SIEM templates - NTM

Products Threat Manager Discussions & Questions
,
1

I’m curious if there’s any documentation on the formats of the various flavors of CEF templates I see in our SIEM integration page. I see this

image
image201×244 7.44 KB

However, none of them (with the exception of the Custom one) actually show the fields and format that are being sent. Just wondering if this is documented anywhere because I cannot find anything currently. Also curious, for those that are using SIEM, what format are you using? Our SIEM is Splunk, would love to hear what others are using.

Thanks!

2

Hey Art,

This is a documentation gap that I’ll get fixed. Ultimately, it depends on what your SIEM tool is expecting.

Differences between the 4 CEF templates
All four CEF templates produce an identical CEF header and body — the fields, format, and structure are the same. The only difference between them is the timestamp prefix placed in front of the CEF:0 header.

Template Prefix Example prefix output
CEF template %SYSLOG_DATE% %HOST% 2026-07-16 14:32:05Z myhost
ISO CEF template %SYSLOG_DATE_ISO% %HOST% 2026-07-16T14:32:05.123Z myhost
Raw CEF template none (message starts directly at CEF:0|...)
CEF rsyslog template %SYSLOG_DATE_ISO_D% %HOST% 20260716T14:32:05.123Z myhost

Which one to use:

  • CEF template — standard syslog-style date. Works with most CEF-consuming SIEMs. Good default choice.
  • ISO CEF template — use when the SIEM or log collector requires strict ISO 8601 timestamps.
  • Raw CEF template — use when the receiving syslog daemon or transport already adds its own date/host prefix, to avoid a duplicated or malformed header.
  • CEF rsyslog template — use specifically for rsyslog-based collectors that expect the date without a colon separator.