |
> | *product* | `str` |  |  |
> | *special_properties* | `str` |  |  |
> | *version* | `int4` |  |  |
> | *log_id* | `str` |  |  |
> | *sequencenum* | `int4` |  |  |
> | *origin* | `ip4` |  |  |
> | *cnt* | `int4` |  |  |
> | *http_host* | `str` |  |  |
> | *lastupdatetime* | `timestamp` |  |  |
> | *packet_capture_name* | `str` |  |  |
> | *packet_capture_time* | `timestamp` |  |  |
> | *packet_capture_unique_id* | `str` |  |  |
> | *policy_time* | `timestamp` |  |  |
> | *proxy_src_ip* | `ip4` |  |  |
> | *referrer* | `str` |  |  |
> | *requestClientApplication* | `str` |  |  |
> | *requestMethod* | `str` |  |  |
> | *subscription_stat* | `str` |  |  |
> | *subscription_stat_desc* | `str` |  |  |
> | *user_agent* | `str` |  |  |
> | *cs1* | `str` |  |  |
> | *deviceCustomDate2* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.rad
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *alert* | `str` |  |  |
> | *ifname* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *msg* | `str` |  |  |
> | *dvc* | `ip4` |  |  |
> | *in* | `int8` |  |  |
> | *rt* | `timestamp` |  |  |
> | *out* | `int8` |  |  |
> | *dtz* | `str` |  |  |
> | *deviceZoneID* | `str` |  |  |
> | *eventAnnotationAuditTrail* | `str` |  |  |
> | *version* | `str` |  |  |
> | *eventAnnotationVersion* | `str` |  |  |
> | *eventAnnotationModificationTime* | `str` |  |  |
> | *art* | `str` |  |  |
> | *origin* | `ip4` |  |  |
> | *originalAgentAddress* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *at* | `str` |  |  |
> | *mrt* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *originalAgentZoneURI* | `str` |  |  |
> | *assetCriticality* | `str` |  |  |
> | *eventAnnotationFlags* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *modelConfidence* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *deviceZoneExternalID* | `str` |  |  |
> | *Severity* | `str` |  |  |
> | *relevance* | `str` |  |  |
> | *av* | `str` |  |  |
> | *eventAnnotationStageUpdateTime* | `str` |  |  |
> | *locality* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *originalAgentVersion* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *originalAgentMacAddress* | `str` |  |  |
> | *originalAgentType* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *originalAgentId* | `str` |  |  |
> | *eventAnnotationManagerReceiptTime* | `str` |  |  |
> | *originalAgentHostName* | `str` |  |  |
> | *priority* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *eventAnnotationEndTime* | `str` |  |  |
> | *product* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.securityGatewayManagement
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *act* | `str` |  |  |
> | *app* | `str` |  |  |
> | *cat* | `str` |  |  |
> | *c6a1Label* | `str` |  |  |
> | *c6a1* | `str` |  |  |
> | *c6a2Label* | `str` |  |  |
> | *c6a2* | `str` |  |  |
> | *c6a3Label* | `str` |  |  |
> | *c6a3* | `str` |  |  |
> | *c6a4Label* | `str` |  |  |
> | *c6a4* | `str` |  |  |
> | *cfp1Label* | `str` |  |  |
> | *cfp1* | `float8` |  |  |
> | *cfp2Label* | `str` |  |  |
> | *cfp2* | `float8` |  |  |
> | *cfp3Label* | `str` |  |  |
> | *cfp3* | `float8` |  |  |
> | *cfp4Label* | `str` |  |  |
> | *cfp4* | `float8` |  |  |
> | *cn1Label* | `str` |  |  |
> | *cn1* | `int8` |  |  |
> | *cn2Label* | `str` |  |  |
> | *cn2* | `int8` |  |  |
> | *cn3Label* | `str` |  |  |
> | *cn3* | `int8` |  |  |
> | *cnt* | `int4` |  |  |
> | *cs1Label* | `str` |  |  |
> | *cs1* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *cs3Label* | `str` |  |  |
> | *cs3* | `str` |  |  |
> | *cs4Label* | `str` |  |  |
> | *cs4* | `str` |  |  |
> | *cs5Label* | `str` |  |  |
> | *cs5* | `str` |  |  |
> | *cs6Label* | `str` |  |  |
> | *cs6* | `str` |  |  |
> | *destinationDnsDomain* | `str` |  |  |
> | *destinationServiceName* | `str` |  |  |
> | *destinationTranslatedAddress* | `ip4` |  |  |
> | *destinationTranslatedPort* | `int4` |  |  |
> | *deviceCustomDate1Label* | `str` |  |  |
> | *deviceCustomDate1* | `timestamp` |  |  |
> | *deviceCustomDate2Label* | `str` |  |  |
> | *deviceCustomDate2* | `timestamp` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *deviceDnsDomain* | `str` |  |  |
> | *deviceExternalId* | `str` |  |  |
> | *deviceInboundInterface* | `str` |  |  |
> | *deviceMacAddress* | `str` |  |  |
> | *deviceNtDomain* | `str` |  |  |
> | *deviceOutboundInterface* | `str` |  |  |
> | *deviceProcessName* | `str` |  |  |
> | *deviceTranslatedAddress* | `ip4` |  |  |
> | *dhost* | `str` |  |  |
> | *dmac* | `str` |  |  |
> | *dntdom* | `str` |  |  |
> | *dpid* | `int4` |  |  |
> | *dpriv* | `str` |  |  |
> | *dproc* | `str` |  |  |
> | *dst* | `ip4` |  |  |
> | *duid* | `str` |  |  |
> | *duser* | `str` |  |  |
> | *dvchost* | `str` |  |  |
> | *dvc* | `ip4` |  |  |
> | *dvcpid* | `int4` |  |  |
> | *end* | `timestamp` |  |  |
> | *deviceFacility* | `str` |  |  |
> | *externalId* | `str` |  |  |
> | *fileCreateTime* | `timestamp` |  |  |
> | *fileHash* | `str` |  |  |
> | *fileId* | `str` |  |  |
> | *fileModificationTime* | `timestamp` |  |  |
> | *filePath* | `str` |  |  |
> | *filePermission* | `str` |  |  |
> | *fileType* | `str` |  |  |
> | *fname* | `str` |  |  |
> | *fsize* | `int8` |  |  |
> | *in* | `int8` |  |  |
> | *msg* | `str` |  |  |
> | *oldFileCreateTime* | `timestamp` |  |  |
> | *oldFileHash* | `str` |  |  |
> | *oldFileId* | `str` |  |  |
> | *oldFileModificationTime* | `timestamp` |  |  |
> | *oldFileName* | `str` |  |  |
