Connecting Firewalls to Azure Log Analytics / Sentinel CEF map log fields

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Connecting Firewalls to Azure Log Analytics / Sentinel CEF map log fields

L0 Member

Hi, how can we achieve creating additional fields for logs being processed in "CommonSecurityLog" (https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/commonsecuritylog) when sending in logs using the described log connector from Azure Sentinel using Syslog? At the moment incoming data gets mapped to fields like "DeviceCustomString1" or "DeviceCustomString1Label" using CEF. Is it possible creating additional/custom fields in "CommonSecurityLog"?!

 

We try connecting Palo Alto Networks firewalling infrastructure to Azure Log Analytics / Sentinel exactly following the guide (Azure Sentinel workspaces > Azure Sentinel | Data connectors > Palo Alto Networks) in Sentinel but we see a lot of incoming data being mapped to fields like "DeviceCustomString1" which don't have a characteristic name. (e.g. "Session ID" -> "DeviceCustomString1", Rule Name -> "DeviceCustomString2"). The real field names get stored in the label fields like "DeviceCustomString2Label".

 

Many thanks and really appreciate your help on that!!

 

Snap 2020-08-10 at 13.57.21p.pngSnap 2020-08-10 at 13.56.27.png

2 REPLIES 2

L0 Member

For better or worse, this is how CEF works. You can create a better view for your analyst or rule writer in Azure Sentinel by using KQL functions as describe in Using KQL functions to speed up analysis in Azure Sentinel that will rename the relevant fields to your liking.

Many thanks for your help on renaming relevant fields! That's great!

  • 8400 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!