← Integrations
Syslog (CEF)CEF export
Microsoft Sentinel
Point syslog forwarding at a Linux collector running the Azure Monitor Agent with the CEF data connector. Events land in CommonSecurityLog with DeviceVendor Securd.
Integration steps for Microsoft Sentinel
Turn on syslog forwarding
In the console, under Settings, Log Forwarding, set the collector host and port. Events are forwarded in real time. This is the method for continuous ingestion; the API export is for backfill and ad hoc retrieval.
Settings > Log Forwarding
Syslog host: collector.example.internal
Syslog port: 514
Collector
Deploy the AMA-based CEF connector from the Sentinel content hub, register the collector VM, and confirm port 514 is open from the Securd side.
collector.sh
sudo wget -O Forwarder_AMA_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Forwarder_AMA_installer.py
sudo python3 Forwarder_AMA_installer.py
Sample events
securd.cef
CEF:0|Securd|DNS|2.0|greywall|api.newai-svc.xyz|5|src=10.40.3.17 dhost=api.newai-svc.xyz cat= reason=first-seen
CEF:0|Securd|DNS|2.0|block|exfil-data.click|7|src=10.40.3.17 dhost=exfil-data.click cat=malware reason=blacklist
CEF:0|Securd|DNS|2.0|accept|api.openai.com|1|src=10.40.3.17 dhost=api.openai.com cat=ai-services reason=policy
Verification
Two queries: one confirms ingestion, one lists first-seen destinations by policy.
Last 10 events arrived
kql
CommonSecurityLog
| where DeviceVendor == "Securd"
| top 10 by TimeGenerated
| project TimeGenerated, DeviceEventClassID, DestinationHostName, SourceIP, DeviceCustomString1First-seen spike per source, last 24h (analytics rule candidate)
kql
CommonSecurityLog
| where DeviceVendor == "Securd" and DeviceEventClassID == "greywall"
| where TimeGenerated > ago(24h)
| summarize held = dcount(DestinationHostName), first = min(TimeGenerated) by SourceIP
| where held > 20
| order by held descEvaluate Agent DNS with your own agent traffic
Forward events from a single policy and review them with your security team.