The CEF v1.0 schema organizes event data by event. Each event element includes information that identifies the device that recorded the event.
The following illustration shows the CEF v1.0 schema.
