---
url: https://docs.realmsec.info/integration/cef.md
---

# Custom Application Logs: CEF Format

Realm supports ingesting custom logs in CEF (Common Event Format) from any source. Choose a transport method based on where your log source runs and how it delivers data.

| Transport | Best for |
|---|---|
| [AWS S3](#aws-s3) | Logs already delivered to an S3 bucket |
| [Azure Blob Storage](#azure-blob-storage) | Logs already delivered to Azure Blob Storage |
| [Cloud HTTP (Webhook)](#cloud-http-webhook) | Sources that can POST CEF events over HTTPS |
| [Cloud OTLP](#cloud-otlp) | Sources that can export CEF logs over OpenTelemetry (OTLP/HTTP) |
| [Cloud Syslog](#cloud-syslog) | Sources that send CEF events wrapped in syslog to Realm Cloud |
| [Collector](#collector) | On-premises sources that cannot reach Realm Cloud directly |

## Create a Source in Realm

Before configuring any transport, create a source in Realm:

1. In Realm, go to **Sources > Add Source**.
2. Enter a name for your source.
3. Set **Product Format** to **Custom CEF**.
4. Click **Save**.

Then follow the section below for your chosen transport method.

***

## AWS S3

Use this transport when your log source delivers CEF log files to an S3 bucket.

### Add an AWS S3 Input Feed

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **AWS S3** and give it a name.
3. Enter the AWS credentials and S3/SQS configuration:

> **Access Key ID:** `<iam_access_key>`\
> **Secret Access Key:** `<iam_secret_key>`\
> **SQS Queue URL:** `<sqs_queue_url>`\
> **S3 Bucket Name:** `<bucket_name>`\
> **AWS Region:** `<region>`

4. Click **Save**.

### Configure AWS Resources

Set up the SQS queue, IAM policy, IAM user, and S3 event notifications to deliver object-create events to Realm. Follow the [AWS S3 source setup guide](/integration/aws-s3#aws-s3-as-a-source) for complete instructions — the setup is identical regardless of log format.

***

## Azure Blob Storage

Use this transport when your log source delivers CEF log files to an Azure Storage Container.

### Add an Azure Blob Storage Input Feed

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **Azure Blob Storage** and give it a name.
3. Enter the Azure credentials and storage configuration:

> **Tenant ID:** `<tenant_id>`\
> **Client ID:** `<client_id>`\
> **Client Secret:** `<client_secret>`\
> **Event Hub Namespace:** `<namespace>.servicebus.windows.net`\
> **Event Hub Name:** `<event_hub_name>`\
> **Storage Account Name:** `<storage_account_name>`\
> **Container Name:** `<container_name>`

4. Click **Save**.

### Configure Azure Resources

Set up the App Registration, Event Hub, Storage Account, and Event Grid notification subscription so Azure notifies Realm when new blobs are created. Follow the [Azure Blob Storage source setup guide](/integration/azure-blob-storage) for complete instructions — the setup is identical regardless of log format.

***

## Cloud HTTP (Webhook)

Use this transport when your log source can POST CEF events over HTTPS to a webhook URL.

### Add a Cloud HTTP Input Feed

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **Cloud HTTP** and give it a name.
3. Select an **Authentication Method** (`Auth Token`, `HMAC`, or `Shared Secret`) and fill in its fields. See [Authentication Methods](/integration/cloud_http#authentication-methods) to choose one.

   > **Note:** Shared Secret reads the secret from a field in a JSON request body, so it does not apply to CEF payloads. Use **Auth Token** or **HMAC** instead.
4. Click **Add**.
5. Click **`...` > View** on the input feed and copy the **Hostname**.
6. If you selected **Auth Token**, click **`...` > Edit** on the input feed, then click the eye icon in the **Token** field to view the token value.
7. By default, the webhook uses a public CA. You can switch to using a Realm private CA from the new or edit input feed form. After saving the feed, the Realm CA pem file will be shown on the **View** page. You can copy and paste it in to the source product.

### Configure Your Log Source

Configure your application or log pipeline to POST CEF events to the Realm **Hostname**, authenticating with the method configured on the input feed. For example, with **Auth Token**:

```shell
curl -X POST "<hostname>" \
  -H "Content-Type: text/plain" \
  -H "Authorization: Bearer <token>" \
  -d 'CEF:0|Security|threatmanager|1.0|100|worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2 spt=1232'
```

**Payload requirements:**

* `Content-Type` must be `text/plain`
* Each CEF event must be on its own line when sending multiple events in a single request

For HMAC and Shared Secret request examples and troubleshooting steps, see the [Cloud HTTP guide](/integration/cloud_http).

