CEF:0|${deviceVendor}|${deviceProduct}|${deviceVersion}|${name}|${severity}| externalId=${meta.sessionid} service=${meta.service} proto=${meta.ip.proto} act=${meta.action} src=${meta.ip.src} spt=${meta.tcp.srcport} dhost=${meta.alias.host} dst=${meta.ip.dst} dpt=${meta.ip.dstport} duser=${meta.user.dst} suser=${meta.user.src} cs1=${meta.did} requestClientApplication=${meta.client} cs1Label=DecoderName request=${meta.referer} cs5Label=QueryString cs5=${meta.query} cs6Label=UDPDestinationPort cs6=${meta.udp.dstport} fsize=${meta.size} fileType=${meta.extension} fname=${meta.filename} filePath=${meta.directory}
