Sep 02 2021 02:12 AM - edited Sep 02 2021 02:55 AM
Microsoft Defender for Identity SIEM log reference page says "Alerts and events are in the CEF format."
CEF spec Version 25 (I used one from that page: https://community.microfocus.com/cyberres/productdocs/w/connector-documentation/38809/arcsight-commo...) states that "The CEF:Version portion of the message is a mandatory header."
Examples for Microsoft Defender for Identity SIEM logs, however, seems to diverge from that.
For instance, example for "Account enumeration reconnaissance":
02-21-2018 16:19:35 Auth.Warning 192.168.0.220 1 2018-02-21T14:19:27.540731+00:00 CENTER CEF 6076 AccountEnumerationSecurityAlert 0|Microsoft|Azure ATP|2.22.4228.22540|AccountEnumerationSecurityAlert|Reconnaissance using account enumeration|5|start=2018-02-21T14:19:02.6045416Z app=Kerberos shost=CLIENT1 suser=LMaldonado msg=Suspicious account enumeration activity using the Kerberos protocol, originating from CLIENT1, was observed and successfully guessed Lamon Maldonado (Software Engineer). externalId=2003 cs1Label=url cs1=https://contoso-corp.atp.azure.com/securityAlert/eb6a35da-ff7f-4ab5-a1b5-a07529a89e6d cs2Label=trigger cs2=new
As can be seen above, (ignoring syslog header and "") CEF message starts with "0|Microsoft|" where 0 is presumably Version, but "CEF:" part is omitted.
The question is: do Microsoft Defender for Identity SIEM logs actually conform to CEF format?
Also, I've found that examples on the other page - ATA SIEM log reference - contain "CEF:0" part.
Thank you!
Sep 02 2021 02:55 AM
Sep 02 2021 03:23 AM - edited Sep 02 2021 03:25 AM
Thank you for the reply!
So it seems to me that when MDI logs are sent in RFC3164, it conforms to CEF, while when MDI logs are sent in RFC5424, it does not (because "CEF:" part is omitted). Is that correct?
At the same time, it looks like https://docs.microsoft.com/en-us/advanced-threat-analytics/cef-format-sa has examples that are in RFC5424, while "CEF:" part of the header is present, so it conforms to CEF format.
Sep 02 2021 03:41 PM
SolutionSep 02 2021 03:41 PM
Solution