Creating extra custom format key-value pairs

Use the Extended Log File Format (ELFF) custom format to forward specific Blue Coat data or events to IBM® QRadar®.

The custom format is a series of pipe-delimited fields that start with the Bluecoat| field and contains the $(Blue Coat ELFF) parameter.

For example:


Table 1. Custom Format examples
Blue Coat ELFF Parameter QRadar Custom Format Example
sc-bytes $(sc-bytes)
rs(Content-type) $(rs(Content-Type))

For more information about available Blue Coat ELFF parameters, see your Blue Coat appliance documentation.