> | *oldFilePath* | `str` |  |  |
> | *oldFilePermission* | `str` |  |  |
> | *oldFileSize* | `int8` |  |  |
> | *oldFileType* | `str` |  |  |
> | *outcome* | `str` |  |  |
> | *out* | `int8` |  |  |
> | *proto* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *requestClientApplication* | `str` |  |  |
> | *requestCookies* | `str` |  |  |
> | *requestMethod* | `str` |  |  |
> | *request* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *shost* | `str` |  |  |
> | *smac* | `str` |  |  |
> | *sntdom* | `str` |  |  |
> | *sourceDnsDomain* | `str` |  |  |
> | *sourceServiceName* | `str` |  |  |
> | *sourceTranslatedAddress* | `ip4` |  |  |
> | *sourceTranslatedPort* | `int4` |  |  |
> | *spid* | `int4` |  |  |
> | *spriv* | `str` |  |  |
> | *sproc* | `str` |  |  |
> | *spt* | `int4` |  |  |
> | *src* | `ip4` |  |  |
> | *start* | `timestamp` |  |  |
> | *suid* | `str` |  |  |
> | *suser* | `str` |  |  |
> | *agt* | `ip4` |  |  |
> | *ahost* | `str` |  |  |
> | *art* | `str` |  |  |
> | *assetCriticality* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *catdt* | `str` |  |  |
> | *categoryBehavior* | `str` |  |  |
> | *categoryCustomFormatField* | `str` |  |  |
> | *categoryDeviceGroup* | `str` |  |  |
> | *categoryObject* | `str` |  |  |
> | *categoryOutcome* | `str` |  |  |
> | *categorySignificance* | `str` |  |  |
> | *categoryTechnique* | `str` |  |  |
> | *categoryTupleDescription* | `str` |  |  |
> | *comment* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *destinationGeoCountryCode* | `str` |  |  |
> | *destinationGeoLocationInfo* | `str` |  |  |
> | *destinationGeoPostalCode* | `str` |  |  |
> | *destinationGeoRegionCode* | `str` |  |  |
> | *deviceDomain* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *dlat* | `float8` |  |  |
> | *dlong* | `float8` |  |  |
> | *dpt* | `int4` |  |  |
> | *dtz* | `str` |  |  |
> | *dvcmac* | `str` |  |  |
> | *endTime* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *failure_impact* | `str` |  |  |
> | *flexNumber1* | `str` |  |  |
> | *flexNumber1Label* | `str` |  |  |
> | *flexNumber2* | `str` |  |  |
> | *flexNumber2Label* | `str` |  |  |
> | *flexString1* | `str` |  |  |
> | *flexString1Label* | `str` |  |  |
> | *flexString2* | `str` |  |  |
> | *flexString2Label* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *modelConfidence* | `int4` |  |  |
> | *mrt* | `timestamp` |  |  |
> | *origin* | `str` |  |  |
> | *originsicname* | `str` |  |  |
> | *priority* | `int4` |  |  |
> | *product* | `str` |  |  |
> | *relevance* | `int4` |  |  |
> | *requestContext* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *sessionId* | `str` |  |  |
> | *slat* | `float8` |  |  |
> | *slong* | `float8` |  |  |
> | *sourceGeoCountryCode* | `str` |  |  |
> | *sourceGeoLocationInfo* | `str` |  |  |
> | *sourceGeoPostalCode* | `str` |  |  |
> | *sourceGeoRegionCode* | `str` |  |  |
> | *update_service* | `str` |  |  |
> | *version* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.smartdefense
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *act* | `str` |  |  |
> | *cat* | `str` |  |  |
> | *c6a2Label* | `str` |  |  |
> | *c6a2* | `str` |  |  |
> | *c6a3Label* | `str` |  |  |
> | *c6a3* | `str` |  |  |
> | *cn1Label* | `str` |  |  |
> | *cn1* | `int8` |  |  |
> | *cn2Label* | `str` |  |  |
> | *cn2* | `int8` |  |  |
> | *cn3Label* | `str` |  |  |
> | *cn3* | `int8` |  |  |
> | *cnt* | `int4` |  |  |
> | *cs1Label* | `str` |  |  |
> | *cs1* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *cs3Label* | `str` |  |  |
> | *cs3* | `str` |  |  |
> | *cs4Label* | `str` |  |  |
> | *cs4* | `str` |  |  |
> | *cs5Label* | `str` |  |  |
> | *cs5* | `str` |  |  |
> | *cs6Label* | `str` |  |  |
> | *cs6* | `str` |  |  |
> | *deviceCustomDate1Label* | `str` |  |  |
> | *deviceCustomDate1* | `timestamp` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *dst* | `ip4` |  |  |
> | *dvc* | `ip4` |  |  |
> | *in* | `int8` |  |  |
> | *msg* | `str` |  |  |
> | *out* | `int8` |  |  |
> | *proto* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *requestMethod* | `str` |  |  |
> | *request* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *sourceServiceName* | `str` |  |  |
> | *dpt* | `int4` |  |  |
> | *spt* | `int4` |  |  |
> | *src* | `ip4` |  |  |
> | *start* | `timestamp` |  |  |
> | *agt* | `ip4` |  |  |
> | *ahost* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *arcSightEventPath* | `str` |  |  |
> | *art* | `str` |  |  |
> | *assetCriticality* | `int4` |  |  |
> | *at* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *av* | `str` |  |  |
> | *catdt* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *deviceAssetId* | `str` |  |  |
> | *deviceZoneID* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *eventAnnotationAuditTrail* | `str` |  |  |
> | *eventAnnotationEndTime* | `timestamp` |  |  |
> | *eventAnnotationEventId* | `str` |  |  |
> | *eventAnnotationFlags* | `str` |  |  |
> | *eventAnnotationManagerReceiptTime* | `timestamp` |  |  |
> | *eventAnnotationModificationTime* | `timestamp` |  |  |
> | *eventAnnotationStageID* | `str` |  |  |
> | *eventAnnotationStageUpdateTime* | `timestamp` |  |  |
> | *eventAnnotationStageURI* | `str` |  |  |
> | *eventAnnotationVersion* | `int4` |  |  |
> | *eventId* | `str` |  |  |
> | *locality* | `int4` |  |  |
> | *modelConfidence* | `int4` |  |  |
> | *mrt* | `timestamp` |  |  |
> | *priority* | `int4` |  |  |
