120
MDS Orbit MCR-4G Technical Manual
MDS 05-6628A01, Rev. B
With the exception of ‘subject’, the Core Profile defines valid values for each of these categories, some
examples of the values include “access, copy, clone, encrypt” for action values, and “error, failure,
ongoing, success” for status values.
All taxonomy fields are optional, however if given they
must
contain exactly one non-null value.
Event Field Dictionary
The Core Profile defines a selection of common fields that may be used in event logs. Like the
taxonomy categories, this dictionary can be extended by vendors by using a custom profile. All of the
defined fields are optional with the exception of the following 3 mandatory fields that must be in every
logged event:
·
host
– Hostname of the event source.
·
pname
– Process name that generated the event.
·
time
– Event start time
It may appear that having the time field is redundant, as the time is already in the syslog message;
this is false for 2 reasons:
1. RFC 3164 (3) Syslog timestamps do not contain the year, and only have second resolution, whereas
the CEE timestamps have microsecond resolution with full year. RFC 5424 (4) Syslog messages do
include the year and support for microsecond resolution.
2. Syslog timestamps reflect the time that the event was sent to syslog, not necessarily the time that
the event occurred. Depending on the situation, these times may be different.
Event Encoding & Transport
CEE defines two different methods for encoding events for transport and storage, XML and JSON. CEE
also explicitly defines how CEE messages are to be transported over syslog (5). The following
requirements are stated:
·
Syslog Header – The standard Syslog header MUST be used.
·
Syslog Body – The CEE Event MUST be represented using the CLS (CEE common Log Syntax)
JSON Encoding.
o CEE Event Flag – The beginning of the encoded CEE Event MUST be identified by the
CEE Event Flag. Within Syslog, the CEE Event Flag is @cee:
·
Character Encoding – If the syslog implementation is only 7-bit, all characters not in the ASCII
character set MUST be escaped.
Examples
A valid CEE JSON Event Record embedded within an RFC5424 Syslog transport:
<165>1 2011-12-20T12:38:06Z 10.10.0.1 process - example-event-1
@cee:{"pname":"auth","host":"system.example.com","time":"2011-12-20T12:38:05.123456-05:00"}
