CEF transformed events:

Oct 22 2018 13:44:25 CEF:0|RSA|NetWitness JsonTest Log Collector|0|jsontest|jsontest|8|time=2017-07-20T05:00:30.3860000Z severity=8 cat=NetworkSecurityGroupFlowEvent act=Add rule=DefaultRule_DenyAllInBound rule=UserRule_Allow-All-From-Pontus rule=UserRule_PontusAll

Oct 22 2018 13:44:25 CEF:0|RSA|NetWitness JsonTest Log Collector|0|jsontest|jsontest|5|time=2017-07-20T05:00:29.0430000Z severity=5 cat=NetworkSecurityGroupFlowEvent act=Delete rule=DefaultRule_DenyAllInBound rule=UserRule_Allow-All-From-Pontus rule=UserRule_PontusAll

Oct 22 2018 13:44:25 CEF:0|RSA|NetWitness JsonTest Log Collector|0|jsontest|jsontest|2|time=2017-07-20T05:00:35.6120000Z severity=2 cat=NetworkSecurityGroupFlowEvent act=Update rule=DefaultRule_DenyAllInBound rule=UserRule_Allow-All-From-Pontus rule=UserRule_PontusAll rule=UserRule_default-allow-ssh-Pontus