Glossary Term

Common Event Format (CEF)

A structured text format used to represent security events as a standard header followed by extension fields that SIEM platforms can parse.

Definition

Common Event Format is a structured event format originally associated with ArcSight. Security products and forwarding tools use CEF to represent vendor, product, event, severity, and extension fields in a predictable shape.

CEF can make IBM i records easier for a SIEM to parse, but format alone does not create useful context. The mapping still needs correct IBM i users, objects, libraries, jobs, timestamps, entry types, results, and any fields required to verify the original record.

Example

An IBM i log forwarder may transform a QAUDJRN authority failure into CEF before sending it to a SIEM that already understands CEF fields.