You can forward the Logger audit events, which are in Common Event Format (CEF), to ArcSight ESM directly for analysis and correlation. Use the Audit Forwarding feature (as described in Audit Forwarding) to forward the events.
For more information about CEF, refer to the document "ArcSight CEF". For a downloadable a copy of this guide, search for “ArcSight Common Event Format (CEF) Guide” in the Micro Focus Security Community.
The following topics describe Logger’s audit events: