Understanding CEF format for Harmony Mobile

Devavrat — Tue, 23 Aug 2022 08:40:17 GMT

Hey Folks,

I am working on building a parser for one of the SIEM, and we are going to support CheckPoint Harmony Mobile.

I have few queries regarding this:

1. I could not find ArcSight format on the community or in the docs. Can someone provide the exact CEF log reference guide or fields explanation. I could find a post about syslog format, but I'm looking for CEF format.
2. Can I get sample CEF logs somewhere in the docs or community for network protection feature like phishing, URL filtering, file protection, anti bot etc?
3. I am getting little bit confused in Harmony Mobile and Sandblast Cloud for office 365. Is it the same product or feature which you can integrate with Harmony Mobile or a separate product?

Thank you in advance!

Re: Understanding CEF format for Harmony Mobile

Chris_Atkinson — Tue, 23 Aug 2022 12:10:37 GMT

Harmony Mobile and Sandblast Cloud (email) are certainly different solutions.

sk144192 is generally the go to for log field descriptions

Re: Understanding CEF format for Harmony Mobile

Devavrat — Tue, 23 Aug 2022 13:20:27 GMT

Thank you for the response

topic Understanding CEF format for Harmony Mobile in Mobile

Understanding CEF format for Harmony Mobile

Re: Understanding CEF format for Harmony Mobile

Re: Understanding CEF format for Harmony Mobile