Blog Post

Microsoft Sentinel Blog
12 MIN READ

Azure Sentinel: The connectors grand (CEF, Syslog, Direct, Agent, Custom and more)

Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Aug 14, 2019
(Last updated Apr 20th, 2021)   Please note that as the built-in list of connectors in Azure Sentinel is growing, this list is not actively maintained anymore. Refer to the Azure Sentinel connect...
Updated Sep 30, 2021
Version 171.0
Connectors
Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Dec 24, 2019

majo1 :

 

First to your specific challenge: since the events are Syslog, they require setting up the Syslog connector rather than, or in addition to, the CEF connector. As things are now, the Syslog messages are rejected.

 

To have a single connector VM support both CEF and Syslog:

  1. Install the CEF connector VM using the instructions in the connector page (the new procedure in case yours was setup before October).
  2. Configure the facilities & priorities that you want to get Syslog messages of using Settings -> Workspace Settings -> Advanced Settings -> Data -> Syslog
  3. Make sure that the facility/priority combination used by your CEF source is not configured for Syslog collection

 

That’s it. If #3 is not doable, we will have to revert to config file editing on the VM.

 

As to your question:

  • You will need custom parsers as described in the custom connector blog post.
  • A troubleshooting script is available for CEF. For Syslog I suggest working with support.
  • Having a connector listed in the connector page implies parsing, however most of them are CEF, which means parsed as sent. This does not hold true for the list here.