> | *relevance* | `int4` |  |  |
> | *type* | `int4` |  |  |
> | *aggressive_aging_status* | `str` |  |  |
> | *alert* | `str` |  |  |
> | *capacity_notification* | `str` |  |  |
> | *connections_table_capacity* | `str` |  |  |
> | *content_type* | `str` |  |  |
> | *content_length* | `int8` |  |  |
> | *cp_severity* | `str` |  |  |
> | *description_url* | `str` |  |  |
> | *flexNumber1Label* | `str` |  |  |
> | *flexNumber1* | `int4` |  |  |
> | *flexNumber2Label* | `str` |  |  |
> | *flexNumber2* | `int4` |  |  |
> | *flexString2Label* | `str` |  |  |
> | *flexString2* | `str` |  |  |
> | *http_host* | `str` |  |  |
> | *http_server* | `str` |  |  |
> | *http_status* | `str` |  |  |
> | *ifname* | `str` |  |  |
> | *lastupdatetime* | `timestamp` |  |  |
> | *layer_uuid* | `str` |  |  |
> | *layer_name* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *log_id* | `str` |  |  |
> | *memory_consumption* | `str` |  |  |
> | *origin* | `ip4` |  |  |
> | *originsicname* | `str` |  |  |
> | *packet_capture_name* | `str` |  |  |
> | *packet_capture_time* | `timestamp` |  |  |
> | *packet_capture_unique_id* | `str` |  |  |
> | *policy* | `str` |  |  |
> | *policy_time* | `timestamp` |  |  |
> | *precise_error* | `str` |  |  |
> | *product* | `str` |  |  |
> | *proxy_src_ip* | `ip4` |  |  |
> | *referrer* | `str` |  |  |
> | *reject_id_kid* | `str` |  |  |
> | *rule* | `str` |  |  |
> | *rule_name* | `str` |  |  |
> | *rule_uid* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *ser_agent_kid* | `str` |  |  |
> | *server_kid* | `str` |  |  |
> | *session_id* | `str` |  |  |
> | *signature* | `str` |  |  |
> | *smartdefense_profile* | `str` |  |  |
> | *streaming_engine* | `str` |  |  |
> | *sub_policy_name* | `str` |  |  |
> | *sub_policy_uid* | `str` |  |  |
> | *syn_defender* | `str` |  |  |
> | *user_agent* | `str` |  |  |
> | *version* | `str` |  |  |
> | *rawMessage* | `str` |  | **✓** |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.smarteventClient
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *reason* | `str` |  |  |
> | *msg* | `str` |  |  |
> | *dvc* | `ip4` |  |  |
> | *in* | `int8` |  |  |
> | *rt* | `timestamp` |  |  |
> | *out* | `int8` |  |  |
> | *outcome* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *deviceZoneID* | `str` |  |  |
> | *eventAnnotationAuditTrail* | `str` |  |  |
> | *eventAnnotationVersion* | `str` |  |  |
> | *eventAnnotationModificationTime* | `str` |  |  |
> | *art* | `str` |  |  |
> | *originalAgentAddress* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *at* | `str` |  |  |
> | *mrt* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *originalAgentZoneURI* | `str` |  |  |
> | *assetCriticality* | `str` |  |  |
> | *eventAnnotationFlags* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *modelConfidence* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *deviceZoneExternalID* | `str` |  |  |
> | *Severity* | `str` |  |  |
> | *relevance* | `str` |  |  |
> | *av* | `str` |  |  |
> | *eventAnnotationStageUpdateTime* | `str` |  |  |
> | *locality* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *originalAgentVersion* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *originalAgentMacAddress* | `str` |  |  |
> | *originalAgentType* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *originalAgentId* | `str` |  |  |
> | *eventAnnotationManagerReceiptTime* | `str` |  |  |
> | *originalAgentHostName* | `str` |  |  |
> | *priority* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *eventAnnotationEndTime* | `str` |  |  |
> | *product* | `str` |  |  |
> | *origin* | `ip4` |  |  |
> | *sequencenum* | `int4` |  |  |
> | *originsicname* | `str` |  |  |
> | *update_service* | `str` |  |  |
> | *failure_impact* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *version* | `int4` |  |  |
> | *cp_severity* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.systemMonitor
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *act* | `str` |  |  |
> | *app* | `str` |  |  |
> | *cat* | `str` |  |  |
> | *c6a1Label* | `str` |  |  |
> | *c6a1* | `str` |  |  |
> | *c6a2Label* | `str` |  |  |
> | *c6a2* | `str` |  |  |
> | *c6a3Label* | `str` |  |  |
> | *c6a3* | `str` |  |  |
> | *c6a4Label* | `str` |  |  |
> | *c6a4* | `str` |  |  |
> | *cfp1Label* | `str` |  |  |
> | *cfp1* | `float8` |  |  |
> | *cfp2Label* | `str` |  |  |
> | *cfp2* | `float8` |  |  |
> | *cfp3Label* | `str` |  |  |
> | *cfp3* | `float8` |  |  |
> | *cfp4Label* | `str` |  |  |
> | *cfp4* | `float8` |  |  |
> | *cn1Label* | `str` |  |  |
> | *cn1* | `int8` |  |  |
> | *cn2Label* | `str` |  |  |
> | *cn2* | `int8` |  |  |
> | *cn3Label* | `str` |  |  |
> | *cn3* | `int8` |  |  |
> | *cnt* | `int4` |  |  |
> | *cs1Label* | `str` |  |  |
> | *cs1* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *cs3Label* | `str` |  |  |
> | *cs3* | `str` |  |  |
> | *cs4Label* | `str` |  |  |
> | *cs4* | `str` |  |  |
> | *cs5Label* | `str` |  |  |
> | *cs5* | `str` |  |  |
> | *cs6Label* | `str` |  |  |
> | *cs6* | `str` |  |  |
> | *destinationDnsDomain* | `str` |  |  |
> | *destinationServiceName* | `str` |  |  |
> | *destinationTranslatedAddress* | `ip4` |  |  |
> | *destinationTranslatedPort* | `int4` |  |  |
> | *deviceCustomDate1Label* | `str` |  |  |
> | *deviceCustomDate1* | `timestamp` |  |  |
> | *deviceCustomDate2Label* | `str` |  |  |
> | *deviceCustomDate2* | `timestamp` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *deviceDnsDomain* | `str` |  |  |
