I am trying to configure CEF formatted logs in 4.6. Even though i configured data source as Arcsight (CEF) device, in logs its showing me "ArcSight CEF? False" and arcsight pre-processor is not getting called.

Is there any other file where we need to configure this in 4.6.

asked 18 Sep '14, 01:23

Praful's gravatar image

Praful ♦♦
accept rate: 5%

In 4.6 , there is no dependency on the resource type, Its present in more setting under Step 2


answered 18 Sep '14, 01:24

Praful's gravatar image

Praful ♦♦
accept rate: 5%

Also you can specify custom diff config files for different resource types that have data coming in the CEF format. No longer restricted to just arc sight resource.


answered 15 Oct '14, 14:20

anjan's gravatar image

anjan ♦♦
accept rate: 22%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported



Asked: 18 Sep '14, 01:23

Seen: 1,026 times

Last updated: 15 Oct '14, 14:20