Skip to content

Commit 921c6ec

Browse files
cwatson-catcwatson-cat
committed
Sentinel - Restore CEF name mapping file
1 parent d6ed2a1 commit 921c6ec

File tree

3 files changed

+259
-5
lines changed

3 files changed

+259
-5
lines changed

‎.openpublishing.redirection.sentinel.json

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,5 @@
11
{
22
"redirections": [
3-
{
4-
"source_path": "articles/sentinel/cef-name-mapping.md",
5-
"redirect_url": "/azure/sentinel/cef-syslog-ama-overview",
6-
"redirect_document_id": false
7-
},
83
{
94
"source_path": "articles/sentinel/detect-threats-built-in.md#use-analytics-rule-templates",
105
"redirect_url": "/azure/sentinel/create-analytics-rule-from-template",

‎articles/sentinel/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1303,6 +1303,8 @@
13031303
href: data-source-schema-reference.md
13041304
- name: Security alert schema reference
13051305
href: security-alert-schema.md
1306+
- name: CEF log field mapping
1307+
href: cef-name-mapping.md
13061308
- name: Windows security event sets
13071309
href: windows-security-event-id-reference.md
13081310
- name: DNS over AMA reference

‎articles/sentinel/cef-name-mapping.md

Lines changed: 257 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,257 @@
1+
---
2+
title: Common Event Format (CEF) key and CommonSecurityLog field mapping
3+
description: This article maps CEF keys to the corresponding field names in the CommonSecurityLog in Microsoft Sentinel.
4+
author: yelevin
5+
ms.author: yelevin
6+
ms.topic: reference
7+
ms.date: 08/12/2024
8+
---
9+
10+
# CEF and CommonSecurityLog field mapping
11+
12+
The following tables map Common Event Format (CEF) field names to the names they use in Microsoft Sentinel's CommonSecurityLog, and might be helpful when you're working with a CEF data source in Microsoft Sentinel. For more information, see [Ingest syslog and CEF messages to Microsoft Sentinel with the Azure Monitor Agent](connect-cef-syslog-ama.md).
13+
14+
A Microsoft Sentinel workspace is required in order to [ingest CEF data](connect-common-event-format.md#prerequisites) into Log Analytics.
15+
16+
## A - C
17+
18+
|CEF key name |CommonSecurityLog field name |Description |
19+
|---------|---------|---------|
20+
| act | <a name="deviceaction"></a> DeviceAction | The action mentioned in the event. |
21+
| app | ApplicationProtocol | The protocol used in the application, such as HTTP, HTTPS, SSHv2, Telnet, POP, IMPA, IMAPS, and so on. |
22+
| cat | DeviceEventCategory | Represents the category assigned by the originating device. Devices often use their own categorization schema to classify event. For example: `/Monitor/Disk/Read`. |
23+
| cnt | EventCount | A count associated with the event, showing how many times the same event was observed. |
24+
25+
## D
26+
27+
|CEF key name |CommonSecurityLog name |Description |
28+
|---------|---------|---------|
29+
|Device Vendor | DeviceVendor | String that, together with device product and version definitions, uniquely identifies the type of sending device. |
30+
|Device Product | DeviceProduct | String that, together with device vendor and version definitions, uniquely identifies the type of sending device. |
31+
|Device Version | DeviceVersion | String that, together with device product and vendor definitions, uniquely identifies the type of sending device. |
32+
| destinationDnsDomain | DestinationDnsDomain | The DNS part of the fully qualified domain name (FQDN). |
33+
| destinationServiceName | DestinationServiceName | The service that is targeted by the event. For example, `sshd`.|
34+
| destinationTranslatedAddress | DestinationTranslatedAddress | Identifies the translated destination referred to by the event in an IP network, as an IPv4 IP address. |
35+
