CEF Format (HTTP)

About the Format

CEF (Common Event Format) is a standard log format developed by ArcSight and widely used in the security sector. It takes place in the Line Format list in the profile form with the CEF Format option.

The TR7 CEF format presents all the details of the HTTP requests in a structured format that the SIEM systems can parse easily. When the WAF profile is active, the attack information is also added to the logs.

Use cases

• SIEM integration (ArcSight, Splunk, QRadar, etc.).
• Security event monitoring (SOC).
• Compliance and audit requirements.
• WAF event correlation.

Supported Features

HTTP vService

L7 TCP vService

WAF Information

SSL Information

INFO

When the same CEF Format option is assigned to an L7 TCP vService, it produces a much shorter, connection-level line; its fields and example are on the CEF (L7 TCP) page.

Example Log (WAF Disabled)

CEF:0|TR7|TR7 ASP|v1.9|200|DBE|5|name=LOGTEST-H src=172.16.101.42 srcPort=59654 dst=172.16.102.85 dstPort=443 serverIP=172.16.102.168 serverPort=80 fCipher=TLS_AES_128_GCM_SHA256 fProtocol=TLSv1.3 sCipher=- sProtocol=- reqMethod=GET reqBase=/login.php reqQuery= reqProtocol=HTTP/1.1 reqHost=test.tr7.com reqUA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 reqHeaders=host: test.tr7.com\r\ncache-control: max-age\=0\r\nsec-ch-ua: \"Chromium\";v\=\"152\", \"Not?A_Brand\";v\=\"24\", \"Google Chrome\";v\=\"152\"\r\nsec-ch-ua-mobile: ?0\r\nsec-ch-ua-platform: \"Windows\"\r\nupgrade-insecure-requests: 1\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/152.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q\=0.9,image\/avif,image\/webp,image\/apng,*\/*;q\=0.8,application\/signed-exchange;v\=b3;q\=0.7\r\nsec-fetch-site: none\r\nsec-fetch-mode: navigate\r\nsec-fetch-user: ?1\r\nsec-fetch-dest: document\r\naccept-encoding: gzip, deflate, br, zstd\r\naccept-language: en-US,en;q\=0.9\r\n\r\n resHeaders=date: Wed, 09 Sep 2026 17:41:24 GMT\r\nserver: Apache\/2.4.59 (Debian)\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 824\r\ncontent-type: text\/html; charset\=UTF-8\r\n\r\n reqUploadBytes=632 resDownloadBytes=1011 username=- isWafAttack=- wafInfo={}

Example Log (WAF Block)

CEF:0|TR7|TR7 ASP|v1.9|418|TR7|5|name=LOGTEST-H src=172.16.101.42 srcPort=54983 dst=172.16.102.85 dstPort=443 serverIP=- serverPort=- fCipher=TLS_AES_128_GCM_SHA256 fProtocol=TLSv1.3 sCipher=- sProtocol=- reqMethod=GET reqBase=/cmd.exe reqQuery= reqProtocol=HTTP/1.1 reqHost=test.tr7.com reqUA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 reqHeaders=host: test.tr7.com\r\ncache-control: max-age\=0\r\nsec-ch-ua: \"Chromium\";v\=\"152\", \"Not?A_Brand\";v\=\"24\", \"Google Chrome\";v\=\"152\"\r\nsec-ch-ua-mobile: ?0\r\nsec-ch-ua-platform: \"Windows\"\r\nupgrade-insecure-requests: 1\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/152.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q\=0.9,image\/avif,image\/webp,image\/apng,*\/*;q\=0.8,application\/signed-exchange;v\=b3;q\=0.7\r\nsec-fetch-site: none\r\nsec-fetch-mode: navigate\r\nsec-fetch-user: ?1\r\nsec-fetch-dest: document\r\naccept-encoding: gzip, deflate, br, zstd\r\naccept-language: en-US,en;q\=0.9\r\n\r\n resHeaders=- reqUploadBytes=630 resDownloadBytes=0 username=- isWafAttack=1 wafInfo={"attacks":[{"scope":"path","payload":"\/cmd.exe","id":130005,"monitor":false,"score":8}],"uid":"AC10652A:D6C76AA19A96:A10044","totalScore":8,"wafTime":1.651,"action":"block"}

CEF Header Structure

CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension

Field	Value	Description
Version	0	The CEF format version
Device Vendor	TR7	The manufacturer name
Device Product	TR7 ASP	The product name
Device Version	v1.9	The format version. It is fixed; it does not change with the installed TR7 version.
Signature ID	200 · 418	The HTTP response status code. In a WAF block, the blocking code in the WAF profile is written (default 418).
Name	DBE · TR7	The source of the response (its values are in the table below)
Severity	5	It is fixed; TR7 does not change this value according to the severity of the event. The 0–10 range that CEF defines is only formal information.

Extension Fields

Network Information

Field	Example	Description
name	LOGTEST-H	The vService name
src	172.16.101.42	The client IP address
srcPort	59654	The client source port
dst	172.16.102.85	The Frontend (vService) IP address
dstPort	443	The Frontend port
serverIP	172.16.102.168	The Backend Service IP address. If the request never reached the Backend Service (such as a WAF block), - is written.
serverPort	80	The Backend Service port. If the request never reached the Backend Service, - is written.

