Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Common Event Format (CEF) via AMA

View on GitHub ↗Original file ↗

Description

Common Event Format (CEF) is an industry standard format on top of Syslog messages, used by many security vendors to allow event interoperability among different platforms. By connecting your CEF logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2223547&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Declared status
1
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

CommonSecurityLog

Declared permissions

read and write permissions.
Workspace data sources
Workspace
To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Enable data collection rule​
> CEF Events logs are collected only from **Linux** agents.
Run the following command to install and apply the CEF collector:

Related content

Links established from declared identifiers and solution manifests.

Analytics rules97
ApexOne - Attack Discovery DetectionHighApexOne - C&C callback eventsHighApexOne - Commands in UrlHighApexOne - Device access permissions was changedMediumApexOne - Inbound remote access connectionHighApexOne - Multiple deny or terminate actions on single IPHighApexOne - Possible exploit or execute operationHighApexOne - Spyware with failed responseHighApexOne - Suspicious commandline argumentsHighApexOne - Suspicious connectionsHighAwake Security - High Match Counts By DeviceMediumAwake Security - High Severity Matches By DeviceMediumAwake Security - Model With Multiple DestinationsMediumCisco SEG - DLP policy violationMediumCisco SEG - Malicious attachment not blockedHighCisco SEG - Multiple large emails sent to external recipientMediumCisco SEG - Multiple suspiciuos attachments receivedHighCisco SEG - Possible outbreakMediumCisco SEG - Potential phishing linkMediumCisco SEG - Suspicious linkHighCisco SEG - Suspicious sender domainMediumCisco SEG - Unexpected attachmentHighCisco SEG - Unexpected linkMediumCisco SEG - Unscannable attacmentMediumClaroty - Asset DownHighClaroty - Critical baseline deviationHighClaroty - Login to uncommon locationMediumClaroty - Multiple failed logins by userHighClaroty - Multiple failed logins to same destinationsHighClaroty - New AssetHighClaroty - Policy violationHighClaroty - Suspicious activityHighClaroty - Suspicious file transferHighClaroty - Threat detectedHighCommon Event Format (CEF) via AMA - Critical or High Severity Detections by UserHighCommon Event Format (CEF) via AMA - Critical Severity DetectionHighContrast BlocksLowContrast ExploitsHighContrast ProbesInformationalContrast SuspiciousMediumCritical RisksHighDiscord CDN Risky File DownloadMediumDragos NotificationsMediumGreyNoise TI Map IP Entity to CommonSecurityLogMediumIllusive Incidents Analytic RuleMediumInfoblox - Data Exfiltration AttackMediumInfoblox - High Threat Level Query Not Blocked DetectedMediumInfoblox - Many High Threat Level Queries From Single Host DetectedMediumInfoblox - Many High Threat Level Single Query DetectedMediumInfoblox - Many NXDOMAIN DNS Responses DetectedMediumInfoblox - SOC Insight Detected - CDC SourceMediumInfoblox - TI - CommonSecurityLog Match Found - MalwareC2MediumInfoblox - TI - InfobloxCDC Match Found - Lookalike DomainsMediumInfoblox - TI - Syslog Match Found - URLMediumLumen TI IPAddress in CommonSecurityLogMediumMicrosoft COVID-19 file hash indicator matchesMediumPalo Alto - possible internal to external port scanningLowPalo Alto - possible nmap scan on with top 100 optionMediumPalo Alto - potential beaconing detectedLowPalo Alto Threat signatures from Unusual IP addressesMediumPaloAlto - Dropping or denying session with trafficMediumPaloAlto - File type changedMediumPaloAlto - Forbidden countriesMediumPaloAlto - Inbound connection to high risk portsMediumPaloAlto - MAC address conflictLowPaloAlto - Possible attack without responseHighPaloAlto - Possible floodingMediumPaloAlto - Possible port scanHighPaloAlto - Put and post method request in high risk file typeHighPaloAlto - User privileges was changedMediumPing Federate - Abnormal password reset attemptsHighPing Federate - Abnormal password resets for userHighPing Federate - Authentication from new IP.LowPing Federate - Forbidden countryHighPing Federate - New user SSO success loginLowPing Federate - OAuth old versionMediumPing Federate - Password reset request from unexpected source IP address..MediumPing Federate - SAML old versionMediumPing Federate - Unexpected authentication URL.MediumPing Federate - Unexpected country for userMediumPing Federate - Unusual mail domain.MediumPRODAFT USTA - TI map File Hash to CommonSecurityLogMediumRequest for single resource on domainLowSonicWall - Allowed SSH, Telnet, and RDP ConnectionsMediumSonicWall - Capture ATP Malicious File DetectionMediumvArmour AppController - SMB Realm TraversalMediumVectra Account's BehaviorsInformationalVectra AI Detect - Detections with High SeverityHighVectra AI Detect - New Campaign DetectedMediumVectra AI Detect - Suspected Compromised AccountInformationalVectra AI Detect - Suspected Compromised HostInformationalVectra AI Detect - Suspicious Behaviors by CategoryInformationalVectra Host's BehaviorsInformationalVotiro - File Blocked from ConnectorLowVotiro - File Blocked in EmailLowVulerabilitiesHigh[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High
Solutions1
Workbooks20

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
CefAma
Additional source files 2Solutions/Common Event Format/Data Connectors/CEF AMA.JSONsource ↗Solutions/Common Event Format/Data/Solution_CommonEventFormat.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.