| destinationTranslatedPort | DestinationTranslatedPort | Port, after translation, such as a firewall. <br>Valid port numbers: `0` - `65535` |
36+
| deviceDirection | <a name="communicationdirection"></a> CommunicationDirection | Any information about the direction the observed communication has taken. Valid values: <br>- `0` = Inbound <br>- `1` = Outbound |
37+
| deviceDnsDomain | DeviceDnsDomain | The DNS domain part of the full qualified domain name (FQDN) |
38+
|DeviceEventClassID | DeviceEventClassID | String or integer that serves as a unique identifier per event type. |
39+
| deviceExternalId | deviceExternalId | A name that uniquely identifies the device generating the event. |
40+
| deviceFacility | DeviceFacility | The facility generating the event.|
41+
| deviceInboundInterface | DeviceInboundInterface |The interface on which the packet or data entered the device. |
42+
| deviceNtDomain | DeviceNtDomain | The Windows domain of the device address |
43+
| deviceOutboundInterface | DeviceOutboundInterface |Interface on which the packet or data left the device. |
44+
| devicePayloadId |DevicePayloadId |Unique identifier for the payload associated with the event. |
45+
| deviceProcessName | ProcessName | Process name associated with the event. <br><br>For example, in UNIX, the process generating the syslog entry. |
46+
| deviceTranslatedAddress | DeviceTranslatedAddress | Identifies the translated device address that the event refers to, in an IP network. <br><br>The format is an Ipv4 address. |
47+
| dhost |DestinationHostName | The destination that the event refers to in an IP network. <br>The format should be an FQDN associated with the destination node, when a node is available. For example, `host.domain.com` or `host`. |
48+
| dmac | DestinationMacAddress | The destination MAC address (FQDN) |
49+
| dntdom | DestinationNTDomain | The Windows domain name of the destination address.|
50+
| dpid | DestinationProcessId |The ID of the destination process associated with the event.|
51+
| dpriv | DestinationUserPrivileges | Defines the destination use's privileges. <br>Valid values: `Admninistrator`, `User`, `Guest` |
52+
| dproc | DestinationProcessName | The name of the event’s destination process, such as `telnetd` or `sshd.` |
53+
| dpt | DestinationPort | Destination port. <br>Valid values: `*0` - `65535` |
54+
| dst | DestinationIP | The destination IpV4 address that the event refers to in an IP network. |
55+
| dtz | DeviceTimeZone | Timezone of the device generating the event |
56+
| duid |DestinationUserId | Identifies the destination user by ID. |
57+
| duser | DestinationUserName |Identifies the destination user by name.|
58+
| dvc | DeviceAddress | The IPv4 address of the device generating the event. |
59+
| dvchost | DeviceName | The FQDN associated with the device node, when a node is available. For example, `host.domain.com` or `host`.|
60+
| dvcmac | DeviceMacAddress | The MAC address of the device generating the event. |
61+
| dvcpid | Process ID | Defines the ID of the process on the device generating the event. |
62+
63+
## E - I
64+
65+
|CEF key name |CommonSecurityLog name |Description |
66+
|---------|---------|---------|
67+
|externalId | ExternalID | An ID used by the originating device. Typically, these values have increasing values that are each associated with an event. |
68+
|fileCreateTime | FileCreateTime | Time when the file was created. |
69+
|fileHash | FileHash | Hash of a file. |
70+
|fileId | FileID |An ID associated with a file, such as the inode. |
71+
| fileModificationTime | FileModificationTime |Time when the file was last modified. |
72+
| filePath | FilePath | Full path to the file, including the filename. For example: `C:\ProgramFiles\WindowsNT\Accessories\wordpad.exe` or `/usr/bin/zip`.|
73+
| filePermission |FilePermission |The file's permissions. |
74+
| fileType | FileType | File type, such as pipe, socket, and so on.|
75+
|fname | FileName| The file's name, without the path. |
76+
| fsize | FileSize | The size of the file. |
77+
|Host | Computer | Host, from Syslog |
78+
|in | ReceivedBytes |Number of bytes transferred inbound. |
79+
80+
81+
## M - P
82+
83+
|CEF key name |CommonSecurityLog name |Description |
84+
|---------|---------|---------|
85+
|msg | Message | A message that gives more details about the event. |
86+
|Name | Activity | A string that represents a human-readable and understandable description of the event. |
87+
|oldFileCreateTime | OldFileCreateTime | Time when the old file was created. |
88+
|oldFileHash | OldFileHash | Hash of the old file. |
89+
|oldFileId | OldFileId | And ID associated with the old file, such as the inode. |
90+
| oldFileModificationTime | OldFileModificationTime |Time when the old file was last modified. |
91+
| oldFileName | OldFileName |Name of the old file. |
92+
| oldFilePath | OldFilePath | Full path to the old file, including the filename. <br>For example, `C:\ProgramFiles\WindowsNT\Accessories\wordpad.exe` or `/usr/bin/zip`.|
93+
| oldFilePermission | OldFilePermission |Permissions of the old file. |
94+
|oldFileSize | OldFileSize | Size of the old file.|
95+
| oldFileType | OldFileType | File type of the old file, such as a pipe, socket, and so on.|
96+
| out | SentBytes | Number of bytes transferred outbound. |
97+
| outcome | EventOutcome | Outcome of the event, such as `success` or `failure`.|
98+
|proto | Protocol | Transport protocol that identifies the Layer-4 protocol used. <br><br>Possible values include protocol names, such as `TCP` or `UDP`. |
99+
100+
101+
## R - T
102+
103+
|CEF key name |CommonSecurityLog name |Description |
104+
|---------|---------|---------|
105+
| reason | Reason | The reason an audit event was generated. For example, `badd password` or `unknown user`. This could also be an error or return code. For example: `0x1234`. |
106+
|Request | RequestURL | The URL accessed for an HTTP request, including the protocol. For example, `http://www/secure.com` |
107+
|requestClientApplication | RequestClientApplication | The user agent associated with the request. |
108+
| requestContext | RequestContext | Describes the content from which the request originated, such as the HTTP Referrer. |
109+
| requestCookies | RequestCookies |Cookies associated with the request. |
110+
| requestMethod | RequestMethod | The method used to access a URL. <br><br>Valid values include methods such as `POST`, `GET`, and so on. |
111+
| rt | ReceiptTime | The time at which the event related to the activity was received. |
112+
|Severity | <a name="logseverity"></a> LogSeverity | A string or integer that describes the importance of the event.<br><br> Valid string values: `Unknown` , `Low`, `Medium`, `High`, `Very-High` <br><br>Valid integer values are:<br> - `0`-`3` = Low <br>- `4`-`6` = Medium<br>- `7`-`8` = High<br>- `9`-`10` = Very-High |
113+
| shost | SourceHostName |Identifies the source that event refers to in an IP network. Format should be a fully qualified domain name (DQDN) associated with the source node, when a node is available. For example, `host` or `host.domain.com`. |
114+
| smac | SourceMacAddress | Source MAC address. |
115+
| sntdom | SourceNTDomain | The Windows domain name for the source address. |
116+
| sourceDnsDomain | SourceDnsDomain | The DNS domain part of the complete FQDN. |
117+
| sourceServiceName | SourceServiceName | The service responsible for generating the event. |
118+
| sourceTranslatedAddress | SourceTranslatedAddress | Identifies the translated source that the event refers to in an IP network. |
119+
| sourceTranslatedPort | SourceTranslatedPort | Source port after translation, such as a firewall. <br>Valid port numbers are `0` - `65535`. |
