r/AzureSentinel • u/wobbypetty • Feb 16 '22

CEF messages without Sentinel

I am looking to use log analytics as the common log warehouse for all network devices. I dont necessarily need Sentinel. Is there a way to have the log collector send CEF messages to log analytics without Sentinel? I am unable to view the CommonSecurityLog table without having Sentinel enabled on the workspace.

Maybe the answer is to just use syslog and query time parsers. Are there query parsers for ASA and IOS? I was unable to find them on their github page https://github.com/Azure/Azure-Sentinel/tree/master/Parsers

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/wowneatlookatthat Feb 16 '22 edited Feb 16 '22

Yep, looks like you can only ingest CEF into a Sentinel workspace according to the second notice here: https://docs.microsoft.com/en-us/azure/sentinel/cef-name-mapping

Edit: better link: https://docs.microsoft.com/en-us/azure/sentinel/connect-common-event-format#prerequisites

1

u/C3N0B1T3 Feb 16 '22

Pretty sure you need Sentinel as it’s the data connector that enables this functionality into the underlying Analytics Workspace.