Forum Discussion
Do Microsoft Defender for Identity SIEM logs conform to CEF format?
Microsoft Defender for Identity SIEM log reference page says "Alerts and events are in the CEF format." CEF spec Version 25 (I used one from that page: https://community.microfocus.com/cyberres/p...
- Effectively, yes, if you want to use a "pure" CEF format, then RFC3164 will work better for you.
It's main disadvantage is that it does not support Unicode, only ASCII.
And yes, the technical writes of ATA used the RFC3164 for samples there (or a mix), but I advise not to rely on ATA docs for MDI reference, as things often work differently between the two and it might be confusing.
EliOfek
Microsoft
MicrosoftIn the syslog configuration, select RFC3164 to get the header in the requested format.
MDI sends that data in RFC 3164 or RFC5424 (default) , and the payload itself inside it is in CEF format.
If you select RFC 3164 it will look like this:
05-13-2019 16:55:11 Auth.Warning 192.168.0.77 May 13 13:55:00 TESTMACHINE CEF:0|Microsoft|Azure ATP|2.78.0.0|AccountEnumerationSecurityAlert|Account enumeration reconnaissance|5|start=2019-05-13T13:51:55.6029975Z app=Ntlm shost=CLIENT2 msg=An actor on CLIENT2 performed suspicious account enumeration exposing Eugene Jenkins (Software Engineer). externalId=2003 cs1Label=url cs1=https://sample.atp.azure.com/securityAlert/9d7ce723-0698-443e-b3a2-4cb985029660 cs2Label=trigger cs2=new
MDI sends that data in RFC 3164 or RFC5424 (default) , and the payload itself inside it is in CEF format.
If you select RFC 3164 it will look like this:
05-13-2019 16:55:11 Auth.Warning 192.168.0.77 May 13 13:55:00 TESTMACHINE CEF:0|Microsoft|Azure ATP|2.78.0.0|AccountEnumerationSecurityAlert|Account enumeration reconnaissance|5|start=2019-05-13T13:51:55.6029975Z app=Ntlm shost=CLIENT2 msg=An actor on CLIENT2 performed suspicious account enumeration exposing Eugene Jenkins (Software Engineer). externalId=2003 cs1Label=url cs1=https://sample.atp.azure.com/securityAlert/9d7ce723-0698-443e-b3a2-4cb985029660 cs2Label=trigger cs2=new
Thank you for the reply!
So it seems to me that when MDI logs are sent in RFC3164, it conforms to CEF, while when MDI logs are sent in RFC5424, it does not (because "CEF:" part is omitted). Is that correct?
At the same time, it looks like https://docs.microsoft.com/en-us/advanced-threat-analytics/cef-format-sa has examples that are in RFC5424, while "CEF:" part of the header is present, so it conforms to CEF format.- EliOfekEffectively, yes, if you want to use a "pure" CEF format, then RFC3164 will work better for you.
It's main disadvantage is that it does not support Unicode, only ASCII.
And yes, the technical writes of ATA used the RFC3164 for samples there (or a mix), but I advise not to rely on ATA docs for MDI reference, as things often work differently between the two and it might be confusing.
