/
cef0.microsoft

cef0.microsoft

Introduction

The tags beginning with cef0.microsoft identify events in CEF format generated by Microsoft.

Tag structure

Events in CEF format don't have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

Tags

Data tables

Tags

Data tables

cef0.microsoft.adFs

cef0.microsoft.adFs

cef0.microsoft.azureActiveDirectory

cef0.microsoft.azureActiveDirectory

cef0.microsoft.azureActivity

cef0.microsoft.azureActivity

cef0.microsoft.azureIdentityAndAccess

cef0.microsoft.azureIdentityAndAccess

cef0.microsoft.azureReports

cef0.microsoft.azureReports

cef0.microsoft.azureSecurityCenter

cef0.microsoft.azureSecurityCenter

cef0.microsoft.compliance

cef0.microsoft.compliance

cef0.microsoft.crm

cef0.microsoft.crm

cef0.microsoft.dhcpServer

cef0.microsoft.dhcpServer

cef0.microsoft.dnsTraceLog

cef0.microsoft.dnsTraceLog

cef0.microsoft.esent

cef0.microsoft.esent

cef0.microsoft.exchangeOnline

cef0.microsoft.exchangeOnline

cef0.microsoft.exchangeServer

cef0.microsoft.exchangeServer

cef0.microsoft.forefrontProtection

cef0.microsoft.forefrontProtection

cef0.microsoft.gene6

cef0.microsoft.gene6

cef0.microsoft.iis

cef0.microsoft.iis

cef0.microsoft.internetInformationServer

cef0.microsoft.internetInformationServer

cef0.microsoft.isaServer

cef0.microsoft.isaServer

cef0.microsoft.localAdministratorPasswordSolution

cef0.microsoft.localAdministratorPasswordSolution

cef0.microsoft.microsoftAntimalware

cef0.microsoft.microsoftAntimalware

cef0.microsoft.microsoftAzuremfaAuthz

cef0.microsoft.microsoftAzuremfaAuthz

cef0.microsoft.microsoftFlow

cef0.microsoft.microsoftFlow

cef0.microsoft.microsoftStream

cef0.microsoft.microsoftStream

cef0.microsoft.microsoftTeams

cef0.microsoft.microsoftTeams

cef0.microsoft.microsoftWindows

cef0.microsoft.microsoftWindows

cef0.microsoft.microsoftWindowsWindowsupdateclient

cef0.microsoft.microsoftWindowsWindowsupdateclient

cef0.microsoft.nps

cef0.microsoft.nps

cef0.microsoft.o365Alerts

cef0.microsoft.o365Alerts

cef0.microsoft.onedrive

cef0.microsoft.onedrive

cef0.microsoft.powerapps

cef0.microsoft.powerapps

cef0.microsoft.powerbi

cef0.microsoft.powerbi

cef0.microsoft.projectOnline

cef0.microsoft.projectOnline

cef0.microsoft.radius

cef0.microsoft.radius

cef0.microsoft.sccm_fep

cef0.microsoft.sccm_fep

cef0.microsoft.securityComplianceCenter

cef0.microsoft.securityComplianceCenter

cef0.microsoft.sharepointOnline

cef0.microsoft.sharepointOnline

cef0.microsoft.sqlServer

cef0.microsoft.sqlServer

cef0.microsoft.systemOrApplicationEvent

cef0.microsoft.systemOrApplicationEvent

cef0.microsoft.threatIntelligence

cef0.microsoft.threatIntelligence

cef0.microsoft.vmcomputer

cef0.microsoft.vmcomputer

cef0.microsoft.windows

cef0.microsoft.windows

cef0.microsoft.windowsDefenderAtp

cef0.microsoft.windowsDefenderAtp

cef0.microsoft.yammer

cef0.microsoft.yammer

How is the data sent to Devo?

CEF data can be sent directly to Devo or by using a relay. To use the CEF default relay rule, send to the relay’s port 13000. Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Related content

cef0.mcafee
cef0.mcafee
More like this
cef0.cisco
cef0.cisco
More like this
cef0.cisco
cef0.cisco
More like this
cef0.cisco
cef0.cisco
More like this
cef0.kaspersky
cef0.kaspersky
More like this
cef0.amazon
cef0.amazon
More like this