What is the CEF severity mapping for syslog forwarding in Cortex Data Lake?
1568
Created On 08/28/23 23:37 PM - Last Modified 06/10/25 21:53 PM
Question
What is the CEF severity mapping for syslog forwarding in Cortex Data Lake?
Environment
- Cortex Data Lake
- Syslog Forwarding with CEF format
- Common Event Format (CEF)
Answer
CEF format severity mapping is different form the PAN-OS.
Here is the mapping for CEF format:
| Sevirity | CEF format severity |
|---|---|
| Informational | 1 |
| Low | 3 |
| Medium | 5 |
| High | 7 |
| Critical | 9 |
| Everything else | 3 |
Additional Information
- CEF format severity in Cortex Data Lake Syslog Forwarding is different from the PAN-OS severity value.
- Example, PAN-OS defines "High" severity value as "4". But the severity in CEF format shows "7".