> | *deviceExternalId* | `str` |  |  |
> | *deviceInboundInterface* | `str` |  |  |
> | *deviceMacAddress* | `str` |  |  |
> | *deviceNtDomain* | `str` |  |  |
> | *deviceOutboundInterface* | `str` |  |  |
> | *deviceProcessName* | `str` |  |  |
> | *deviceTranslatedAddress* | `ip4` |  |  |
> | *dhost* | `str` |  |  |
> | *dmac* | `str` |  |  |
> | *dntdom* | `str` |  |  |
> | *dpid* | `int4` |  |  |
> | *dpriv* | `str` |  |  |
> | *dproc* | `str` |  |  |
> | *dst* | `ip4` |  |  |
> | *duid* | `str` |  |  |
> | *duser* | `str` |  |  |
> | *dvchost* | `str` |  |  |
> | *dvc* | `ip4` |  |  |
> | *dvcpid* | `int4` |  |  |
> | *end* | `timestamp` |  |  |
> | *deviceFacility* | `str` |  |  |
> | *externalId* | `str` |  |  |
> | *fileCreateTime* | `timestamp` |  |  |
> | *fileHash* | `str` |  |  |
> | *fileId* | `str` |  |  |
> | *fileModificationTime* | `timestamp` |  |  |
> | *filePath* | `str` |  |  |
> | *filePermission* | `str` |  |  |
> | *fileType* | `str` |  |  |
> | *fname* | `str` |  |  |
> | *fsize* | `int8` |  |  |
> | *in* | `int8` |  |  |
> | *msg* | `str` |  |  |
> | *sys_message* | `str` |  |  |
> | *oldFileCreateTime* | `timestamp` |  |  |
> | *oldFileHash* | `str` |  |  |
> | *oldFileId* | `str` |  |  |
> | *oldFileModificationTime* | `timestamp` |  |  |
> | *oldFileName* | `str` |  |  |
> | *oldFilePath* | `str` |  |  |
> | *oldFilePermission* | `str` |  |  |
> | *oldFileSize* | `int8` |  |  |
> | *oldFileType* | `str` |  |  |
> | *outcome* | `str` |  |  |
> | *out* | `int8` |  |  |
> | *proto* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *requestClientApplication* | `str` |  |  |
> | *requestCookies* | `str` |  |  |
> | *requestMethod* | `str` |  |  |
> | *request* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *ifname* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *shost* | `str` |  |  |
> | *smac* | `str` |  |  |
> | *sntdom* | `str` |  |  |
> | *sourceDnsDomain* | `str` |  |  |
> | *sourceServiceName* | `str` |  |  |
> | *origin* | `ip4` |  |  |
> | *originsicname* | `str` |  |  |
> | *sourceTranslatedAddress* | `ip4` |  |  |
> | *sourceTranslatedPort* | `int4` |  |  |
> | *spid* | `int4` |  |  |
> | *spriv* | `str` |  |  |
> | *sproc* | `str` |  |  |
> | *spt* | `int4` |  |  |
> | *src* | `ip4` |  |  |
> | *start* | `timestamp` |  |  |
> | *suid* | `str` |  |  |
> | *suser* | `str` |  |  |
> | *catdt* | `str` |  |  |
> | *deviceDomain* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *dpt* | `int4` |  |  |
> | *dtz* | `str` |  |  |
> | *dvcmac* | `str` |  |  |
> | *endTime* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *flexNumber1* | `str` |  |  |
> | *flexNumber1Label* | `str` |  |  |
> | *flexNumber2* | `str` |  |  |
> | *flexNumber2Label* | `str` |  |  |
> | *flexString1* | `str` |  |  |
> | *flexString1Label* | `str` |  |  |
> | *flexString2* | `str` |  |  |
> | *flexString2Label* | `str` |  |  |
> | *modelConfidence* | `int4` |  |  |
> | *priority* | `int4` |  |  |
> | *relevance* | `int4` |  |  |
> | *requestContext* | `str` |  |  |
> | *sessionId* | `str` |  |  |
> | *slat* | `float8` |  |  |
> | *slong* | `float8` |  |  |
> | *dlat* | `float8` |  |  |
> | *dlong* | `float8` |  |  |
> | *sourceGeoCountryCode* | `str` |  |  |
> | *sourceGeoLocationInfo* | `str` |  |  |
> | *sourceGeoPostalCode* | `str` |  |  |
> | *sourceGeoRegionCode* | `str` |  |  |
> | *destinationGeoCountryCode* | `str` |  |  |
> | *destinationGeoLocationInfo* | `str` |  |  |
> | *destinationGeoPostalCode* | `str` |  |  |
> | *destinationGeoRegionCode* | `str` |  |  |
> | *agt* | `ip4` |  |  |
> | *ahost* | `str` |  |  |
> | *art* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *mrt* | `timestamp` |  |  |
> | *categoryBehavior* | `str` |  |  |
> | *categoryCustomFormatField* | `str` |  |  |
> | *categoryDeviceGroup* | `str` |  |  |
> | *categoryObject* | `str` |  |  |
> | *categoryOutcome* | `str` |  |  |
> | *categorySignificance* | `str` |  |  |
> | *categoryTechnique* | `str` |  |  |
> | *categoryTupleDescription* | `str` |  |  |
> | *assetCriticality* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *version* | `str` |  |  |
> | *product* | `str` |  |  |
> | *hostchain* |  |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* |  |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [cef0.checkPoint.threatEmulation](#cef0.checkPoint.threatEmulation)
> - [cef0.checkPoint.urlFiltering](#cef0.checkPoint.urlFiltering)
> - [cef0.checkPoint.vpn1Firewall1](#cef0.checkPoint.vpn1Firewall1)
> - [cef0.checkPoint.vpn1Firewall1AndContentAwareness](#cef0.checkPoint.vpn1Firewall1AndContentAwareness)
> - [cef0.checkPoint.web_api](#cef0.checkPoint.web_api)
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.threatEmulation
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *c6a4Label* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *dvc* | `ip4` |  |  |
> | *deviceFacility* | `str` |  |  |
> | *msg* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *requestClientApplication* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *shost* | `str` |  |  |
> | *src* | `ip4` |  |  |
> | *suser* | `str` |  |  |
> | *ad_additional__info* | `str` |  |  |
> | *ad_client__version* | `str` |  |  |
> | *ad_cp__severity* | `str` |  |  |
> | *ad_event__type* | `str` |  |  |
> | *ad_host__type* | `str` |  |  |
> | *ad_installed__products* | `str` |  |  |
> | *ad_local__time* | `str` |  |  |
