CEF:0|Varonis Inc.|DatAdvantage|<DatAdvantage version>|<Event Op Code>|<Event Type>|<Severity>|rt=<Alert Time> cat=Alert cs2=<Rule Name> cs2Label=RuleName cn1=<Rule ID> cn1Label=RuleID end=<Event Time> duser=<Acting Object> dhost=<File Server/Domain> filePath=<Access Path> fname=<Affected Object> act=<Event Type> dvchost=<Device Name> dvc=<Device IP Address> outcome=<Event Status> msg=<Additional Data> cs3=<Attachment Name> cs3Label=AttachmentName cs4=http://<DLS_IP_ADDRESS>/DatAdvantage/#/app/analytics/entity/Alert/<Alert ID> cs4Label=AlertURL deviceCustomDate1=<Mail Date> fileType=<Mail Item Type> cs1=<Mail Recipients> cs1Label=MailRecipient suser=<Mail Source> cs5=<Mailbox Access Type> cs5Label=MailboxAccessType cnt=<Threshold> cs6=<Changed Permissions> cs6Label=ChangedPermissions oldFilePermission=<Permissions Before Change> filePermission=<Permissions After Change> dpriv=<Trustee> start=<First Event Time> externalId=<Alert ID>