Mind the Log

🧩 CEF, But Not Quite: UniFi OS Events Break the Format TL;DR: UniFi devices generate two types of CEF events—one from "UniFi Network" and one from "UniFi OS". Only the "UniFi Network" events are properly formatted. "UniFi OS" events are malformed, missing required fields, and cannot be parsed without custom workarounds. If you're relying on CEF parsers, expect frustration. Ubiquiti should fix these broken events. In my previous post, I wrote that UniFi devices can generate CEF events for both UniFi OS and UniFi Network . I need to clarify that statement. Because only one of those event types is correctly formatted as CEF. The other? Parsers won’t even touch it. What CEF is supposed to look like To make sense of this, let’s first recap what a CEF event is supposed to look like. The official documentation for the format is here: 👉 Micro Focus CEF Implementation Standard According to the spec, a typical CEF header looks l...

TL;DR: UniFi Teleport VPN logs (in CEF format) are missing the client's remote IP address—the WireGuard endpoint—which is critical for threat detection, auditing, and correlation in SIEM tools. Although this IP is available in other events, it isn't included in the CEF event. Adding a field like UNIFIvpnClientRemoteIp would significantly improve log completeness and security monitoring value. When a Teleport VPN connection is made through a UniFi device, three IP addresses are involved: The remote IP of the Teleport client (the WireGuard endpoint) The WAN IP of the UniFi device The internal IP assigned to the Teleport client The CEF log that's generated captures a good deal of useful information, including the internal client IP, VPN type, and WAN interface. But one important piece is missing: the remote IP address of the Teleport client. Here's an example CEF event for a VPN connection: CEF:0|Ubiquiti|UniFi Network|9.3.45|522|Teleport Clie...