LEEF

The Log Event Extended Format is an enterprise security event logging format created by IBM for QRadar. A LEEF record is a pipe-delimited header followed by an attribute section of key=value pairs.

DataStream converts to and from LEEF with the Normalize processor.

Message Format

A record consists of five header fields and an attribute section:

LEEF:1.0|Vendor|Product|Version|EventID|key=value<TAB>key=value ...

Position	Header Field	ECS Source	Written When Absent
1	LEEF Version	-	Always `LEEF:1.0`
2	Vendor	`observer.vendor`	`Unknown`
3	Product	`observer.product`	`Unknown`
4	Version	`observer.version`	`1.0`
5	Event ID	`event.code`	`0`

Attributes are separated by a tab, sorted by key in ascending case-insensitive order.

Versions

The format has two versions, and DataStream treats them asymmetrically.

Direction	Support
Writing	`LEEF:1.0` only
Reading	`LEEF:1.0` and `LEEF:2.0`

LEEF 2.0 adds an optional sixth header field naming a custom attribute delimiter as a hexadecimal value such as x09. The parser reads that field and applies the delimiter it names, falling back to a tab when it is absent or unparseable.

Attribute Fields

The tables below give the LEEF attribute produced for each ECS field.

An ECS field not listed here is still written out. Its dotted path is condensed into a single camel-case key, so network.user becomes networkUser. No field is dropped for being unmapped.

Where two keys are shown, the first is the one written. Both are recognized when reading, which is how QRadar's alternative attribute names are accepted.

Timestamp

ECS Field	LEEF Field
`@timestamp`	`receivedTime`

Device

ECS Field	LEEF Field
`device.name`	`Name`, `disp`
`device.host`	`Host`
`device.request`	`Request`
`device.os`	`os`
`device.osversion`	`osVersion`
`device.zone`	`zone`

Observer

ECS Field	LEEF Field
`observer.vendor`	`deviceVendor`
`observer.product`	`deviceProduct`
`observer.version`	`deviceVersion`
`observer.name`	`sys_name`
`observer.type`	`deviceType`
`observer.hostname`	`identHostName`
`observer.ip`	`identSrc`
`observer.mac`	`identMAC`
`observer.scope`	`scope`
`observer.scope.id`	`scopeId`
`observer.domain`	`deviceDnsDomain`
`observer.facility`	`deviceFacility`
`observer.ntdomain`	`deviceNtDomain`
`observer.payload`	`devicePayloadId`
`observer.process.id`	`deviceProcessId`
`observer.process.name`	`deviceProcessName`
`observer.nat.address`	`deviceNatIpAddr`
`observer.timezone`	`deviceTimezone`

Event

ECS Field	LEEF Field
`event.id`	`externalId`
`event.original_uid`	`originalUid`
`event.extid`	`extId`
`event.code`	`deviceEventClassId`
`event.count`	`eventCount`
`event.action`	`act`
`event.severity`	`sev`
`event.outcome`	`outcome`
`event.reason`	`reason`
`event.created`	`devTime`
`event.start`	`start`
`event.end`	`end`
`event.timezone`	`tz`
`event.type`	`type`
`event.module`	`module`
`event.category`	`cat`
`event.kind`	`kind`
`event.duration`	`duration`
`event.hash`	`eventHash`
`event.original`	`rawEvent`
`event.risk_score`	`agentSeverity`
`event.dataset`	`dataset`
`event.schema`	`schema`
`event.schema_version`	`schemaVersion`
`event.owner`	`owner`