120+
| spid | SourceProcessId | The ID of the source process associated with the event.|
121+
| spriv | SourceUserPrivileges | The source user's privileges. <br><br>Valid values include: `Administrator`, `User`, `Guest` |
122+
| sproc | SourceProcessName | The name of the event's source process.|
123+
| spt | SourcePort | The source port number. <br>Valid port numbers are `0` - `65535`. |
124+
| src | SourceIP |The source that an event refers to in an IP network, as an IPv4 address. |
125+
| suid | SourceUserID | Identifies the source user by ID. |
126+
| suser | SourceUserName | Identifies the source user by name. |
127+
| type | EventType | Event type. Value values include: <br>- `0`: base event <br>- `1`: aggregated <br>- `2`: correlation event <br>- `3`: action event <br><br>**Note**: This event can be omitted for base events. |
128+
129+
130+
## Custom fields
131+
132+
The following tables map the names of CEF keys and CommonSecurityLog fields that are available for customers to use for data that doesn't apply to any of the built-in fields.
133+
134+
### Custom IPv6 address fields
135+
136+
The following table maps CEF key and CommonSecurityLog names for the *IPv6* address fields available for custom data.
137+
138+
|CEF key name |CommonSecurityLog name |
139+
|---------|---------|
140+
| c6a1 | DeviceCustomIPv6Address1 |
141+
| c6a1Label | DeviceCustomIPv6Address1Label |
142+
| c6a2 | DeviceCustomIPv6Address2 |
143+
| c6a2Label | DeviceCustomIPv6Address2Label |
144+
| c6a3 | DeviceCustomIPv6Address3 |
145+
| c6a3Label | DeviceCustomIPv6Address3Label |
146+
| c6a4 | DeviceCustomIPv6Address4 |
147+
| c6a4Label | DeviceCustomIPv6Address4Label |
148+
| cfp1 | DeviceCustomFloatingPoint1 |
149+
| cfp1Label | deviceCustomFloatingPoint1Label |
150+
| cfp2 | DeviceCustomFloatingPoint2 |
151+
| cfp2Label | deviceCustomFloatingPoint2Label |
152+
| cfp3 | DeviceCustomFloatingPoint3 |
153+
| cfp3Label | deviceCustomFloatingPoint3Label |
154+
| cfp4 | DeviceCustomFloatingPoint4 |
155+
| cfp4Label | deviceCustomFloatingPoint4Label |
156+
157+
158+
### Custom number fields
159+
160+
The following table maps CEF key and CommonSecurityLog names for the *number* fields available for custom data.
161+
162+
|CEF key name |CommonSecurityLog name |
163+
|---------|---------|
164+
| cn1 | DeviceCustomNumber1 |
165+
| cn1Label | DeviceCustomNumber1Label |
166+
| cn2 | DeviceCustomNumber2 |
167+
| cn2Label | DeviceCustomNumber2Label |
168+
| cn3 | DeviceCustomNumber3 |
169+
| cn3Label | DeviceCustomNumber3Label |
170+
171+
172+
### Custom string fields
173+
174+
The following table maps CEF key and CommonSecurityLog names for the *string* fields available for custom data.
175+
176+
|CEF key name |CommonSecurityLog name |
177+
|---------|---------|
178+
| cs1 | DeviceCustomString1 <sup>[1](#use-sparingly)</sup> |
179+
| cs1Label | DeviceCustomString1Label <sup>[1](#use-sparingly)</sup> |
180+
| cs2 | DeviceCustomString2 <sup>[1](#use-sparingly)</sup> |
181+
| cs2Label | DeviceCustomString2Label <sup>[1](#use-sparingly)</sup> |
182+
| cs3 | DeviceCustomString3 <sup>[1](#use-sparingly)</sup> |
183+
| cs3Label | DeviceCustomString3Label <sup>[1](#use-sparingly)</sup> |
184+
| cs4 | DeviceCustomString4 <sup>[1](#use-sparingly)</sup> |
185+
| cs4Label | DeviceCustomString4Label <sup>[1](#use-sparingly)</sup> |
186+
| cs5 | DeviceCustomString5 <sup>[1](#use-sparingly)</sup> |
187+
| cs5Label | DeviceCustomString5Label <sup>[1](#use-sparingly)</sup> |
188+
| cs6 | DeviceCustomString6 <sup>[1](#use-sparingly)</sup> |
189+
| cs6Label | DeviceCustomString6Label <sup>[1](#use-sparingly)</sup> |
190+
| flexString1 | FlexString1 |
191+
| flexString1Label | FlexString1Label |
192+
| flexString2 | FlexString2 |
193+
| flexString2Label | FlexString2Label |
194+
195+
196+
> [!TIP]
197+
> <a name="use-sparingly"></a><sup>1</sup> We recommend that you use the **DeviceCustomString** fields sparingly and use more specific, built-in fields when possible.
198+
>
199+
### Custom timestamp fields
200+
201+
The following table maps CEF key and CommonSecurityLog names for the *timestamp* fields available for custom data.
202+
203+
|CEF key name |CommonSecurityLog name |
204+
|---------|---------|
205+
| deviceCustomDate1 | DeviceCustomDate1 |
206+
| deviceCustomDate1Label | DeviceCustomDate1Label |
207+
| deviceCustomDate2 | DeviceCustomDate2 |
208+
| deviceCustomDate2Label | DeviceCustomDate2Label |
209+
| flexDate1 | FlexDate1 |
210+
| flexDate1Label | FlexDate1Label |
211+
212+
213+
### Custom integer data fields
214+
215+
The following table maps CEF key and CommonSecurityLog names for the *integer* fields available for custom data.
216+
217+
|CEF key name |CommonSecurityLog name |
218+
|---------|---------|
219+
| flexNumber1 | FlexNumber1 |
220+
| flexNumber1Label | FlexNumber1Label |
221+
| flexNumber2 | FlexNumber2 |
222+
| flexNumber2Label | FlexNumber2Label |
223+
224+
225+
## Enrichment fields
226+
227+
The following **CommonSecurityLog** fields are added by Microsoft Sentinel to enrich the original events received from the source devices, and don't have mappings in CEF keys:
228+
229+
### Threat intelligence fields
230+
231+
|CommonSecurityLog field name |Description |
232+
|---------|---------|
233+
| **IndicatorThreatType** | The [MaliciousIP](#MaliciousIP) threat type, according to the threat intelligence feed. |
234+
| <a name="MaliciousIP"></a>**MaliciousIP** | Lists any IP addresses in the message that correlates with the current threat intelligence feed. |
235+
| **MaliciousIPCountry** | The [MaliciousIP](#MaliciousIP) country/region, according to the geographic information at the time of the record ingestion. |
236+
| **MaliciousIPLatitude** | The [MaliciousIP](#MaliciousIP) longitude, according to the geographic information at the time of the record ingestion. |
237+
| **MaliciousIPLongitude** | The [MaliciousIP](#MaliciousIP) longitude, according to the geographic information at the time of the record ingestion. |
238+
| **ReportReferenceLink** | Link to the threat intelligence report. |
239+
| **ThreatConfidence** | The [MaliciousIP](#MaliciousIP) threat confidence, according to the threat intelligence feed. |
240+
| **ThreatDescription** | The [MaliciousIP](#MaliciousIP) threat description, according to the threat intelligence feed. |
241+
| **ThreatSeverity** | The threat severity for the [MaliciousIP](#MaliciousIP), according to the threat intelligence feed at the time of the record ingestion. |
242+
243+
244+
### Other enrichment fields
245+
246+
|CommonSecurityLog field name |Description |
247+
|---------|---------|
248+
|**OriginalLogSeverity** | Always empty, supported for integration with CiscoASA. <br>For details about log severity values, see the [LogSeverity](#logseverity) field. |
249+
|**RemoteIP** | The remote IP address. <br>This value is based on [CommunicationDirection](#communicationdirection) field, if possible. |
250+
|**RemotePort** | The remote port. <br>This value is based on [CommunicationDirection](#communicationdirection) field, if possible. |
251+
|**SimplifiedDeviceAction** | Simplifies the [DeviceAction](#deviceaction) value to a static set of values, while keeping the original value in the [DeviceAction](#deviceaction) field. <br>For example: `Denied` > `Deny`. |
252+
|**SourceSystem** | Always defined as **OpsManager**. |
253+
254+
255+
## Next steps
256+
257+
For more information, see [Connect your external solution using Common Event Format](connect-common-event-format.md).

0 commit comments

Comments
 (0)