Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

Common Event Format (CEF) via AMA

Voir sur GitHub ↗Fichier original ↗

Description

Common Event Format (CEF) is an industry standard format on top of Syslog messages, used by many security vendors to allow event interoperability among different platforms. By connecting your CEF logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2223547&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Statut déclaré
1
Auteur / éditeur déclaré
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

CommonSecurityLog

Permissions déclarées

read and write permissions.
Workspace data sources
Workspace
To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

Enable data collection rule​
> CEF Events logs are collected only from **Linux** agents.
Run the following command to install and apply the CEF collector:

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques97
ApexOne - Attack Discovery DetectionHighApexOne - C&C callback eventsHighApexOne - Commands in UrlHighApexOne - Device access permissions was changedMediumApexOne - Inbound remote access connectionHighApexOne - Multiple deny or terminate actions on single IPHighApexOne - Possible exploit or execute operationHighApexOne - Spyware with failed responseHighApexOne - Suspicious commandline argumentsHighApexOne - Suspicious connectionsHighAwake Security - High Match Counts By DeviceMediumAwake Security - High Severity Matches By DeviceMediumAwake Security - Model With Multiple DestinationsMediumCisco SEG - DLP policy violationMediumCisco SEG - Malicious attachment not blockedHighCisco SEG - Multiple large emails sent to external recipientMediumCisco SEG - Multiple suspiciuos attachments receivedHighCisco SEG - Possible outbreakMediumCisco SEG - Potential phishing linkMediumCisco SEG - Suspicious linkHighCisco SEG - Suspicious sender domainMediumCisco SEG - Unexpected attachmentHighCisco SEG - Unexpected linkMediumCisco SEG - Unscannable attacmentMediumClaroty - Asset DownHighClaroty - Critical baseline deviationHighClaroty - Login to uncommon locationMediumClaroty - Multiple failed logins by userHighClaroty - Multiple failed logins to same destinationsHighClaroty - New AssetHighClaroty - Policy violationHighClaroty - Suspicious activityHighClaroty - Suspicious file transferHighClaroty - Threat detectedHighCommon Event Format (CEF) via AMA - Critical or High Severity Detections by UserHighCommon Event Format (CEF) via AMA - Critical Severity DetectionHighContrast BlocksLowContrast ExploitsHighContrast ProbesInformationalContrast SuspiciousMediumCritical RisksHighDiscord CDN Risky File DownloadMediumDragos NotificationsMediumGreyNoise TI Map IP Entity to CommonSecurityLogMediumIllusive Incidents Analytic RuleMediumInfoblox - Data Exfiltration AttackMediumInfoblox - High Threat Level Query Not Blocked DetectedMediumInfoblox - Many High Threat Level Queries From Single Host DetectedMediumInfoblox - Many High Threat Level Single Query DetectedMediumInfoblox - Many NXDOMAIN DNS Responses DetectedMediumInfoblox - SOC Insight Detected - CDC SourceMediumInfoblox - TI - CommonSecurityLog Match Found - MalwareC2MediumInfoblox - TI - InfobloxCDC Match Found - Lookalike DomainsMediumInfoblox - TI - Syslog Match Found - URLMediumLumen TI IPAddress in CommonSecurityLogMediumMicrosoft COVID-19 file hash indicator matchesMediumPalo Alto - possible internal to external port scanningLowPalo Alto - possible nmap scan on with top 100 optionMediumPalo Alto - potential beaconing detectedLowPalo Alto Threat signatures from Unusual IP addressesMediumPaloAlto - Dropping or denying session with trafficMediumPaloAlto - File type changedMediumPaloAlto - Forbidden countriesMediumPaloAlto - Inbound connection to high risk portsMediumPaloAlto - MAC address conflictLowPaloAlto - Possible attack without responseHighPaloAlto - Possible floodingMediumPaloAlto - Possible port scanHighPaloAlto - Put and post method request in high risk file typeHighPaloAlto - User privileges was changedMediumPing Federate - Abnormal password reset attemptsHighPing Federate - Abnormal password resets for userHighPing Federate - Authentication from new IP.LowPing Federate - Forbidden countryHighPing Federate - New user SSO success loginLowPing Federate - OAuth old versionMediumPing Federate - Password reset request from unexpected source IP address..MediumPing Federate - SAML old versionMediumPing Federate - Unexpected authentication URL.MediumPing Federate - Unexpected country for userMediumPing Federate - Unusual mail domain.MediumPRODAFT USTA - TI map File Hash to CommonSecurityLogMediumRequest for single resource on domainLowSonicWall - Allowed SSH, Telnet, and RDP ConnectionsMediumSonicWall - Capture ATP Malicious File DetectionMediumvArmour AppController - SMB Realm TraversalMediumVectra Account's BehaviorsInformationalVectra AI Detect - Detections with High SeverityHighVectra AI Detect - New Campaign DetectedMediumVectra AI Detect - Suspected Compromised AccountInformationalVectra AI Detect - Suspected Compromised HostInformationalVectra AI Detect - Suspicious Behaviors by CategoryInformationalVectra Host's BehaviorsInformationalVotiro - File Blocked from ConnectorLowVotiro - File Blocked in EmailLowVulerabilitiesHigh[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High
Solutions1
Workbooks20

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
CefAma
Autres fichiers source 2Solutions/Common Event Format/Data Connectors/CEF AMA.JSONsource ↗Solutions/Common Event Format/Data/Solution_CommonEventFormat.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.