JSON formatting for NSS Log Feeds (Web, DNS, and Firewall)

Hi all -

For those that need to send NSS logs as JSON format to your SIEM, you can use the following (copy/paste to NSS window) for the Web, DNS, and Firewall log types:
Firewall Logs
[ \{ "datetime" : "%s{time}", "user" : "%s{login}", "department" : "%s{dept}", "locationname" : "%s{location}", "cdport" : "%d{cdport}", "csport" : "%d{csport}", "cdip" : "%s{cdip}", "ssip" : "%s{ssip}", "sdip" : "%s{sdip}", "tsip" : "%s{tsip}", "tunsport" : "%d{tsport}", "tuntype" : "%s{ttype}", "action" : "%s{action}", "dnat" : "%s{dnat}", "stateful" : "%s{stateful}", "aggregate" : "%s{aggregate}", "nwsvc" : "%s{nwsvc}", "nwapp" : "%s{nwapp}", "proto" : "%s{ipproto}", "ipcat" : "%s{ipcat}", "destcountry" : "%s{destcountry}", "avgduration" : "%d{avgduration}", "rulelabel" : "%s{rulelabel}", "inbytes" : "%ld{inbytes}", "outbyes" : "%ld{outbytes}", "duration" : "%d{duration}", "durationms" : "%d{durationms}", "numsessions" : "%d{numsessions}", "ipsrulelabel" : "%s{ipsrulelabel}", "threatcat" : "%s{threatcat}", "threatname" : "%s{threatname}", "deviceowner" : "%s{deviceowner}", "devicehostname" : "%s{devicehostname}" \} ]
DNS Logs
[ \{ "datetime" : "%s{time}", "user" : "%s{login}", "department" : "%s{dept}", "locationname" : "%s{location}", "reqaction" : "%s{reqaction}", "resaction" : "%s{resaction}", "reqrulelabel" : "%s{reqrulelabel}", "resrulelabel" : "%s{resrulelabel}", "dns_reqtype" : "%s{reqtype}", "dns_req" : "%s{req}", "dns_resp" : "%s{res}", "srv_dport" : "%d{sport}", "durationms" : "%d{durationms}", "clt_sip" : "%s{cip}", "srv_dip" : "%s{sip}", "category" : "%s{domcat}", "deviceowner" : "%s{deviceowner}" \} ]
Web Logs
\{"action":"%s{action}","appclass":"%s{appclass}","appname":"%s{appname}","bwclassname":"%s{bwclassname}","bwrulename":"%s{bwrulename}","bwthrottle":"%s{bwthrottle}","ClientIP":"%s{cip}","clientpublicIP":"%s{cintip}","clientsslcipher":"%s{clientsslcipher}","clientsslsessreuse":"%s{clientsslsessreuse}","clienttlsversion":"%s{clienttlsversion}","clienttranstime":"%d{ctime}","contenttype":"%s{contenttype}","contenttype__1":"%s{contenttype}","department":"%s{dept}","dept":"%s{dept}","deviceappversion":"%s{deviceappversion}","devicemodel":"%s{devicemodel}","devicename":"%s{devicename}","devicename__1":"%s{devicename}","deviceostype":"%s{deviceostype}","deviceostype__1":"%s{deviceostype}","deviceosversion":"%s{deviceosversion}","deviceplatform":"%s{deviceplatform}","dlpdicthitcount":"%s{dlpdicthitcount}","dlpdictionaries":"%s{dlpdict}","dlpengine":"%s{dlpeng}","dlpidentifier":"%d{dlpidentifier}","dlpmd5":"%s{dlpmd5}","ehost":"%s{ehost}","epochtime":"%d{epochtime}","ereferer":"%s{ereferer}","event_id":"%d{recordid}","fileclass":"%s{fileclass}","filename":"%s{filename}","filesubtype":"%s{filesubtype}","filetype":"%s{filetype}","hostname":"%s{ehost}","location":"%s{location}","md5":"%s{bamd5}","mobappcat":"%s{mobappcat}","mobappname":"%s{mobappname}","mobdevtype":"%s{mobdevtype}","module":"%s{module}","login":"%s{login}","pagerisk":"%d{riskscore}","product":"NSS","productversion":"%s{productversion}","protocol":"%s{proto}","reason":"%s{reason}","refererURL":"%s{ereferer}","reqdatasize":"%d{reqdatasize}","reqhdrsize":"%d{reqhdrsize}","requestmethod":"%s{reqmethod}","requestsize":"%d{reqsize}","respdatasize":"%d{respdatasize}","resphdrsize":"%d{resphdrsize}","responsesize":"%d{respsize}","respsize":"%d{respsize}","respversion":"%s{respversion}","rulelabel":"%s{rulelabel}","ruletype":"%s{ruletype}","serverip":"%s{sip}","serversslsessreuse":"%s{serversslsessreuse}","servertranstime":"%d{stime}","srvcertchainvalpass":"%s{srvcertchainvalpass}","srvcertvalidationtype":"%s{srvcertvalidationtype}","srvcertvalidityperiod":"%s{srvcertvalidityperiod}","srvocspresult":"%s{srvocspresult}","srvsslcipher":"%s{srvsslcipher}","srvtlsversion":"%s{srvtlsversion}","srvwildcardcert":"%s{srvwildcardcert}","status":"%s{respcode}","threatcategory":"%s{malwarecat}","threatclass":"%s{malwareclass}","threatname":"%s{threatname}","throttlereqsize":"%d{throttlereqsize}","throttlerespsize":"%d{throttlerespsize}","trafficredirectmethod":"%s{trafficredirectmethod}","transactionsize":"%d{totalsize}","tz":"%s{tz}","ua_token":"%s{ua_token}","uaclass":"%s{uaclass}","url":"%s{eurl}","urlcategory":"%s{urlcat}","urlclass":"%s{urlclass}","urlsupercategory":"%s{urlsupercat}","user":"%s{login}"\}