hmLoadTopic({
hmKeywords:"LEEF event",
hmTitle:"Events exported to LEEF format",
hmDescription:"To filter the event logs sent to Syslog, create a log category notification with a defined filter.",
hmPrevLink:"events-exported-to-json-format.html",
hmNextLink:"events_exported_to_cef_format.html",
hmParentLink:"admin_server_settings_export_to_syslog.html",
hmBreadCrumbs:"<a href=\"using.html\">Using ESET PROTECT On-Prem<\/a> &gt; <a href=\"working_with_era.html\">ESET PROTECT On-Prem Main Menu<\/a> &gt; <a href=\"admin.html\">More<\/a> &gt; <a href=\"admin_server_settings_export_to_syslog.html\">Export logs to Syslog<\/a>",
hmTitlePath:"Using ESET PROTECT On-Prem > ESET PROTECT On-Prem Main Menu > More > Export logs to Syslog > Events exported to LEEF format",
hmHeader:"<h1 class=\"p_Heading1\"><span class=\"f_Heading1\">Events exported to LEEF format<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_Normal\">To filter the event logs sent to Syslog, <a href=\"admin_notif_events_on.html\" class=\"topiclink\">create a log category notification<\/a> with a defined filter.<\/p>\n\r<p class=\"p_Normal\">LEEF format is a customized event format for IBM® Security QRadar®. Events have standard and custom attributes:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">ESET PROTECT On-Prem uses some of standard attributes described in <a href=\"https:\/\/www.ibm.com\/docs\/en\/dsm?topic=overview-predefined-leef-event-attributes\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">official IBM documentation<\/a>.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><a href=\"events-exported-to-json-format.html#custom_keys\" class=\"topiclink\">Custom attributes<\/a> are the same as in JSON format. The deviceGroupName attribute contains the full path to the static group of the computer generating the event. If the path is longer than 255 characters, deviceGroupName contains only the static group name. The deviceOSName attribute contains information about the computer´s operating system, and the deviceGroupDescription attribute contains the static group description.<\/p>\n\r<p class=\"p_Normal\">Event categories:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><img alt=\"Antivirus detections\" title=\"Antivirus detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_antivirus.png\"\/><span class=\"f_NormalList\">Antivirus detections<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><img alt=\"Firewall detections\" title=\"Firewall detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_firewall.png\"\/><span class=\"f_NormalList\"> Firewall<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">Filtered websites—<img alt=\"Web Protection detections\" title=\"Web Protection detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_web_protection.png\"\/> Web Protection<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><img alt=\"HIPS detections\" title=\"HIPS detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_hips.png\"\/><span class=\"f_NormalList\"> HIPS<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\"><a href=\"audit_log.html\" class=\"topiclink\">Audit<\/a><\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><img alt=\"ESET Inspect alerts\" title=\"ESET Inspect alerts\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_ei_alert.png\"\/><span class=\"f_NormalList\"> <a href=\"eset_inspect.html\" class=\"topiclink\">ESET Inspect Alerts<\/a><\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><img alt=\"Blocked files\" title=\"Blocked files\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_blocked.png\"\/> <a href=\"eset_inspect.html#blocked_files\" class=\"topiclink\">Blocked files<\/a><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\">You can find more information about Log Event Extended Format (LEEF) on the <a href=\"https:\/\/www.ibm.com\/docs\/en\/SS42VS_DSM\/pdf\/b_Leef_format_guide.pdf\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">official IBM website<\/a>.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r"
})