***

## Cloud OTLP

Use this transport when your log source or pipeline can export CEF logs using the OpenTelemetry Protocol (OTLP) over HTTP, such as an OpenTelemetry Collector.

### Add a Cloud OTLP Input Feed

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **Cloud OTLP** and give it a name.
3. Enter a token if you have one or leave it empty to have the system generate a random token for you.
4. Click **Add**.
5. Click **`...` > View** on the input feed and copy the **Hostname**.
6. Click **`...` > Edit** on the input feed, then click the eye icon in the **Token** field to view the token value.
7. Copy the **Token** — you will need it and the **Hostname** when configuring your OTLP exporter.
8. By default, the endpoint uses a public CA. You can switch to using a Realm private CA from the new or edit input feed form. After saving the feed, the Realm CA pem file will be shown on the **View** page. You can copy and paste it in to your OTLP exporter configuration.

### Configure Your Log Source

Configure your OTLP exporter to send CEF log records to the Realm **Hostname** with the token in an `Authorization: Bearer <token>` header.

> **Note:** Cloud OTLP accepts OTLP over HTTP only. gRPC is not supported.

For a sample OpenTelemetry Collector configuration and troubleshooting steps, see the [Cloud OTLP guide](/integration/cloud_otlp).

***

## Cloud Syslog

Use this transport when your log source sends CEF events wrapped in syslog directly to Realm Cloud. CEF is natively syslog-based, making this the most common transport for network devices and security appliances that emit CEF.

### Add a Cloud Syslog Input Feed

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **Cloud Syslog** and give it a name.
3. Click **Save**.
4. Click **`...` > Edit** on the newly created input feed.
5. Copy the **Syslog Hostname**, **Port**, **Protocol** — you will need these to configure your log source.
6. By default, the Cloud syslog uses a public CA. You can switch to using a Realm private CA from the new or edit input feed form. After saving the feed, Private CA value will be shown. You can copy and paste it in to the source product.

### Configure Your Log Source

Update your log source to send CEF events to the Realm Cloud syslog endpoint. The syslog message body must be a valid CEF event string.

**Example syslog message format (RFC 5424):**

```
<134>1 2024-01-01T00:00:00Z myhost threatmanager - - - CEF:0|Security|threatmanager|1.0|100|worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2 spt=1232
```

* The syslog header fields (facility, severity, hostname, app name) are parsed alongside the CEF body.
* Configure TLS using the Realm CA Certificate saved above.

For Cloud Syslog connection details, see the [Cloud Syslog guide](/integration/cloud_syslog). For rsyslog, see the [Rsyslog guide](/integration/rsyslog) for TLS configuration examples that apply here as well.

***

## Collector

Use this transport when your CEF log source is on-premises and cannot send data directly to Realm Cloud. The Realm Collector runs in your environment and forwards logs on behalf of the source.

Collector support ingesting

* CEF logs that are new line delimited or
* CEF formatted log wrapped in Syslog RFC-5424 over TCP or UDP.

### Add a Collector Input Feed

1. On the **Select Transport Method** step in the Add Source flow, select **Collector** > create a new collector or select an existing one > click **Continue** to add a stream.
2. Configure the collector stream:
   * **Name:** Give the stream a name.
   * **Protocol:** Select **TCP** or **UDP**.
   * **Port:** Use the preconfigured port or change it to suit your environment.
   * **Framing Trailer:** Select the framing trailer that defines the delimiter for log messages.
3. Click `Create Stream`.

> **Note:** Alternatively, create a stream from the **Collectors** page by selecting a collector and clicking **Add Stream**.

1. Configure the collector stream:
   * **Name:** Give the stream a name.
   * **Protocol:** Select **TCP** or **UDP**.
   * **Port:** Use the preconfigured port or change it to suit your environment.
   * **Framing Trailer:** Select the framing trailer that defines the delimiter for log messages.
   * **Source:** Select the source node in the Realm Fabric to which the logs should be forwarded to.
2. Click `Create Stream`.

### Configure the Realm Collector

If you have not yet deployed the Realm Collector in your environment, follow the [Collector setup guide](/integration/collector) first.

Once the Collector is running, follow the steps above to add a Stream to the collector.

> **Note:** The Collector is the recommended option when your log source is behind a firewall or on a private network that cannot reach Realm Cloud endpoints.