{
  "id": "CefAma",
  "title": "Common Event Format (CEF) via AMA",
  "publisher": "Microsoft",
  "descriptionMarkdown": "Common Event Format (CEF) is an industry standard format on top of Syslog messages, used by many security vendors to allow event interoperability among different platforms. By connecting your CEF logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2223547&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "CommonSecurityLog",
      "baseQuery": "CommonSecurityLog"
    }
  ],
  "sampleQueries": [
    {
      "description": "All logs",
      "query": "CommonSecurityLog\n            | sort by TimeGenerated"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "CEFAMA",
      "value": null
    }
  ],
  "dataTypes": [
    {
      "name": "CommonSecurityLog",
      "lastDataReceivedQuery": "CommonSecurityLog\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }
  ],
  "availability": {
    "status": 1
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces/datasources",
        "permissionsDisplayText": "read and write permissions.",
        "providerDisplayName": "Workspace data sources",
        "scope": "Workspace",
        "requiredPermissions": {
          "read": true,
          "write": true
        }
      }
    ],
    "customs": [
      {
        "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)"
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "Enable data collection rule​",
      "description": ">  CEF Events logs are collected only from **Linux** agents.",
      "instructions": [
        {
          "type": "CefAma"
        }
      ]
    },
    {
      "instructions": [
        {
          "parameters": {
            "linkType": "OpenCreateDataCollectionRule",
            "dataCollectionRuleType": 3
          },
          "type": "InstallAgent"
        }
      ]
    },
    {
      "title": "Run the following command to install and apply the CEF collector:",
      "instructions": [
        {
          "parameters": {
            "fillWith": [
              "WorkspaceId",
              "PrimaryKey"
            ],
            "label": "",
            "value": "sudo wget -O Forwarder_AMA_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Forwarder_AMA_installer.py&&sudo python Forwarder_AMA_installer.py"
          },
          "type": "CopyableLabel"
        }
      ]
    }
  ]
}