Smarter by Design.Simpler for Business
CEF Format (L7 TCP)
About the Format
CEF (Common Event Format) is the log format that presents the TCP connection information in a SIEM-compatible format for the L7 TCP vServices. It takes place in the Line Format list in the profile form with the CEF Format option.
Unlike the HTTP CEF format, the TCP CEF format has a simpler structure and carries only nine fields: the vService name, the client and frontend addresses, the frontend TLS information and the transferred byte amounts. The request/response headers, the Backend Service address, the WAF information, the timing metrics, the connection termination state (%ts), the connection counters and the queue information are not present in this format. In order to see how the connection ended, Standard or TR7 JSON is used.
Use cases
- SIEM integration (ArcSight, Splunk, QRadar).
- TCP proxy security monitoring.
- Compliance and audit requirements.
Supported Features
HTTP vService
L7 TCP vService
WAF Information
SSL Information (frontend)
Example Log
text
CEF:0|TR7|TR7 ASP|v1.9|TCP|TCP|5|name=LOGTEST-T src=172.16.101.42 srcPort=64657 dst=172.16.102.85 dstPort=8080 fCipher=TLS_AES_128_GCM_SHA256 fProtocol=TLSv1.3 reqUploadBytes=4792 resDownloadBytes=6969CEF Header Structure
text
CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension| Field | Value | Description |
|---|---|---|
| Version | 0 | The CEF format version |
| Device Vendor | TR7 | The manufacturer name |
| Device Product | TR7 ASP | The product name |
| Device Version | v1.9 | The format version. It is fixed; it does not change with the installed TR7 version. |
| Signature ID | TCP | The event type (fixed) |
| Name | TCP | The event name (fixed) |
| Severity | 5 | It is fixed; TR7 does not change this value according to the severity of the event. The 0–10 range that CEF defines is only formal information. |
Extension Fields
Network Information
| Field | Example | Description |
|---|---|---|
name | LOGTEST-T | The vService name; if the name is empty, the vService ID is written |
src | 172.16.101.42 | The client IP address |
srcPort | 64657 | The client source port |
dst | 172.16.102.85 | The Frontend (vService) IP address |
dstPort | 8080 | The Frontend port |
SSL/TLS Information
| Field | Example | Description |
|---|---|---|
fCipher | TLS_AES_128_GCM_SHA256 | The Frontend SSL cipher suite. On a frontend that listens unencrypted, - is written. |
fProtocol | TLSv1.3 | The Frontend SSL/TLS protocol. On a frontend that listens unencrypted, - is written. |
Data Transfer
| Field | Example | Description |
|---|---|---|
reqUploadBytes | 4792 | The bytes received from the client |
resDownloadBytes | 6969 | The bytes sent to the client |
SSL/TLS Cipher Examples
The common cipher suite values:
| Cipher | Protocol | Security |
|---|---|---|
TLS_AES_256_GCM_SHA384 | TLSv1.3 | High |
TLS_AES_128_GCM_SHA256 | TLSv1.3 | High |
TLS_CHACHA20_POLY1305_SHA256 | TLSv1.3 | High |
ECDHE-RSA-AES256-GCM-SHA384 | TLSv1.2 | High |
ECDHE-RSA-AES128-GCM-SHA256 | TLSv1.2 | High |
AES256-GCM-SHA384 | TLSv1.2 | Medium; it does not provide forward secrecy (PFS); on TR7 it is offered only in the old compatibility preset |
- | – | No SSL |
Use Example: SIEM Rules
Detecting a High Data Transfer
text
CEF:0|TR7|TR7 ASP|v1.9|TCP|TCP|5|... resDownloadBytes>10000000The rule: resDownloadBytes > 10000000 (a transfer over 10 MB).
TLS Version Monitoring
text
CEF:0|TR7|TR7 ASP|v1.9|TCP|TCP|5|... fProtocol=TLSv1.1The rule: fProtocol != TLSv1.3 AND fProtocol != TLSv1.2 AND fProtocol != "-" (the use of an old TLS).
WARNING
Without the - exclusion, the rule puts the unencrypted connections into alarm as "old TLS" as well. In addition, on the connections that use TLS 1.0 the field is written not as TLSv1.0 but as TLSv1; the rule must be built according to this value.
The Connections Without SSL
text
CEF:0|TR7|TR7 ASP|v1.9|TCP|TCP|5|... fCipher=- fProtocol=-The rule: fCipher = "-" (an unencrypted connection).
