&lt;#include "macros.ftl"/&gt;CEF:0|RSA|Security Analytics ESA|10.6.0|${statement}|${moduleName}|${severity}|rt=${time?datetime} id=${id} source=${eventSourceId}&lt;#list events as x&gt; sessionid=${x.sessionid!" "}  service=${x.service!" "} protocol=${x.protocol!" "} src=${x.ip_src!" "} dst=${x.ip_dst!" "} hostname=&lt;#if x.alias_host?has_content&gt;&lt;@value_of x.alias_host /&gt;&lt;/#if&gt; dport=${x.ip_dstport!" "} duser=${x.user_dst!" "}  suser=${x.user_src!" "} userGroup=${x.group!" "} fname=${x.filename!" "} &lt;/#list&gt;
