You can use PingFederate to write from logs using the Common Event Format (CEF) open standard.
CEF is an open logging standard. PingFederate provides an option of writing elements from the audit log, the provisioner audit log, or both at runtime to a syslog receiver for parsing and analysis using ArcSight from Micro Focus. Alternatively, administrators can write the information to a flat file in CEF. However, you should use syslog when available.
PingFederate is tested with ArcSight for interoperability using the default elements defined in log4j2.xml. Any additions to these elements might render your CEF logging incompatible with ArcSight.