CEF Serialization in Cribl Stream

The CEF Serializer page in the Cribl Stream documentation describes a Function that takes a list of fields and/or values, and formats them in the Common Event Format (CEF) standard. This post walks through the format the page defines, the function-level settings and field definitions it exposes, the worked example it gives, and the constraints the docs flag, all from that single page.

CEF in one paragraph

The page defines the format in two sentences. CEF defines a syntax for log records, and a record is composed of a standard prefix, and a variable extension formatted as a series of key-value pairs. Nothing else on the page elaborates the grammar: the format documentation is a single syntax line plus the two field groups that fill it.

That syntax line, copied from the CEF Serializer documentation, is:

CEF:Version|Device Vendor|Device Product|Device Version|Device Event Class ID|Name|Severity|[Extension]

The prefix is the chain of seven pipe-delimited header values, and the bracketed [Extension] slot closes the record. The page prints no escape rules, length limits, or alternate prefixes; the single bracket is the only variation the syntax line allows. The page's Header Fields section names the seven header fields in the same order the line lists Version, Device Vendor, Device Product, Device Version, Device Event Class ID, Name, and Severity: cef_version, device_vendor, device_product, device_version, device_event_class_id, name, and severity. Every position on the line has a matching entry in that section, so the order of the line is the order the values are written. The extension that follows the prefix is where the key-value pairs are written.

The serializer function

The Usage section of the CEF Serializer function page documents four function-level settings, and the page gives a default for each of the four:

• Filter: Filter expression (JavaScript) that selects data to feed through the Function. Defaults to true, meaning it evaluates all events.
• Description: Simple description about this Function. Defaults to empty.
• Final: Toggle on to stop feeding data to the downstream Functions. Default is toggled off.
• Output field: The field to which the CEF formatted event will be output. Nested addressing supported. Defaults to _raw.

The Output field setting is the only one of the four that decides where the finished record shows up. The CEF formatted event is written to whatever field you name, and the page notes that nested addressing is supported, so the serialized string does not have to live at a top-level field. Until you change it, that location is _raw.

Under the function-level settings, the page defines the two field groups that make up the record. The Header Fields are the CEF Header field definitions, and the page states that the field values will be written pipe (|)-delimited in the Output Field, that names cannot be changed, and that values can be computed with a JavaScript expression, or can be constants. The seven fields and their documented defaults, as the page spells them:

• cef_version: Defaults to CEF:0.
• device_vendor: Defaults to Cribl.
• device_product: Defaults to Cribl.
• device_version: Defaults to C.version.
• device_event_class_id: Defaults to 420.
• name: Defaults to Cribl Event.
• severity: Defaults to 6.

The Extension Fields are the CEF Extension field definitions. Field names and values will be written in key=value format, you select each field's Name from the drop-down list, and each value can be computed with a JavaScript expression, or can be constants. The split between the two groups is deliberate in the page's wording: header names are fixed, while extension names are the ones you pick from the list. The page does not enumerate the extension names themselves; the format rule and the drop-down list are all it gives for that group.

Where to use it

The page's usage guidance sits in its Example section, and it is scoped to how values get supplied. For each CEF field, allowed values include strings, plus any custom Cribl function. To show a custom function in that role, the page works through a lookup as the value expression for the Name field, copied from the CEF Serializer page:

Name: Name
Value expression: C.Lookup('lookup-exact.csv', 'foo').match('abc', 'bar')

The page adds that this can be used for any of the CEF Header Fields, and it pairs the example with a screenshot of the function's fields. That is the full extent of the guidance the page gives on computing values.

The example then turns to the output side. For an Output field set to _CEF_out, the page states that the resulting event has the following structure, copied from the CEF Serializer page:

_CEF_out:CEF:0|Cribl|Cribl|42.0-61c12259|420|Business Group 6|6|c6a1Label=Colorado_Ext_Bldg7

Read against the format line, the first seven pipe-delimited values are the prefix, and the trailing c6a1Label=Colorado_Ext_Bldg7 is the extension in the key-value format the definition states. The page does not document what fills each prefix position in that example, so this post does not assign one either.

Beyond computed values and a named output field, the page gives no placement guidance for the CEF Serializer in a pipeline, and it shows no examples beyond the lookup and the resulting event.

What the docs flag

The page repeats a handful of constraints worth carrying into your configuration:

• Header names are fixed. The page states that header field names cannot be changed; only the values are configurable, as constants or JavaScript expressions.
• The Output field defaults to _raw. The CEF formatted event is written to whatever field the Output field names, and nested addressing is supported. The page's example uses _CEF_out instead of the default.
• Filter and Final default to pass-through. Filter defaults to true, so it evaluates all events until you give it a JavaScript expression. Final defaults to toggled off, so data keeps feeding downstream Functions until you toggle it on.
• One default is an expression, not a constant. device_version defaults to C.version, while the other six header defaults are constant values: CEF:0, Cribl, Cribl, 420, Cribl Event, and 6.

The page also stays quiet on consumers: it does not name a downstream tool or destination that expects the formatted output. Everything it commits to is on the producing side. One syntax line, four function-level settings, seven header fields with fixed names and documented defaults, extension fields governed by the key-value rule, and one worked example covering a computed value and a non-default output field: that is the full scope of the CEF Serializer documentation this post draws on.

Frequently asked questions

What does the CEF Serializer function in Cribl Stream do?

It takes a list of fields and/or values, and formats them in the Common Event Format (CEF) standard. The docs page defines CEF as a syntax for log records composed of a standard prefix and a variable extension formatted as a series of key-value pairs. The formatted event is written to the function's Output field, which defaults to _raw.

What header fields does the Cribl Stream CEF Serializer function document?

The page defines seven, each with a default: cef_version at CEF:0, device_vendor at Cribl, device_product at Cribl, device_version at C.version, device_event_class_id at 420, name at Cribl Event, and severity at 6. Their values are written pipe-delimited in the Output field, and the field names cannot be changed.

How are extension fields written by the Cribl Stream CEF Serializer function?

Extension field names and values are written in key=value format in the output event. Each field's Name is selected from a drop-down list, and each value can be computed with a JavaScript expression or can be a constant. The page's example result ends with c6a1Label=Colorado_Ext_Bldg7 in that trailing position.

Can header values in the Cribl Stream CEF Serializer function come from lookups or other custom functions?

Yes. The page states that for each CEF field, allowed values include strings, plus any custom Cribl function. Its example sets the Name field to C.Lookup('lookup-exact.csv', 'foo').match('abc', 'bar'), and notes this can be used for any of the CEF Header Fields.