Hi, how can we achieve creating additional fields for logs being processed in "CommonSecurityLog" (https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/commonsecuritylog) when sending in logs using the described log connector from Azure Sentinel using Syslog? At the moment incoming data gets mapped to fields like "DeviceCustomString1" or "DeviceCustomString1Label" using CEF. Is it possible creating additional/custom fields in "CommonSecurityLog"?!
We try connecting Palo Alto Networks firewalling infrastructure to Azure Log Analytics / Sentinel exactly following the guide (Azure Sentinel workspaces > Azure Sentinel | Data connectors > Palo Alto Networks) in Sentinel but we see a lot of incoming data being mapped to fields like "DeviceCustomString1" which don't have a characteristic name. (e.g. "Session ID" -> "DeviceCustomString1", Rule Name -> "DeviceCustomString2"). The real field names get stored in the label fields like "DeviceCustomString2Label".
Many thanks and really appreciate your help on that!!
For better or worse, this is how CEF works. You can create a better view for your analyst or rule writer in Azure Sentinel by using KQL functions as describe in Using KQL functions to speed up analysis in Azure Sentinel that will rename the relevant fields to your liking.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!