Log and event formats: a field guide
The formats your pipeline speaks — syslog, CEF, LEEF, Windows Event Log, NDJSON, OCSF, ECS, Apache/Nginx access logs, AWS CloudTrail, Suricata EVE JSON, Linux auditd — explained, with a generated sample of each.
Every log pipeline speaks a format. Get it wrong and your parser drops the event; get it right and detections, dashboards, and alerts behave correctly. This track explains the formats you meet most often and shows how to generate a compliant sample of each with Eventum.
Windows Event Log & Sysmon
The XML event model, EventIDs, and Sysmon — and how to generate them without running anything.
CEF
ArcSight Common Event Format: header, extensions, and a generated CEF stream.
LEEF
QRadar Log Event Extended Format and how to generate LEEF events.
syslog (RFC 5424 / 3164)
The two syslog headers, when each applies, and generating both.
NDJSON
Newline-delimited JSON, also known as JSON Lines: how it differs from a JSON array, and a generated NDJSON stream.
OCSF
Open Cybersecurity Schema Framework: categories, event classes, and activities — and a generated Authentication event.
ECS
Elastic Common Schema: how event, host, and related fields are namespaced, and a generated ECS-mapped event.
Apache & Nginx access logs
Common Log Format and Combined Log Format, Apache vs Nginx defaults, and a generated Combined-format stream.
AWS CloudTrail
The Records envelope, camelCase event fields, userIdentity, and a generated CloudTrail stream.
Suricata EVE JSON
The event_type discriminator, common fields, and the alert event, plus a generated EVE JSON stream.
Linux auditd
The multi-record audit.log format, the shared audit ID stitching records together, and a generated auditd stream.
Streaming vs bulk: live vs sample mode
How streaming and bulk test data differ, how Eventum's live mode and sample mode produce each, and how to bound a generator that would otherwise run forever.
Windows Event Log & Sysmon
Channels, EventID, and the XML event model behind Windows Event Log and Sysmon — and how to generate realistic Security and Sysmon events with Eventum.