> | *ad_loguid* | `str` |  |  |
> | *ad_machine__guid* | `str` |  |  |
> | *ad_origin* | `str` |  |  |
> | *ad_os__name* | `str` |  |  |
> | *ad_os__version* | `str` |  |  |
> | *ad_policy__date* | `str` |  |  |
> | *ad_policy__name* | `str` |  |  |
> | *ad_policy__number* | `str` |  |  |
> | *ad_product* | `str` |  |  |
> | *ad_sequencenum* | `str` |  |  |
> | *ad_user__name* | `str` |  |  |
> | *ad_user__sid* | `str` |  |  |
> | *ad_version* | `str` |  |  |
> | *agentZoneURI* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *art* | `str` |  |  |
> | *at* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *av* | `str` |  |  |
> | *control_log_type* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *geid* | `str` |  |  |
> | *log_id* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *origin* | `str` |  |  |
> | *originsicname* | `str` |  |  |
> | *product* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *sourceZoneURI* | `str` |  |  |
> | *version* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.urlFiltering
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *msg* | `str` |  |  |
> | *dvc* | `ip4` |  |  |
> | *in* | `int8` |  |  |
> | *rt* | `timestamp` |  |  |
> | *out* | `int8` |  |  |
> | *deviceCustomDate2Label* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *deviceZoneID* | `str` |  |  |
> | *eventAnnotationAuditTrail* | `str` |  |  |
> | *eventAnnotationVersion* | `str` |  |  |
> | *eventAnnotationModificationTime* | `str` |  |  |
> | *art* | `str` |  |  |
> | *originalAgentAddress* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *at* | `str` |  |  |
> | *mrt* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *originalAgentZoneURI* | `str` |  |  |
> | *assetCriticality* | `str` |  |  |
> | *eventAnnotationFlags* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *modelConfidence* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *deviceZoneExternalID* | `str` |  |  |
> | *Severity* | `str` |  |  |
> | *relevance* | `str` |  |  |
> | *av* | `str` |  |  |
> | *eventAnnotationStageUpdateTime* | `str` |  |  |
> | *catdt* | `str` |  |  |
> | *locality* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *originalAgentVersion* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *originalAgentMacAddress* | `str` |  |  |
> | *originalAgentType* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *originalAgentId* | `str` |  |  |
> | *eventAnnotationManagerReceiptTime* | `str` |  |  |
> | *originalAgentHostName* | `str` |  |  |
> | *priority* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *eventAnnotationEndTime* | `str` |  |  |
> | *act* | `str` |  |  |
> | *aggregated_log_count* | `int8` |  |  |
> | *alert* | `str` |  |  |
> | *app_category* | `str` |  |  |
> | *app_id* | `str` |  |  |
> | *app_properties* | `str` |  |  |
> | *app* | `str` |  |  |
> | *browse_time* | `str` |  |  |
> | *client_type_os* | `str` |  |  |
> | *bytes* | `int8` |  |  |
> | *certificate_resource* | `str` |  |  |
> | *certificate_validation* | `str` |  |  |
> | *client_inbound_packets* | `int8` |  |  |
> | *client_outbound_packets* | `int8` |  |  |
> | *connection_count* | `int8` |  |  |
> | *conn_direction* | `str` |  |  |
> | *cp_app_risk* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *creation_time* | `timestamp` |  |  |
> | *cs5* | `str` |  |  |
> | *cs5Label* | `str` |  |  |
> | *cs6* | `str` |  |  |
> | *cs6Label* | `str` |  |  |
> | *dpt* | `int4` |  |  |
> | *dst* | `ip4` |  |  |
> | *duration* | `str` |  |  |
> | *flexString1Label* | `str` |  |  |
> | *hll_key* | `str` |  |  |
> | *ifname* | `str` |  |  |
> | *inzone* | `str` |  |  |
> | *last_hit_time* | `timestamp` |  |  |
> | *lastupdatetime* | `timestamp` |  |  |
> | *layer_name* | `str` |  |  |
> | *layer_uuid* | `str` |  |  |
> | *logid* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *match_id* | `str` |  |  |
> | *origin* | `str` |  |  |
> | *originsicname* | `str` |  |  |
> | *outzone* | `str` |  |  |
> | *packets* | `int8` |  |  |
> | *parent_rule* | `str` |  |  |
> | *product* | `str` |  |  |
> | *proto* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *request* | `str` |  |  |
> | *requestClientApplication* | `str` |  |  |
> | *requestMethod* | `str` |  |  |
> | *requestCookies* | `str` |  |  |
> | *rule_action* | `str` |  |  |
> | *rule_uid* | `str` |  |  |
> | *sequencenum* | `int4` |  |  |
> | *server_inbound_bytes* | `int8` |  |  |
> | *server_inbound_packets* | `int8` |  |  |
> | *server_outbound_bytes* | `int8` |  |  |
> | *server_outbound_packets* | `int8` |  |  |
> | *service_id* | `str` |  |  |
> | *sig_id* | `str` |  |  |
> | *spt* | `int4` |  |  |
> | *src* | `ip4` |  |  |
> | *update_count* | `int8` |  |  |
> | *web_server_type* | `str` |  |  |
> | *version* | `str` |  |  |
> | *db_ver* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.vpn1Firewall1
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *act* | `str` |  |  |
> | *app* | `str` |  |  |
> | *cat* | `str` |  |  |
> | *cn1Label* | `str` |  |  |
> | *cn1* | `int8` |  |  |
> | *cn2Label* | `str` |  |  |
> | *cn2* | `int8` |  |  |
> | *cn3Label* | `str` |  |  |
> | *cn3* | `int8` |  |  |
> | *cnt* | `int4` |  |  |
> | *cs1Label* | `str` |  |  |
> | *cs1* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *cs3Label* | `str` |  |  |
> | *cs3* | `str` |  |  |
> | *cs4Label* | `str` |  |  |
> | *cs4* | `str` |  |  |
> | *cs6Label* | `str` |  |  |
> | *cs6* | `str` |  |  |
