Common Event Grammar › Normalizing and Categorizing Events › Event Result › Event Severity

Event Severity

Event severity is the last CEG field used for normalization. Event severity is interpretation of the seriousness of an event applies to all types of events. The event_severity field contains a severity level value ranging from 0 to 7 with clearly defined descriptions.

Event severity provides a reference point for comparing the internal relativity of a security event in terms of its threat and implication to system security, stability, availability and integrity. As a field, event_severity is not always mapped to result_severity but conveys similar message.

As it applies to the CEG, the purpose of the event_severity fields is to map the value of the result_severity field assigned by different vendors in their security logs to a common denominator.