Source

ECS Field	LEEF Field
`source.ip`	`src`
`source.port`	`srcPort`
`source.hostname`	`srcHost`
`source.service.name`	`srcSvc`
`source.nat.ip`	`srcPostNAT`, `srcPreNAT`
`source.nat.port`	`srcPostNATPort`, `srcPreNATPort`
`source.nat.interface`	`DvcInboundInterface`
`source.domain`	`srcDnsDomain`
`source.interface`	`srcInterface`, `in_if`
`source.mac`	`srcMAC`
`source.user.name`	`suser`
`source.user.id`	`suid`
`source.process.name`	`resource`
`source.process.id`	`resourceId`
`source.bytes`	`srcBytes`, `sent_bytes`
`source.packets`	`srcPackets`, `sent_pkts`
`source.geo.country`	`calCountryOrRegion`
`source.geo.city`	`sourceGeoCity`
`source.geo.region`	`sourceGeoRegion`
`source.geo.location`	`sourceGeoLatitude`, `sourceGeoLongitude`
`source.user.email`	`smail`
`source.user.group`	`sntdom`
`source.user.roles`	`spriv`

Destination

ECS Field	LEEF Field
`destination.name`	`dstName`
`destination.ip`	`dst`
`destination.port`	`dstPort`
`destination.service.name`	`dstSvc`
`destination.nat.ip`	`dstPostNAT`, `dstPreNAT`
`destination.nat.port`	`dstPostNATPort`, `dstPreNATPort`
`destination.nat.interface`	`dstInterface`
`destination.domain`	`destinationDnsDomain`
`destination.domain_type`	`dstDomainType`
`destination.interface`	`dstInterface`, `out_if`
`destination.host`	`dstHost`
`destination.hostname`	`dstHostName`
`destination.fqdn`	`dstFQDN`
`destination.mac`	`dstMAC`
`destination.user.name`	`duser`
`destination.user.id`	`duid`
`destination.process.name`	`dproc`
`destination.process.id`	`dpid`
`destination.bytes`	`dstBytes`, `rcvd_bytes`
`destination.packets`	`dstPackets`, `rcvd_pkts`
`destination.geo.country`	`dntry`
`destination.geo.city`	`destinationGeoCity`
`destination.geo.region`	`destinationGeoRegion`
`destination.geo.location`	`destinationGeoLatitude`, `destinationGeoLongitude`
`destination.user.email`	`dmail`
`destination.user.group`	`dntdom`
`destination.user.roles`	`dpriv`

Network

ECS Field	LEEF Field
`network.protocol`	`app`
`network.transport`	`proto`
`network.type`	`deviceDirection`
`network.application`	`appName`
`network.bytes`	`totalBytes`
`network.packets`	`totalPackets`
`network.direction`	`deviceDirection`
`network.community_id`	`deviceCommunityId`
`network.forwarded`	`deviceForwardingStatus`
`network.vlan`	`deviceVlan`

File

ECS Field	LEEF Field
`file.id`	`fileId`
`file.path`	`filePath`
`file.name`	`fname`
`file.type`	`ftype`
`file.size`	`fsize`
`file.hash`	`fileHash`
`file.created`	`fileCreateTime`
`file.mtime`	`fileModificationTime`
`file.extension`	`fileExtension`
`file.mime_type`	`fileMimeType`
`file.directory`	`fileDirectory`
`file.hash.md5`	`fileHash`
`file.hash.sha1`	`fileHash`
`file.hash.sha256`	`fileHash`
`file.hash.sha512`	`fileHash`
`old_file.id`	`oldFileId`
`old_file.path`	`oldFilePath`
`old_file.name`	`oldFname`
`old_file.type`	`oldFtype`
`old_file.size`	`oldFsize`
`old_file.hash`	`oldFileHash`
`old_file.created`	`oldFileCreateTime`
`old_file.mtime`	`oldFileModificationTime`
`old_file.extension`	`oldFileExtension`
`old_file.mime_type`	`oldFileMimeType`
`old_file.directory`	`oldFileDirectory`
`old_file.hash.md5`	`oldFileHash`
`old_file.hash.sha1`	`oldFileHash`
`old_file.hash.sha256`	`oldFileHash`
`old_file.hash.sha512`	`oldFileHash`

HTTP and URL

ECS Field	LEEF Field
`http.request.method`	`requestMethod`
`http.response.status_code`	`responseStatus`
`http.request.body.content`	`requestBody`
`http.response.body.content`	`responseBody`
`http.request.cookies`	`requestCookies`
`http.request.referrer`	`requestContext`
`url.original`	`requestOriginal`
`url.category`	`requestCategory`
`url.domain`	`requestClientApplication`
`url.full`	`request`