> | *destinationServiceName* | `str` |  |  |
> | *destinationTranslatedAddress* | `ip4` |  |  |
> | *destinationTranslatedPort* | `int4` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *deviceInboundInterface* | `str` |  |  |
> | *deviceOutboundInterface* | `str` |  |  |
> | *dst* | `ip4` |  |  |
> | *dvc* | `ip4` |  |  |
> | *msg* | `str` |  |  |
> | *proto* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *requestClientApplication* | `str` |  |  |
> | *request* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *sourceTranslatedAddress* | `ip4` |  |  |
> | *sourceTranslatedPort* | `int4` |  |  |
> | *spt* | `int4` |  |  |
> | *src* | `ip4` |  |  |
> | *start* | `timestamp` |  |  |
> | *agt* | `ip4` |  |  |
> | *ahost* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *arcSightEventPath* | `str` |  |  |
> | *art* | `str` |  |  |
> | *assetCriticality* | `int4` |  |  |
> | *at* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *av* | `str` |  |  |
> | *catdt* | `str` |  |  |
> | *categoryBehavior* | `str` |  |  |
> | *categoryDeviceGroup* | `str` |  |  |
> | *categoryObject* | `str` |  |  |
> | *categoryOutcome* | `str` |  |  |
> | *categorySignificance* | `str` |  |  |
> | *customerID* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *destinationAssetId* | `str` |  |  |
> | *destinationGeoCountryCode* | `str` |  |  |
> | *destinationGeoLocationInfo* | `str` |  |  |
> | *destinationGeoPostalCode* | `str` |  |  |
> | *destinationGeoRegionCode* | `str` |  |  |
> | *destinationTranslatedZoneID* | `str` |  |  |
> | *destinationTranslatedZoneURI* | `str` |  |  |
> | *destinationZoneExternalID* | `str` |  |  |
> | *destinationZoneID* | `str` |  |  |
> | *destinationZoneURI* | `str` |  |  |
> | *deviceAssetId* | `str` |  |  |
> | *deviceZoneID* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *dlat* | `float8` |  |  |
> | *dlong* | `float8` |  |  |
> | *dpt* | `int4` |  |  |
> | *dtz* | `str` |  |  |
> | *eventAnnotationAuditTrail* | `str` |  |  |
> | *eventAnnotationEndTime* | `timestamp` |  |  |
> | *eventAnnotationEventId* | `str` |  |  |
> | *eventAnnotationFlags* | `str` |  |  |
> | *eventAnnotationManagerReceiptTime* | `timestamp` |  |  |
> | *eventAnnotationModificationTime* | `timestamp` |  |  |
> | *eventAnnotationStageID* | `str` |  |  |
> | *eventAnnotationStageUpdateTime* | `timestamp` |  |  |
> | *eventAnnotationStageURI* | `str` |  |  |
> | *eventAnnotationVersion* | `int4` |  |  |
> | *eventId* | `str` |  |  |
> | *locality* | `int4` |  |  |
> | *modelConfidence* | `int4` |  |  |
> | *mrt* | `timestamp` |  |  |
> | *priority* | `int4` |  |  |
> | *relevance* | `int4` |  |  |
> | *slat* | `float8` |  |  |
> | *slong* | `float8` |  |  |
> | *sourceAssetId* | `str` |  |  |
> | *sourceGeoCountryCode* | `str` |  |  |
> | *sourceGeoLocationInfo* | `str` |  |  |
> | *sourceGeoPostalCode* | `str` |  |  |
> | *sourceGeoRegionCode* | `str` |  |  |
> | *sourceZoneExternalID* | `str` |  |  |
> | *sourceZoneID* | `str` |  |  |
> | *sourceZoneURI* | `str` |  |  |
> | *type* | `int4` |  |  |
> | *conn_direction* | `str` |  |  |
> | *context_num* | `str` |  |  |
> | *contextnum* | `str` |  |  |
> | *hll_key* | `str` |  |  |
> | *ifname* | `str` |  |  |
> | *inzone* | `str` |  |  |
> | *layer_name* | `str` |  |  |
> | *layer_uuid* | `str` |  |  |
> | *logid* | `str` |  |  |
> | *loguid* | `str` |  |  |
> | *match_id* | `str` |  |  |
> | *nat_addtnl_rulenum* | `str` |  |  |
> | *nat_rulenum* | `str` |  |  |
> | *needs_browse_time* | `str` |  |  |
> | *origin* | `ip4` |  |  |
> | *originsicname* | `str` |  |  |
> | *outzone* | `str` |  |  |
> | *parent_rule* | `str` |  |  |
> | *product* | `str` |  |  |
> | *rule_action* | `str` |  |  |
> | *rule_uid* | `str` |  |  |
> | *sequencenum* | `str` |  |  |
> | *service_id* | `str` |  |  |
> | *sig_id* | `str` |  |  |
> | *version* | `str` |  |  |
> | *action_reason* | `str` |  |  |
> | *aggregated_log_count* | `str` |  |  |
> | *alert* | `str` |  |  |
> | *bytes* | `str` |  |  |
> | *creation_time* | `timestamp` |  |  |
> | *client_inbound_packets* | `str` |  |  |
> | *client_outbound_packets* | `str` |  |  |
> | *cluster_info* | `str` |  |  |
> | *connection_count* | `int4` |  |  |
> | *c_bytes* | `str` |  |  |
> | *dst_domain_name* | `str` |  |  |
> | *duration* | `str` |  |  |
> | *fw_message* | `str` |  |  |
> | *icmp* | `str` |  |  |
> | *in* | `int8` |  |  |
> | *lastupdatetime* | `timestamp` |  |  |
> | *last_hit_time* | `timestamp` |  |  |
> | *last_rematch_time* | `str` |  |  |
> | *log_delay* | `str` |  |  |
> | *nat_rule_uid* | `str` |  |  |
> | *out* | `int8` |  |  |
> | *packets* | `str` |  |  |
> | *precise_error* | `str` |  |  |
> | *proxy_src_ip* | `str` |  |  |
> | *rematch_info* | `str` |  |  |
> | *rpc_prog* | `str` |  |  |
> | *segment_time* | `str` |  |  |
> | *server_inbound_bytes* | `str` |  |  |
> | *server_inbound_interface* | `str` |  |  |
> | *server_inbound_packets* | `str` |  |  |
> | *server_outbound_bytes* | `str` |  |  |
> | *server_outbound_interface* | `str` |  |  |
> | *server_outbound_packets* | `str` |  |  |
> | *src_domain_name* | `str` |  |  |
> | *tcp_packet_out_of_state* | `str` |  |  |
> | *update_count* | `str` |  |  |
> | *cp_severity* | `str` |  |  |
> | *db_ver* | `str` |  |  |
> | *log_id* | `str` |  |  |
> | *rawMessage* | `str` |  | **✓** |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.vpn1Firewall1AndContentAwareness
