The Common Event Format (CEF) is an open logging standard. PingFederate provides an option of writing elements from the audit log, the provisioner audit log, or both at runtime to a syslog receiver for parsing and analysis using ArcSight from Micro Focus. Alternatively, administrators can write the information to a flat file in CEF; however, using syslog, when available, is recommended.
PingFederate is tested with ArcSight for interoperability using the default elements defined in log4j2.xml. Any additions to these elements may render your CEF logging incompatible with ArcSight.