Process

ECS Field	LEEF Field
`process.name`	`processName`
`process.pid`	`processId`
`process.args`	`processCommandLine`
`process.title`	`processTitle`
`process.executable`	`processExecutable`
`process.working_directory`	`processPath`
`process.hash.md5`	`processHash`
`process.hash.sha1`	`processHash`
`process.hash.sha256`	`processHash`
`process.parent.name`	`processParentName`
`process.parent.pid`	`processParentId`
`process.parent.args`	`processParentCommandLine`

User

ECS Field	LEEF Field
`user.type`	`userType`
`user.id`	`uid`
`user.name`	`user`
`user.user_type`	`userPrivileges`
`user.domain`	`ntdom`
`user.email`	`mail`
`user.group.id`	`gid`
`user.group.name`	`group`

User Agent

ECS Field	LEEF Field
`user_agent.name`	`userAgent`
`user_agent.version`	`userAgentVersion`

Threat Intelligence

ECS Field	LEEF Field
`threat.framework`	`threatFramework`
`threat.tactic.name`	`threatDescription`
`threat.indicator.ip`	`threatIp`
`threat.indicator.type`	`threatType`

Registry

ECS Field	LEEF Field
`registry.key`	`registryKey`
`registry.value`	`registryValue`
`registry.data`	`registryData`

DNS

ECS Field	LEEF Field
`dns.answers.class`	`answerClass`
`dns.answers.name`	`answerName`
`dns.answers.ttl`	`answerTTL`
`dns.answers.type`	`answerType`
`dns.header_flags`	`dnsFlags`
`dns.id`	`dnsID`
`dns.op_code`	`opCode`
`dns.question.class`	`queryClass`
`dns.question.name`	`queryName`
`dns.question.registered_domain`	`registeredDomain`
`dns.question.subdomain`	`subdomain`
`dns.question.top_level_domain`	`topLevelDomain`
`dns.question.type`	`queryType`
`dns.resolved_ip`	`resolvedIP`
`dns.response_code`	`responseCode`
`dns.type`	`dnsType`

Rule

ECS Field	LEEF Field
`rule.author`	`ruleAuthor`
`rule.category`	`ruleCategory`
`rule.description`	`ruleDescription`
`rule.id`	`ruleID`
`rule.license`	`ruleLicense`
`rule.name`	`ruleName`
`rule.reference`	`ruleReference`
`rule.ruleset`	`ruleSet`
`rule.uuid`	`ruleUUID`
`rule.version`	`ruleVersion`

Message

ECS Field	LEEF Field
`message`	`msg`

Syslog

ECS Field	LEEF Field
`log.syslog.appname`	`syslogAppName`
`log.syslog.facility.code`	`syslogFacilityCode`
`log.syslog.facility.name`	`syslogFacilityName`
`log.syslog.hostname`	`syslogHostname`
`log.syslog.priority`	`syslogPriority`
`log.syslog.procid`	`syslogProcessId`
`log.syslog.severity.code`	`syslogSeverityCode`
`log.syslog.severity.name`	`syslogSeverityName`
`log.syslog.structured_data`	`syslogMsg`

Format Identification

ECS Field	LEEF Field
`leef.version`	`leefVersion`
`leef.name`	`leefName`
`cef.version`	`cefVersion`
`cef.name`	`cefName`