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *act* | `str` |  |  |
> | *app* | `str` |  |  |
> | *c6a4Label* | `str` |  |  |
> | *cs2Label* | `str` |  |  |
> | *cs2* | `str` |  |  |
> | *destinationTranslatedAddress* | `ip4` |  |  |
> | *destinationTranslatedPort* | `int4` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *dst* | `ip4` |  |  |
> | *dst_domain_name* | `str` |  |  |
> | *dpt* | `int4` |  |  |
> | *dvc* | `ip4` |  |  |
> | *proto* | `str` |  |  |
> | *rt* | `timestamp` |  |  |
> | *shost* | `str` |  |  |
> | *sourceTranslatedAddress* | `ip4` |  |  |
> | *sourceTranslatedPort* | `int4` |  |  |
> | *src* | `ip4` |  |  |
> | *spt* | `int4` |  |  |
> | *ad_conn__direction* | `str` |  |  |
> | *ad_context__num* | `str` |  |  |
> | *ad_contextnum* | `str` |  |  |
> | *ad_hll__key* | `str` |  |  |
> | *ad_https__inspection__action* | `str` |  |  |
> | *ad_ifname* | `str` |  |  |
> | *ad_inzone* | `str` |  |  |
> | *ad_layer__name* | `str` |  |  |
> | *ad_layer__uuid* | `str` |  |  |
> | *ad_logid* | `str` |  |  |
> | *ad_loguid* | `str` |  |  |
> | *ad_match__id* | `str` |  |  |
> | *ad_nat__addtnl__rulenum* | `str` |  |  |
> | *ad_nat__rulenum* | `str` |  |  |
> | *ad_needs__browse__time* | `str` |  |  |
> | *ad_origin* | `str` |  |  |
> | *ad_originsicname* | `str` |  |  |
> | *ad_outzone* | `str` |  |  |
> | *ad_parent__rule* | `str` |  |  |
> | *ad_product* | `str` |  |  |
> | *ad_rule__action* | `str` |  |  |
> | *ad_rule__uid* | `str` |  |  |
> | *ad_sequencenum* | `str` |  |  |
> | *ad_service__id* | `str` |  |  |
> | *ad_sig__id* | `str` |  |  |
> | *ad_unauthorized__sni* | `str` |  |  |
> | *ad_version* | `str` |  |  |
> | *agentZoneURI* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *art* | `str` |  |  |
> | *at* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *av* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *destinationTranslatedZoneURI* | `str` |  |  |
> | *destinationZoneURI* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *geid* | `str` |  |  |
> | *sourceTranslatedZoneURI* | `str` |  |  |
> | *sourceZoneURI* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.web_api
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *priorityCode* | `str` |  |  |
> | *cefTag* | `str` |  |  |
> | *cefVersion* | `str` |  |  |
> | *embDeviceVendor* | `str` |  |  |
> | *embDeviceProduct* | `str` |  |  |
> | *deviceVersion* | `str` |  |  |
> | *signatureID* | `str` |  |  |
> | *name* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *_cefVer* | `str` |  |  |
> | *act* | `str` |  |  |
> | *c6a4Label* | `str` |  |  |
> | *deviceDirection* | `int4` |  |  |
> | *dvc* | `ip4` |  |  |
> | *rt* | `timestamp` |  |  |
> | *sntdom* | `str` |  |  |
> | *src* | `ip4` |  |  |
> | *ad_additional__info* | `str` |  |  |
> | *ad_administrator* | `str` |  |  |
> | *ad_loguid* | `str` |  |  |
> | *ad_operation* | `str` |  |  |
> | *ad_origin* | `str` |  |  |
> | *ad_originsicname* | `str` |  |  |
> | *ad_product* | `str` |  |  |
> | *ad_sendtotrackerasadvancedauditlog* | `str` |  |  |
> | *ad_sequencenum* | `str` |  |  |
> | *ad_session__uid* | `str` |  |  |
> | *ad_subject* | `str` |  |  |
> | *ad_version* | `str` |  |  |
> | *agentZoneURI* | `str` |  |  |
> | *agt* | `str` |  |  |
> | *ahost* | `str` |  |  |
> | *aid* | `str` |  |  |
> | *amac* | `str` |  |  |
> | *art* | `str` |  |  |
> | *at* | `str` |  |  |
> | *atz* | `str` |  |  |
> | *av* | `str` |  |  |
> | *customerURI* | `str` |  |  |
> | *deviceSeverity* | `str` |  |  |
> | *deviceZoneURI* | `str` |  |  |
> | *dtz* | `str` |  |  |
> | *eventId* | `str` |  |  |
> | *geid* | `str` |  |  |
> | *sourceZoneURI* | `str` |  |  |
> | *additional_info* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` | *cefTag* | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [cef0.checkPoint.connectra](#tag_connectra)
> - [cef0.checkPoint.unknown](#tag_unknown)
> 
> ### > Macro (anchor)
> 
>  cef0.checkPoint.connectra
> 
> | **Field** | **Type** | **Source field name** | **Extra Fields** |
> | --- | --- | --- | --- |
> | eventdate | `timestamp` |  |  |
> | hostname | `str` |  |  |
> | priorityCode | `str` |  |  |
> | cefTag | `str` |  |  |
> | cefVersion | `str` |  |  |
> | embDeviceVendor | `str` |  |  |
> | embDeviceProduct | `str` |  |  |
> | deviceVersion | `str` |  |  |
> | signatureID | `str` |  |  |
> | name | `str` |  |  |
> | severity | `str` |  |  |
> | _cefVer | `str` |  |  |
> | dvc | `ip4` |  |  |
> | cs3Label | `str` |  |  |
> | deviceDirection | `int4` |  |  |
> | cs4Label | `str` |  |  |
> | cs3 | `str` |  |  |
> | cs1 | `str` |  |  |
> | cn1Label | `str` |  |  |
> | deviceCustomDate1Label | `str` |  |  |
> | deviceCustomDate2Label | `str` |  |  |
> | cn3Label | `str` |  |  |
> | cat | `str` |  |  |
> | cn2Label | `str` |  |  |
> | rt | `timestamp` |  |  |
> | spt | `int4` |  |  |
> | out | `int8` |  |  |
> | cs2Label | `str` |  |  |
> | cs5Label | `str` |  |  |
> | destinationServiceName | `str` |  |  |
> | cnt | `int4` |  |  |
> | shost | `str` |  |  |
> | src | `ip4` |  |  |
> | act | `str` |  |  |
> | in | `int8` |  |  |
> | protocol | `str` |  |  |
> | cs6Label | `str` |  |  |
> | outcome | `str` |  |  |
> | cs1Label | `str` |  |  |
> | categoryDeviceGroup | `str` |  |  |
> | dtz | `str` |  |  |
> | sourceZoneID | `str` |  |  |
> | slong | `str` |  |  |
> | deviceZoneID | `str` |  |  |
> | sourceGeoRegionCode | `str` |  |  |
> | categoryObject | `str` |  |  |
> | eventAnnotationAuditTrail | `str` |  |  |
> | eventAnnotationVersion | `str` |  |  |
> | eventAnnotationModificationTime | `str` |  |  |
> | art | `str` |  |  |
> | categorySignificance | `str` |  |  |
> | eventId | `str` |  |  |
> | sourceGeoPostalCode | `str` |  |  |
> | dpt | `str` |  |  |
> | originalAgentAddress | `str` |  |  |
> | at | `str` |  |  |
> | mrt | `str` |  |  |
> | customerURI | `str` |  |  |
> | originalAgentZoneURI | `str` |  |  |
> | sourceZoneURI | `str` |  |  |
> | assetCriticality | `str` |  |  |
> | eventAnnotationFlags | `str` |  |  |
> | agt | `str` |  |  |
> | categoryBehavior | `str` |  |  |
> | sourceGeoCountryCode | `str` |  |  |
> | modelConfidence | `str` |  |  |
> | aid | `str` |  |  |
> | amac | `str` |  |  |
> | slat | `str` |  |  |
> | Severity | `str` |  |  |
> | relevance | `str` |  |  |
> | av | `str` |  |  |
> | eventAnnotationStageUpdateTime | `str` |  |  |
> | categoryOutcome | `str` |  |  |
> | catdt | `str` |  |  |
> | locality | `str` |  |  |
> | ahost | `str` |  |  |
> | originalAgentVersion | `str` |  |  |
> | customerID | `str` |  |  |
> | atz | `str` |  |  |
> | originalAgentMacAddress | `str` |  |  |
> | type | `str` |  |  |
> | originalAgentType | `str` |  |  |
> | originalAgentId | `str` |  |  |
> | eventAnnotationManagerReceiptTime | `str` |  |  |
> | originalAgentHostName | `str` |  |  |
> | priority | `str` |  |  |
> | deviceZoneURI | `str` |  |  |
> | eventAnnotationEndTime | `str` |  |  |
> | sourceGeoLocationInfo | `str` |  |  |
> | duser | `str` |  |  |
> | request_client_application | `str` |  |  |
> | source_nt_domain | `str` |  |  |
> | auth_encryption_methods | `str` |  |  |
> | client_build | `str` |  |  |
> | client_version | `str` |  |  |
> | cvpn_category | `str` |  |  |
> | device_identification | `str` |  |  |
> | event_type | `str` |  |  |
> | failed_login_factor_num | `str` |  |  |
> | host_ip | `ip4` |  |  |
> | host_type | `str` |  |  |
> | host_name | `str` |  |  |
> | last_update_time | `timestamp` |  |  |
> | login_option | `str` |  |  |
> | login_timestamp | `str` |  |  |
> | loguid | `str` |  |  |
> | mac_address | `str` |  |  |
> | office_mode_ip | `ip4` |  |  |
> | origin | `str` |  |  |
> | originsicname | `str` |  |  |
> | os_bits | `str` |  |  |
> | os_build | `str` |  |  |
> | os_edition | `str` |  |  |
> | os_name | `str` |  |  |
> | os_version | `str` |  |  |
> | product | `str` |  |  |
> | proxy_src_ip | `ip4` |  |  |
> | sequencenum | `str` |  |  |
> | session_timeout | `str` |  |  |
> | session_uid | `str` |  |  |
> | tunnel_protocol | `str` |  |  |
> | user_dn | `str` |  |  |
> | version | `str` |  |  |
> | hostchain | `str` |  | **✓** |
> | tag | `str` | cefTag | **✓** |
> | rawMessage | `str` |  | **✓** |
> 
> ###  > Macro (anchor)
> 
> cef0.checkPoint.unknown
> 
> | **Field** | **Type** | **Source field name** | **Extra fields** |
> | --- | --- | --- | --- |
> | eventdate | `timestamp` |  |  |
> | hostname | `str` |  |  |
> | priorityCode | `str` |  |  |
> | cefTag | `str` |  |  |
> | cefVersion | `str` |  |  |
> | embDeviceVendor | `str` |  |  |
> | embDeviceProduct | `str` |  |  |
> | deviceVersion | `str` |  |  |
> | signatureID | `str` |  |  |
> | name | `str` |  |  |
> | severity | `str` |  |  |
> | _cefVer | `str` |  |  |
> | deviceDirection | `int4` |  |  |
> | start | `timestamp` |  |  |
> | Severity | `str` |  |  |
> | cnt | `int4` |  |  |
> | dvc | `ip4` |  |  |
> | src | `ip4` |  |  |
> | act | `str` |  |  |
> | in | `int8` |  |  |
> | rt | `timestamp` |  |  |
> | out | `int8` |  |  |
> | dtz | `str` |  |  |
> | sourceZoneID | `str` |  |  |
> | slong | `str` |  |  |
> | deviceZoneID | `str` |  |  |
> | eventAnnotationAuditTrail | `str` |  |  |
> | eventAnnotationVersion | `str` |  |  |
> | eventAnnotationModificationTime | `str` |  |  |
> | art | `str` |  |  |
> | originalAgentAddress | `str` |  |  |
> | eventId | `str` |  |  |
> | at | `str` |  |  |
> | mrt | `str` |  |  |
> | sourceZoneExternalID | `str` |  |  |
> | customerURI | `str` |  |  |
> | originalAgentZoneURI | `str` |  |  |
> | sourceZoneURI | `str` |  |  |
> | assetCriticality | `str` |  |  |
> | eventAnnotationFlags | `str` |  |  |
> | agt | `str` |  |  |
> | modelConfidence | `str` |  |  |
> | aid | `str` |  |  |
> | amac | `str` |  |  |
> | deviceZoneExternalID | `str` |  |  |
> | slat | `str` |  |  |
> | relevance | `str` |  |  |
> | av | `str` |  |  |
> | eventAnnotationStageUpdateTime | `str` |  |  |
> | locality | `str` |  |  |
> | ahost | `str` |  |  |
> | originalAgentVersion | `str` |  |  |
> | customerID | `str` |  |  |
> | atz | `str` |  |  |
> | originalAgentMacAddress | `str` |  |  |
> | type | `str` |  |  |
> | deviceSeverity | `str` |  |  |
> | originalAgentType | `str` |  |  |
> | originalAgentId | `str` |  |  |
> | eventAnnotationManagerReceiptTime | `str` |  |  |
> | originalAgentHostName | `str` |  |  |
> | priority | `str` |  |  |
> | deviceZoneURI | `str` |  |  |
> | eventAnnotationEndTime | `str` |  |  |
> | additional_info | `str` |  |  |
> | audit_status | `str` |  |  |
> | loguid | `str` |  |  |
> | operation | `str` |  |  |
> | operation_number | `str` |  |  |
> | origin | `str` |  |  |
> | originsicname | `str` |  |  |
> | product | `str` |  |  |
> | sequence_number | `str` |  |  |
> | subject | `str` |  |  |
> | version | `str` |  |  |
> | hostchain | `str` |  | **✓** |
> | tag | `str` | cefTag | **✓** |
> | rawMessage | `str` |  | **✓** |