Network / Security event

CommonSecurityLog

CEF-formatted events from firewalls, IDS/IPS, WAFs, and other security appliances. This record covers rows that match no source in shared-table-sources.json

Analytics Data lake Primary Secondary Primary · Analytics365 days retention

High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.

How the matrix works

C5 Network activity

Network activity: firewall, DNS, DHCP, web proxy, flow, load balancer, mail gateway and message flow, web access to internet-facing services

ACSC

2. Network device logs
8. Cloud platform logging
12. Windows DNS server analytic event logs

CISA

3. Network device infrastructure3a-3c DNS query and response, DHCP lease information, and firewall logs

MITRE data sources

Network Traffic: Network Traffic Flow
Network Traffic: Network Traffic Content

T1 Near-real-time detection

Generic detections need near-real-time matching on single events.

Lake supported in the Azure Monitor table feature matrix

Sources in this table

40 sources share CommonSecurityLog. Each has its own classification, and the record on this page covers only rows that match none of them.

Source	Filter	Classification	Tier	Retention
Acronis Cyber Protect (CEF)	`DeviceVendor =~ "Acronis"`	Primary	Analytics	365 days
Acronis Cyber Protect audit (CEF)	`DeviceVendor =~ "Acronis audit"`	Primary	Analytics	365 days
Akamai SIEM (CEF)	`DeviceVendor =~ "Akamai" and DeviceProduct =~ "akamai_siem"`	Primary	Analytics	365 days
Arista Awake Security (CEF)	`DeviceVendor =~ "Arista Networks" and DeviceProduct =~ "Awake Security"`	Primary	Analytics	365 days
Aruba ClearPass (CEF)	`DeviceVendor =~ "Aruba Networks" and DeviceProduct =~ "ClearPass"`	Primary	Data lake	365 days
Cisco ASA and Firepower Threat Defense (CEF)	`DeviceVendor =~ "Cisco" and (DeviceProduct has "ASA" or DeviceProduct has "FTD")`	Primary	Data lakesplit hint	180 days
Citrix NetScaler ADC (CEF)	`DeviceVendor =~ "Citrix" and DeviceProduct =~ "NetScaler"`	Primary	Analytics	365 days
Claroty (CEF)	`DeviceVendor =~ "Claroty"`	Primary	Analytics	365 days
Contrast Security (CEF)	`DeviceVendor =~ "Contrast Security"`	Primary	Analytics	365 days
CrowdStrike Falcon event stream (CEF)	`DeviceVendor =~ "CrowdStrike" and DeviceProduct =~ "FalconHost"`	Primary	Analytics	365 days
Dragos Platform (CEF)	`DeviceVendor =~ "Dragos" and DeviceProduct =~ "Platform"`	Primary	Analytics	365 days
FireEye NX (CEF)	`DeviceVendor =~ "FireEye"`	Primary	Analytics	365 days
ForgeRock (CEF)	`DeviceVendor =~ "ForgeRock Inc"`	Primary	Analytics	365 days
Fortinet FortiGate (CEF)	`DeviceVendor =~ "Fortinet" and DeviceProduct startswith "FortiGate"`	Primary	Data lake	180 days
Fortinet FortiWeb (CEF)	`DeviceVendor =~ "Fortinet" and DeviceProduct has "Fortiweb"`	Primary	Analytics	365 days
iboss (CEF)	`DeviceVendor =~ "iboss"`	Primary	Data lake	180 days
Illumio Core (CEF)	`DeviceVendor =~ "Illumio"`	Primary	Data lake	180 days
Illusive (CEF)	`DeviceProduct =~ "illusive"`	Primary	Analytics	365 days
Infoblox Cloud Data Connector (CEF)	`DeviceVendor =~ "Infoblox" and DeviceProduct =~ "Data Connector"`	Primary	Data lakesplit hint	180 days
IronNet IronDefense (CEF)	`DeviceProduct =~ "IronDefense"`	Primary	Analytics	365 days
Netwrix Auditor (CEF)	`DeviceVendor =~ "Netwrix"`	Primary	Analytics	365 days
Netwrix StealthDEFEND (CEF)	`DeviceVendor =~ "STEALTHbits Technologies" and DeviceProduct =~ "StealthDEFEND"`	Primary	Analytics	365 days
Nozomi Networks (CEF)	`DeviceVendor has "Nozomi"`	Primary	Analytics	365 days
One Identity Safeguard (CEF)	`DeviceVendor =~ "OneIdentity"`	Primary	Analytics	365 days
OSSEC (CEF)	`DeviceVendor has "OSSEC"`	Primary	Analytics	365 days
Palo Alto Networks Cortex Data Lake (CEF)	`DeviceVendor =~ "Palo Alto Networks" and DeviceProduct =~ "LF"`	Primary	Data lake	180 days
Palo Alto Networks Cortex XDR (CEF)	`DeviceVendor =~ "Palo Alto Networks" and DeviceProduct =~ "Cortex XDR"`	Primary	Analytics	365 days
Palo Alto Networks PAN-OS (CEF)	`DeviceVendor =~ "Palo Alto Networks" and DeviceProduct =~ "PAN-OS"`	Primary	Data lakesplit hint	180 days
PingFederate (CEF)	`DeviceProduct has "PingFederate"`	Primary	Analytics	365 days
Radiflow (CEF)	`DeviceVendor =~ "radiflow"`	Primary	Analytics	365 days
Ridge Security RidgeBot (CEF)	`DeviceVendor =~ "RidgeSecurity"`	Primary	Data lake	365 days
Silverfort (CEF)	`DeviceVendor has "Silverfort" and DeviceProduct has "Admin Console"`	Primary	Analytics	365 days
Symantec DLP (CEF)	`DeviceVendor =~ "Symantec" and DeviceProduct =~ "DLP"`	Primary	Analytics	365 days
TippingPoint IPS (CEF)	`DeviceVendor =~ "TippingPoint" and DeviceProduct =~ "UnityOne"`	Primary	Analytics	365 days
Trend Micro Apex Central (CEF)	`DeviceVendor =~ "Trend Micro" and DeviceProduct =~ "Apex Central"`	Primary	Analytics	365 days
Trend Micro Deep Security (CEF)	`(DeviceVendor =~ "Trend Micro" or DeviceVendor =~ "TrendMicro") and DeviceProduct startswith "Deep Security"`	Primary	Analytics	365 days
vArmour Application Controller (CEF)	`DeviceVendor =~ "vArmour" and DeviceProduct =~ "AC"`	Primary	Data lakesplit hint	180 days
Vectra X Series (CEF)	`DeviceVendor =~ "Vectra Networks" and DeviceProduct =~ "X Series"`	Primary	Analytics	365 days
Wazuh (CEF)	`DeviceProduct =~ "Wazuh"`	Primary	Analytics	365 days
Zscaler Internet Access web logs (CEF)	`DeviceVendor =~ "Zscaler" and DeviceProduct =~ "NSSWeblog"`	Primary	Data lakesplit hint	180 days

