Connecting Firewalls to Azure Log Analytics / Sentinel CEF map log fields

[pschoenegger-gm]

Hi, how can we achieve creating additional fields for logs being processed in "CommonSecurityLog" (https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/commonsecuritylog) when sending in logs using the described log connector from Azure Sentinel using Syslog? At the moment incoming data gets mapped to fields like "DeviceCustomString1" or "DeviceCustomString1Label" using CEF. Is it possible creating additional/custom fields in "CommonSecurityLog"?!

We try connecting Palo Alto Networks firewalling infrastructure to Azure Log Analytics / Sentinel exactly following the guide (Azure Sentinel workspaces > Azure Sentinel | Data connectors > Palo Alto Networks) in Sentinel but we see a lot of incoming data being mapped to fields like "DeviceCustomString1" which don't have a characteristic name. (e.g. "Session ID" -> "DeviceCustomString1", Rule Name -> "DeviceCustomString2"). The real field names get stored in the label fields like "DeviceCustomString2Label".

Many thanks and really appreciate your help on that!!

[Shezaf]

For better or worse, this is how CEF works. You can create a better view for your analyst or rule writer in Azure Sentinel by using KQL functions as describe in Using KQL functions to speed up analysis in Azure Sentinel that will rename the relevant fields to your liking.

[pschoenegger-gm]

Many thanks for your help on renaming relevant fields! That's great!