{
  "Name": "Common Event Format",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The Common Event Format (CEF) solution for Microsoft Sentinel allows you to ingest logs from any product and/or appliance that can send logs in the [Common Event Format (CEF) over Syslog messages](https://docs.microsoft.com/azure/sentinel/connect-common-event-format). \n\nInstalling this solution will deploy two data connectors,\n\r\n1. Common Event Format via AMA - This data connector helps in ingesting CEF formatted logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). Microsoft recommends using this Data Connector\r\n2. Common Event Format via Legacy Agent - This data connector helps in ingesting CEF formatted logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\r\n<P style=\"color:red\">**NOTE**: Microsoft recommends Installation of Common Event Format via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.</p>\n\n**Underlying Microsoft Technologies used:**\n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n\n a. [Agent-based log collection (CEF over Syslog)](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)",
  "Data Connectors": [
    "Data Connectors/CEF.json",
    "Data Connectors/CEF AMA.json"
  ],
  "Workbooks": [
    "Workbooks/CEFOverviewWorkbook.json"
  ],
  "StaticDataConnectorIds": [
    "CefAma"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Common Event Format",
  "Version": "3.0.6",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true
}