---
title: "cef0.cyberark"
canonical: "https://docs.devo.com/space/latest/95125581/cef0.cyberark"
format: markdown
---
> Macro (toc)

> ℹ️ Check the reference vendor documentation [here](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PTA/CEF-Based-Format-Definition.htm).

## Introduction

The tags beginning with `cef0.cyberark` identify events in CEF format generated by [CrowdStrike Falcon Host](https://access.redhat.com/ecosystem/software/2857931).

## Tag structure

<span style="color: #282828">Events in CEF format don't have a specific tag structure, as explained in </span><span style="color: #282828">[Technologies supported in CEF syslog format](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94666383)</span><span style="color: #282828">. They are always sent to a table with the structure </span><span style="color: #282828">**cef0.**</span><span style="color: #282828">*deviceVendor*</span><span style="color: #282828">.</span><span style="color: #282828">*deviceProduct*</span><span style="color: #282828">.</span>

In this case, the valid data tables are:

| **Tags** | **Data tables** |
| --- | --- |
| `cef0.cyberark.pta` | `cef0.cyberark.pta` |
| `cef0.cyberark.vault` | `cef0.cyberark.vault` |

## <span style="color: #282828">How is the data sent to Devo?</span>

CEF data can be sent directly to Devo or by using a relay. To use the [CEF default relay rule](https://docs.devo.com/space/latest/96469422/The+4+predefined+relay+rules), send to the relay’s port **13000**. Learn more about CEF syslog format and how Devo tags these events in [Technologies supported in CEF syslog format](https://docs.devo.com/space/latest/94666383/Technologies+supported+in+CEF+syslog+format).

## Relay rules

If you are sending the data to Devo through a relay, define the following relay rule to send the events properly to the `cef0.cyberArk.vault` table:

| **Source port** | Use your required port. |
| --- | --- |
| **Source data** | `^.+CEF:(.+)$` |
| **Target tag** | `CEF` |
| **Target message** | `\\D1` |
| **Stop processing** | **✓** |

Learn how to define new relay rules in [this article.](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96469377) 

## Table structure

These are the fields displayed in these tables:

### cef0.cyberark.vault

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *hostname* | `str` |  |  |
| *priorityCode* | `str` |  |  |
| *cefTag* | `str` |  |  |
| *cefVersion* | `str` |  |  |
| *embDeviceVendor* | `str` |  |  |
| *embDeviceProduct* | `str` |  |  |
| *deviceVersion* | `str` |  |  |
| *signatureID* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *_cefVer* | `str` |  |  |
| *act* | `str` |  |  |
| *app* | `str` |  |  |
| *cn1Label* | `str` |  |  |
| *cn1* | `str` |  |  |
| *cn2Label* | `str` |  |  |
| *cn2* | `str` |  |  |
| *cs1Label* | `str` |  |  |
| *cs1* | `str` |  |  |
| *cs2Label* | `str` |  |  |
| *cs2* | `str` |  |  |
| *cs3Label* | `str` |  |  |
| *cs3* | `str` |  |  |
| *cs4Label* | `str` |  |  |
| *cs4* | `str` |  |  |
| *cs5Label* | `str` |  |  |
| *cs5* | `str` |  |  |
| *dhost* | `str` |  |  |
| *duser* | `str` |  |  |
| *dvc* | `ip4` |  |  |
| *externalId* | `str` |  |  |
| *fname* | `str` |  |  |
| *msg* | `str` |  |  |
| *reason* | `str` |  |  |
| *shost* | `str` |  |  |
| *suser* | `str` |  |  |
| *eventId* | `str` |  |  |
| *categorySignificance* | `str` |  |  |
| *categoryBehavior* | `str` |  |  |
| *categoryDeviceGroup* | `str` |  |  |
| *catdt* | `str` |  |  |
| *categoryOutcome* | `str` |  |  |
| *categoryObject* | `str` |  |  |
| *art* | `str` |  |  |
| *rt* | `timestamp` |  |  |
| *src* | `ip4` |  |  |
| *sourceZoneURI* | `str` |  |  |
| *ahost* | `str` |  |  |
| *agt* | `str` |  |  |
| *agentZoneURI* | `str` |  |  |
| *amac* | `str` |  |  |
| *av* | `str` |  |  |
| *atz* | `str` |  |  |
| *at* | `str` |  |  |
| *deviceZoneURI* | `str` |  |  |
| *dtz* | `str` |  |  |
| *msg_date* | `str` |  |  |
| *msg_eventname* | `str` |  |  |
| *msg_eventid* | `str` |  |  |
| *msg_targetaccount* | `str` |  |  |
| *msg_targetaddress* | `str` |  |  |
| *msg_sourceaddress* | `str` |  |  |
| *msg_auditid* | `str` |  |  |
| *msg_score* | `str` |  |  |
| *rawMessage* | `str` |  | **✓** |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` | *cefTag* | **✓** |

### cef0.cyberark.pta

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *hostname* | `str` |  |  |
| *priority_code* | `str` |  |  |
| *cef_tag* | `str` |  |  |
| *cef_version* | `str` |  |  |
| *emb_device_vendor* | `str` |  |  |
| *emb_device_product* | `str` |  |  |
| *device_version* | `str` |  |  |
| *signature_id* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *device_custom_string_1_label* | `str` |  |  |
| *device_custom_string_1* | `str` |  |  |
| *device_custom_string_2_label* | `str` |  |  |
| *device_custom_string_2* | `str` |  |  |
| *device_custom_string_3_label* | `str` |  |  |
| *device_custom_string_3* | `str` |  |  |
| *device_custom_string_4_label* | `str` |  |  |
| *device_custom_string_4* | `str` |  |  |
| *device_custom_date_1_label* | `str` |  |  |
| *device_custom_date_1* | `timestamp` |  |  |
| *destination_hostname* | `str` |  |  |
| *destination_ip* | `ip4` |  |  |
| *destination_username* | `str` |  |  |
| *source_hostname* | `str` |  |  |
| *source_ip* | `ip4` |  |  |
| *source_username* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` | *cef_tag* | **✓** |
| *rawMessage* | `str` |  | **✓** |