--- title: CEF fields description: Module for receiving CEF logs over Syslog. The module adds vendor specific fields in addition to the fields the decode_cef processor provides. Fields... url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/beats/filebeat/exported-fields-cef-module products: - Beats - Filebeat applies_to: - Elastic Cloud Serverless: Generally available - Elastic Stack: Generally available --- # CEF fields Module for receiving CEF logs over Syslog. The module adds vendor specific fields in addition to the fields the decode_cef processor provides. ## forcepoint Fields for Forcepoint Custom String mappings Virus ID type: keyword ## checkpoint Fields for Check Point custom string mappings. Application risk. type: keyword Application threat severity. type: keyword The signature ID which the application was detected by. type: keyword Password authentication protocol used. type: keyword Category. type: keyword Confidence level determined. type: integer Connectivity state. type: keyword IKE cookie. type: keyword Destination IP-Phone. type: keyword Engine name. type: keyword Internal email ID. type: keyword Number of recipients. type: long Internal email session ID. type: keyword Internal email spool ID. type: keyword Email subject. type: keyword Number of events associated with the log. type: long Scan frequency. type: keyword ICMP type. type: long ICMP code. type: long Identity type. type: keyword Format of original data. type: keyword Scan invoke type. type: keyword Malware family. type: keyword Main IP of the peer Security Gateway. type: ip Protection performance impact. type: integer Protection malware ID. type: keyword Specific signature name of the attack. type: keyword Type of protection used to detect the attack. type: keyword Scan result. type: keyword Sensor mode. type: keyword Threat severity. type: keyword Spyware name. type: keyword Spyware status. type: keyword The expiration date of the subscription. type: date TCP packet flags. type: keyword Termination reason. type: keyword Update status. type: keyword User response. type: keyword External ID. type: keyword Virus name. type: keyword VoIP log types. type: keyword ## cef.extensions Extra vendor-specific extensions. type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword type: keyword