Build the split rule for CommonSecurityLog

A table has one split rule. Select the sources you collect to combine them into one condition. Rows that match stay in Analytics and are mirrored to the data lake. All other rows go to CommonSecurityLog_SPLT.

I also collect sources that are not listed. They follow the CommonSecurityLog record: Analytics, 365 days.

CommonSecurityLog retention
CommonSecurityLog_SPLT retention

Retention is set per table. The values are the highest recommendation among the selected sources on each side. Data lake sources without a split hint keep no rows in Analytics.

Fields detections use

High-value fields

ActivityApplicationProtocolDestinationIPDestinationPortDestinationUserNameDeviceActionDeviceEventClassIDDeviceNameDeviceProductDeviceVendorLogSeverityMessageProtocolRequestMethodRequestURLSimplifiedDeviceActionSourceHostNameSourceIPSourcePortSourceUserNameTimeGenerated

Most used in public rules

DeviceVendor81
TimeGenerated68
SourceIP58
DestinationIP47
DeviceProduct47
DeviceEventClassID42
DeviceAction39
Activity29
DeviceName25
RequestURL25
DestinationPort18
Message17

Parsers that read this table

CiscoSEGEvent21 rules
PingFederateEvent21 rules
ClarotyEvent20 rules
PaloAltoCDLEvent20 rules
TMApexOneEvent20 rules
RadiflowEvent8 rules
InfobloxCDC6 rules
Fortiweb3 rules
CrowdStrikeFalconEventStream2 rules
InfobloxCDC_SOCInsights2 rules

Split hints

Rows to keep in Analytics with a split rule. On a shared table, these apply only to rows that match no source.

Keep denied/blocked/alert actions and high-severity events in Analytics

(DeviceAction has "Deny" or DeviceAction has "Block" or DeviceAction has "Drop" or DeviceAction has "Reject" or DeviceAction has "Alert" or DeviceAction has "Reset") or toint(LogSeverity) >= 7

Sources for this recommendation

Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.