… is this place: http://www.arcsight.com/solutions/solutions-cef/ This is where you can request it via email.
The reason for this post? A lot of Google search traffic for “common event format” lands here on my blog (see picture) and the link above is the correct place to go to.
Now, if those are generic searches looking for some kind of log or event format, then you want CEE (when we finish it, actually)
Possibly related posts: