Une incohérence a été détectée dans les sources : variantes ou fichier invalide. Vérifiez les fichiers et le commit indiqués ci-dessous.
Description
The PROVIDER NAME APPLIANCE NAME data connector ingests Common Event Format (CEF) logs from APPLIANCE NAME into Microsoft Sentinel. CEF is an industry standard format on top of Syslog messages, used by many security vendors to allow event interoperability. Logs are collected using the Azure Monitor Agent (AMA) via the Microsoft **Common Event Format (CEF) via AMA** solution, which must be installed in your workspace before configuring this connector.
[Learn more about the CEF via AMA connector >](https://learn.microsoft.com/azure/sentinel/connect-cef-ama)
- Statut déclaré
- 1
- Auteur / éditeur déclaré
- PROVIDER NAME
Sources déclarées
Métadonnées du fichier source. Aucune dépendance déduite du KQL.
Types de données
Permissions déclarées
read and write permissions are required.
Workspace
Workspace
To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)
The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)
Instructions du connecteur
Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.
1. Configure APPLIANCE NAME to forward CEF logs
Configure APPLIANCE NAME to forward Syslog messages in CEF format to a Linux log forwarder machine on port 514 TCP.
> Replace this step with your product-specific instructions for enabling CEF output. Include the destination IP/hostname of the log forwarder and any product-side configuration steps the customer must complete.
2. Install the Common Event Format (CEF) via AMA solution
This connector relies on the Microsoft **Common Event Format (CEF) via AMA** solution to collect CEF data into your workspace using the Azure Monitor Agent. If you have not already installed it, install it from the Microsoft Marketplace and create a Data Collection Rule (DCR) to collect CEF logs from your log forwarder.
[Install Common Event Format (CEF) via AMA from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)
Traçabilité de la source
GitHubLes valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.
- Commit
629d1d3↗- Identifiant source
ProviderNameApplianceName
Autres fichiers source 1
DataConnectors/Templates/Connector_CEF_template.jsonsource ↗GSTEP / SUIVI DU CATALOGUE
Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC