Also this document
Thanks & Best Regards
F5 BigIP ASM module can send logs using CEF format, but as for any CEF-format connector, there is no categorization so the default ArcSight content doesn't take these events into account. We also found out some messages have the same meaning but are not parsed the same way, which doesn't help categorization. This is why we created some additional map files to *correct* some fields.