While CEE isn't developed any more, nothing precludes you from using it for pretty much exactly the purposes you described: http://cee.mitre.org/about/faqs.html

While CEE isn't developed any more, nothing precludes you from using it for pretty much exactly the purposes you described: http://cee.mitre.org/about/faqs.html#a1 http://cee.mitre.org/about/faqs.html#a1 We're doing so at work (using rsyslog forwarding as a transport for logs and metrics), and are very happy with what we have.