Custom Fields

ECS Field	LEEF Field
`cef.device_custom_string_1.value`	`cs1`
`cef.device_custom_string_1.label`	`cs1Label`
`cef.device_custom_string_2.value`	`cs2`
`cef.device_custom_string_2.label`	`cs2Label`
`cef.device_custom_string_3.value`	`cs3`
`cef.device_custom_string_3.label`	`cs3Label`
`cef.device_custom_string_4.value`	`cs4`
`cef.device_custom_string_4.label`	`cs4Label`
`cef.device_custom_string_5.value`	`cs5`
`cef.device_custom_string_5.label`	`cs5Label`
`cef.device_custom_string_6.value`	`cs6`
`cef.device_custom_string_6.label`	`cs6Label`
`cef.device_custom_number_1.value`	`cn1`
`cef.device_custom_number_1.label`	`cn1Label`
`cef.device_custom_number_2.value`	`cn2`
`cef.device_custom_number_2.label`	`cn2Label`
`cef.device_custom_number_3.value`	`cn3`
`cef.device_custom_number_3.label`	`cn3Label`
`cef.device_custom_ipv6_address_1.value`	`c6a1`
`cef.device_custom_ipv6_address_1.label`	`c6a1Label`
`cef.device_custom_ipv6_address_2.value`	`c6a2`
`cef.device_custom_ipv6_address_2.label`	`c6a2Label`
`cef.device_custom_ipv6_address_3.value`	`c6a3`
`cef.device_custom_ipv6_address_3.label`	`c6a3Label`
`cef.device_custom_ipv6_address_4.value`	`c6a4`
`cef.device_custom_ipv6_address_4.label`	`c6a4Label`
`cef.device_custom_floating_point_1.value`	`cfp1`
`cef.device_custom_floating_point_1.label`	`cfp1Label`
`cef.device_custom_floating_point_2.value`	`cfp2`
`cef.device_custom_floating_point_2.label`	`cfp2Label`
`cef.device_custom_floating_point_3.value`	`cfp3`
`cef.device_custom_floating_point_3.label`	`cfp3Label`
`cef.device_custom_floating_point_4.value`	`cfp4`
`cef.device_custom_floating_point_4.label`	`cfp4Label`
`cef.flex_string_1`	`flexString1`
`cef.flex_string_1_label`	`flexString1Label`
`cef.flex_string_2`	`flexString2`
`cef.flex_string_2_label`	`flexString2Label`
`cef.flex_date_1`	`flexDate1`
`cef.flex_date_1_label`	`flexDate1Label`
`cef.flex_number_1`	`flexNumber1`
`cef.flex_number_1_label`	`flexNumber1Label`
`cef.flex_number_2`	`flexNumber2`
`cef.flex_number_2_label`	`flexNumber2Label`
`cef.device_custom_date_1.value`	`deviceCustomDate1`
`cef.device_custom_date_1.label`	`deviceCustomDate1Label`
`cef.device_custom_date_2.value`	`deviceCustomDate2`
`cef.device_custom_date_2.label`	`deviceCustomDate2Label`

Additional

ECS Field	LEEF Field
`additional.extensions`	`additionalExtensions`

Severity

DataStream applies no severity default when writing LEEF—a record whose source carries no event.severity simply has no sev attribute.

The Microsoft Sentinel content pack does set one, on an inverted four-point scale where 1 is the most severe:

`sev`	Meaning
`1`	High
`2`	Medium
`3`	Low
`4`	Informational

This is narrower than QRadar's own 1–10 ascending scale, and applies only to events passing through that pack.

Limitations

Values are not escaped on write. An attribute value containing a tab breaks the record into extra attributes when it is read back. There is no quoting mechanism.
devTime format depends on the pipeline. The general conversion writes Unix epoch seconds and removes devTimeFormat; the Microsoft Sentinel pack writes an ISO 8601 string and sets devTimeFormat to yyyy-MM-dd'T'HH:mm:ssz.
Several ECS fields share one attribute. file.hash and its four algorithm-specific variants all produce fileHash; processHash and oldFileHash behave the same way. Converting back yields the base field.
Geographic coordinates lose longitude. source.geo.location and destination.geo.location list a latitude and a longitude key, and only the first is written.

Message Format​

Versions​

Attribute Fields​

Timestamp​

Device​

Observer​

Event​

Source​

Destination​

Network​

File​

HTTP and URL​

Process​

User​

User Agent​

Threat Intelligence​

Registry​

DNS​

Rule​

Message​

Syslog​

Format Identification​

Custom Fields​

Additional​

Severity​

Limitations​