Common Event Format (CEF) is a format for logs. ACOS extends it by defining certain vendor-specific fields.
Common Event Format (CEF) is a Logging and Auditing file format from ArcSight and is an extensible, text-based format designed to support multiple device types by offering the most relevant information. Common Event Format can be used with on-premise devices by implementing the ArcSight Syslog SmartConnector. Common Event Format can also be used by cloud-based service providers by implementing the SmartConnector for ArcSight Common Event Format REST. Common Event Format is probably the widest used Logging and Auditing file format.
For more information visit: https://ldapwiki.com/wiki/Common%20Event%20Format