An inconsistency was detected in the sources: variants or an invalid file. Check the files and commit shown below.
Description
The PROVIDER NAME APPLIANCE NAME data connector ingests Common Event Format (CEF) logs from APPLIANCE NAME into Microsoft Sentinel. CEF is an industry standard format on top of Syslog messages, used by many security vendors to allow event interoperability. Logs are collected using the Azure Monitor Agent (AMA) via the Microsoft **Common Event Format (CEF) via AMA** solution, which must be installed in your workspace before configuring this connector.
[Learn more about the CEF via AMA connector >](https://learn.microsoft.com/azure/sentinel/connect-cef-ama)
- Declared status
- 1
- Declared author / publisher
- PROVIDER NAME
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
read and write permissions are required.
Workspace
Workspace
To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)
The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
1. Configure APPLIANCE NAME to forward CEF logs
Configure APPLIANCE NAME to forward Syslog messages in CEF format to a Linux log forwarder machine on port 514 TCP.
> Replace this step with your product-specific instructions for enabling CEF output. Include the destination IP/hostname of the log forwarder and any product-side configuration steps the customer must complete.
2. Install the Common Event Format (CEF) via AMA solution
This connector relies on the Microsoft **Common Event Format (CEF) via AMA** solution to collect CEF data into your workspace using the Azure Monitor Agent. If you have not already installed it, install it from the Microsoft Marketplace and create a Data Collection Rule (DCR) to collect CEF logs from your log forwarder.
[Install Common Event Format (CEF) via AMA from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
ProviderNameApplianceName
Additional source files 1
DataConnectors/Templates/Connector_CEF_template.jsonsource ↗GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC