Log baseline v0.5.1
GitHub
CommonSecurityLog
Source inside CommonSecurityLog

Radiflow (CEF)

Radiflow OT/ICS network monitoring events for industrial control system threat detection

Recommendation

AnalyticsData lakePrimarySecondaryPrimary ยท Analytics365 days retention

High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.

Retention is set per table, so the retention for this source is advisory.

How the matrix works

C1 Detections and findings

Detections, alerts, incidents, security findings (vulnerability and posture findings), and detection pipeline health

T1 Near-real-time detection

Generic detections need near-real-time matching on single events.

Rows that belong to this source

DeviceVendor =~ "radiflow"

Rules query these rows through the RadiflowEvent parser.

Sources for this recommendation

  • Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
  • Azure-Sentinel public content corpus Table identity and usage evidence from public analytics rules, hunting queries, parsers, and solution content. Classification, tier, retention, and billing recommendations require human review.
  • Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
  • Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.