SSL/TLS Information

Field	Example	Description
fCipher	TLS_AES_128_GCM_SHA256	The Frontend SSL cipher
fProtocol	TLSv1.3	The Frontend SSL protocol
sCipher	-	The Backend Service SSL cipher. When the connection to the Backend Service is made unencrypted, - is written.
sProtocol	-	The Backend Service SSL protocol. When the connection to the Backend Service is made unencrypted, - is written.

HTTP Request Information

Field	Example	Description
reqMethod	GET	The HTTP method
reqBase	/login.php	The request path
reqQuery	(empty)	The query string. When there is no query in the request, the field is written without a value in the reqQuery= form; both example logs are in this situation.
reqProtocol	HTTP/1.1	The HTTP protocol version
reqHost	test.tr7.com	The value of the Host header
reqUA	Mozilla/5.0 (Windows NT 10.0; ...	User-Agent
reqHeaders	host: test.tr7.com\r\n...	The request headers; at most 4096 bytes are captured, the excess is cut
resHeaders	date: Wed, 09 Sep 2026 ...	The response headers; at most 4096 bytes are captured. In the responses that TR7 produces itself (such as a WAF block), - is written.

Escaping

In the reqHost, reqUA, reqHeaders, resHeaders and wafInfo fields the value is encoded as JSON: the line endings are escaped in the \r\n, the slash in the \/ and the equals sign in the \= form. The max-age\=0 and charset\=UTF-8 in the example log are because of this. This escaping is not applied to the reqBase, reqQuery, reqMethod, username and name fields; the values that contain = in them (especially the query string) can shift the field boundary in strict CEF parsers.

Size and Identity Information

Field	Example	Description
reqUploadBytes	632	The request size (bytes)
resDownloadBytes	1011	The size of the response read from the Backend Service (bytes); the response headers are also included. In a WAF block it is 0 because the request never reached the Backend Service; even if the blocking page is sent to the client.
username	-	The authenticated user; if authentication is not used, -

WAF Information

Field	Example	Description
isWafAttack	1	Whether the request was blocked by the WAF or not. When an attack is detected and only monitored (monitor), or in the traffic within the scope of the false positive cleaner, this field does not become 1.
wafInfo	{...}	The WAF event details (JSON); if there is no attack, {}

isWafAttack does not mean "is there an attack"

The field becomes 1 only when blocking takes place. In monitor mode or when a rule in monitoring mode matches, wafInfo comes filled ("action":"monitor") but isWafAttack does not become 1. In order to understand whether there is an attack or not, whether the wafInfo field is empty ({}) or not is looked at.

WAF Info Structure

When the WAF does not detect an attack, the wafInfo field is written as an empty object ({}). When an attack is detected, it carries the details in JSON form:

{
  "attacks": [
    { "scope": "path", "payload": "/cmd.exe", "id": 130005, "monitor": false, "score": 8 }
  ],
  "uid": "AC10652A:D6C76AA19A96:A10044",
  "totalScore": 8,
  "wafTime": 1.651,
  "action": "block"
}

Field	Description
attacks	The list of the detected matches. As more than one rule can match in the same request, the same rule can enter the list more than once as well.
attacks[].scope	The component in which the attack was detected: path · query · header · form · json · xml · raw
attacks[].payload	The detected malicious content. If the rule does not produce a payload, the description of the rule is written instead; it can be turned off completely from the WAF profile.
attacks[].id	The WAF rule ID. It is the only field printed unconditionally.
attacks[].monitor	The state of the rule itself: if true, the score of this rule is not included in the total. On its own it does not show whether the request was blocked or not.
attacks[].score	The rule score
uid	The unique event identifier
totalScore	The score total of only the matches that are monitor: false. The rules in monitoring mode appear in the list with their real scores but are not included in the total; in learning mode the total remains 0.
wafTime	The CPU time that the WAF spent on the request (ms)
action	The applied action: block (blocked) · monitor (only recorded) · fpc (within the scope of the false positive cleaner)

INFO

The order of the fields is not fixed; while the JSON is being parsed, it must be read according to the key name. The score, scope, monitor and payload fields depend on the log field selection in the WAF profile and can be turned off; in addition, severity and the rule meta information (name, desc, category, cwe, mitre, capec, owaspWeb, owaspApi, target) can be added.

The WAF timeout record does not carry the schema

When the WAF scan times out, TR7 produces a synthetic record: totalScore 100, a single attacks entry (id 369999) and wafTime 2000. In this record the uid and action fields are not present, and isWafAttack becomes 1 without a real attack. The parsers that assume a fixed schema give an error on this line.

Name Field (Response Source)

Value	Description
DBE	The response came from the default Backend Service group
be-<group>	The response came from a Backend Service group selected with conditional routing
TR7	TR7 produced the response (WAF block, error page, cache)
ags_daemon	The response came from the AGS portal

The values change when the report is on

If a Reports profile is assigned to the vService, the responses that TR7 produces itself are stamped with the values that name the source: WAF in a WAF block, SSL_REDIRECT in an HTTPS redirect. The same WAF block produces TR7 while the report is off and WAF while the report is on.