This page gives SOC engineers the complete field maps for the Alphyn CEF and LEEF sinks, so you can build a custom parser, an ArcSight FlexConnector, or a QRadar DSM property mapping. The record shapes and field tables below match exactly what the Alphyn formatters emit.
CEF:0|Byteria|Alphyn|<schemaVersion>|<signatureId>|<name>|<severity>|<extension>
Header field Value Device Vendor ByteriaDevice Product AlphynDevice Version <schemaVersion>Signature ID THREAT: the detection module (for example ROOT-V1). AUDIT: the audit event type. Name THREAT: the detection title. AUDIT: the audit event type. Severity Integer 0-10.
CEF key Alphyn field externalIdEvent ID deviceExternalIdDevice ID catDetection module msgDetection description srcDevice IP cs1Label=Package / cs1App package name cs2Label=AppVersion / cs2App version cs3Label=AppHash / cs3App hash cs4Label=OS / cs4Operating system cs5Label=EventType / cs5Event type cs6Label=TenantId / cs6Tenant ID deviceCustomDate1Label=OccurredAt / deviceCustomDate1Event timestamp
CEF key Alphyn field externalIdEvent ID suidActor ID suserActor username srcSource IP requestClientApplicationUser agent cs1Label=ActorEmail / cs1Actor email cs2Label=ResourceType / cs2Resource type cs3Label=ResourceId / cs3Resource ID cs4Label=Category / cs4Audit category cs5Label=EventType / cs5Event type cs6Label=TenantId / cs6Tenant ID deviceCustomDate1Label=OccurredAt / deviceCustomDate1Event timestamp
LEEF:2.0|Byteria|Alphyn|<schemaVersion>|<eventID>|x09|<tab-separated attributes>
LEEF 2.0 declares the attribute delimiter in the header. Alphyn uses a tab (x09). Severity is carried in the sev attribute as an integer 1-10.
LEEF attribute Alphyn field catDetection module sevSeverity (1-10) srcDevice IP externalIdEvent ID deviceExternalIdDevice ID msgDetection description packageNameApp package name appVersionApp version appHashApp hash osOperating system eventTypeEvent type tenantIdTenant ID occurredAtEvent timestamp
LEEF attribute Alphyn field sevSeverity (1-10) usrNameActor username srcSource IP externalIdEvent ID actorIdActor ID actorEmailActor email resourceTypeResource type resourceIdResource ID catAudit category eventTypeEvent type tenantIdTenant ID occurredAtEvent timestamp userAgentUser agent
The Splunk HEC and Microsoft Sentinel sinks deliver the canonical Alphyn Security Event JSON rather than a flattened CEF or LEEF record. See each sink’s page for the exact envelope. In Splunk the events land under sourcetype alphyn:security; in Sentinel they land in the custom table declared by your Data Collection Rule.
