Realm.Security Documentation

Appearance

Microsoft Sentinel ​

Realm Security integrates seamlessly with Microsoft Sentinel, enabling intelligent routing and analysis of security event logs. Follow these steps carefully to configure log forwarding to your Sentinel instance from Realm Security Data Fabric.

Prerequisites ​

  • Administrative access to your Azure console
  • An existing Log Analytics Workspace

Overview ​

  1. Azure Console: Create Microsoft Entra app registration
  2. Azure Console: Create DCR (Azure Native table or Custom table) to send data to target table
  3. Azure Console: Assign Permissions to DCR
  4. Realm Console: Setup Microsoft Sentinel output feed

1. Azure: Create Microsoft Entra App Registration ​

  1. Log in to the Azure console.
  2. Navigate to App Registrations > New registration.
  3. Give the app a name and click Register. Register
  4. Navigate to the newly created App Registration.
  5. Copy and store the Application (Client) ID and Directory (Tenant) ID. You will need these later when configuring the MS Sentinel output feed in the Realm console.
  6. Navigate to Manage > Certificates and secrets. Select the Client secrets tab and click New client secret. Client Secret
  7. Give the secret an optional description and select an expiration duration.
  8. Immediately copy and store the secret Value — it is only shown once and cannot be retrieved after you leave the page. You will need this when configuring the MS Sentinel output feed in the Realm console.

2. Azure: Create a DCR and Target Table ​

Important: Realm only supports the DCR logs ingestion endpoint. Do not use a Data Collection Endpoint (DCE) URL — ingestion will fail if you do. The DCR logs ingestion endpoint is generated automatically when you create a DCR with "kind": "Direct". It can be found in the DCR's JSON view in the Azure portal under properties.logsIngestion.endpoint.

Choose one of the following paths depending on whether you are sending logs to a Microsoft native table or a custom table you create yourself.

Path A: Send to a Microsoft Native Table (e.g. CommonSecurityLog) ​

Use this path if you want logs to land in a built-in Microsoft Sentinel table like CommonSecurityLog.

  1. In the Azure console, search for "Deploy a custom template" and select Build your own template in the editor.
  2. Paste the appropriate Realm-provided DCR template for your source type into the editor.
  3. In the parameters block, replace the default values for:
    • dcrName — a name for your DCR (e.g. Rlm-Palo-CEF-DCR)
    • location — must exactly match the region of your Log Analytics workspace (e.g. EastUS)
    • workspaceResourceId — the full resource ID of your Log Analytics workspace. Find this by navigating to your Log Analytics workspace → JSON view → copy the value of id (e.g. /subscriptions/00000000-.../resourceGroups/.../providers/Microsoft.OperationalInsights/workspaces/yourworkspace)
    • logAnalyticsDestinationName — a friendly name for the destination within the DCR (e.g. my-workspace)
    • inputStreamName — the name of your custom input stream. Must be prefixed with Custom- (e.g. Custom-PaloCEFDCR). This is the value you will enter as the stream name in the Realm console later.
  4. Click Save.
  5. Select your Resource Group and click Review + create. Once validation passes, click Create.
  6. Once deployment completes, navigate to the DCR resource in the Azure console and confirm it is visible.
  7. Open the DCR and click JSON view (top right of the overview page). Locate and copy the following — you will need all three to configure the Realm output feed:
    • Immutable ID: found at properties.immutableId (e.g. dcr-abc123...)
    • Logs Ingestion URL: found at properties.logsIngestion.endpoint (e.g. https://my-dcr-name.eastus-1.ingest.monitor.azure.com)
    • Stream name: found at properties.dataFlows[0].streams[0] — this is the value you set for inputStreamName (e.g. Custom-PaloCEFDCR)

Path B: Send to a Custom Table ​

Use this path if you want logs to land in a custom table you define yourself (table name must end in _CL).

Step 1: Create the Custom Table ​

  1. In the Azure console, search for "Deploy a custom template" and select Build your own template in the editor.
  2. Paste the appropriate Realm-provided table template for your source type into the editor.
  3. Update the following:
    • parameters.tableName.defaultValue — replace with your desired table name. Must end in _CL (e.g. PaloCEFTable_CL).
    • resources[0].properties.schema.columns[] — update to match your desired schema if needed.
  4. Click Save. Custom Deployment
  5. Select your Resource Group. Set Workspace Name to your Log Analytics workspace name (e.g. my-workspace).
  6. Click Review + create. Once validation passes, click Create.
  7. Before proceeding, confirm the table appears under your Log Analytics Workspace → Settings → Tables. Do not proceed until it is visible.

Step 2: Create the DCR ​

  1. In the Azure console, search for "Deploy a custom template" and select Build your own template in the editor.

  2. Paste the appropriate Realm-provided DCR template for your source type into the editor.

  3. In the variables block, replace the following values:

    • dcrName — a name for your DCR (e.g. PaloAltoCEF-API-Ingestion)
    • location — must exactly match the region of your Log Analytics workspace (e.g. EastUS)
    • workspaceResourceId — the full resource ID of your Log Analytics workspace. Find this by navigating to your Log Analytics workspace → JSON view → copy the value of id (e.g. /subscriptions/00000000-.../resourceGroups/.../providers/Microsoft.OperationalInsights/workspaces/yourworkspace)
    • inputStreamName — the name of your custom input stream. Must be prefixed with Custom- (e.g. Custom-PaloCEFDCR). This is the value you will enter as the stream name in the Realm console later.
    • outputTableName — for documentation purposes only. This value is not read by the deployment. The field that actually controls where data lands is dataFlows[0].outputStream in step 7 below.

  4. Manually rename the key under resources[0].properties.streamDeclarations to exactly match the value you set for inputStreamName. This is a literal JSON key — it will not update automatically when you change the variable. For example, if you set inputStreamName to Custom-MyStream, the key must be:

    json
    "streamDeclarations": {
    "Custom-MyStream": {
        "columns": [...]
    }
}

    Custom Deployment

  5. Update resources[0].properties.streamDeclarations.<inputStreamName>.columns[] to match your custom table's schema.

  6. Update resources[0].properties.dataFlows[0].transformKql to project the columns by name that match your table schema.

  7. Update resources[0].properties.dataFlows[0].outputStream to your table name with both a Custom- prefix and _CL suffix (e.g. Custom-PaloCEFTable_CL). This is what controls where the data actually lands.

  8. Click Save. Custom Deployment

  9. Select your Resource Group and click Review + create. Once validation passes, click Create.

  10. Before proceeding, confirm the DCR is visible in the Azure console.

  11. Open the DCR and click JSON view (top right of the overview page). Locate and copy the following — you will need all three to configure the Realm output feed:

    • Immutable ID: found at properties.immutableId (e.g. dcr-abc123...)
    • Logs Ingestion URL: found at properties.logsIngestion.endpoint (e.g. https://my-dcr-name.eastus-1.ingest.monitor.azure.com)
    • Stream name: found at properties.dataFlows[0].streams[0] — this is the value you set for inputStreamName (e.g. Custom-PaloCEFDCR)

DCR DetailsDCR Details

3. Azure: Assign Permissions to DCR ​

After the DCR has been created, the app registration must be granted permission to send data to it.

Note: If you skip this step or assign the role at the wrong scope, you will see an Authentication failure error in the Realm console.

  1. Navigate to your DCR resource in the Azure portal.
  2. Select Access Control (IAM) > Add role assignment.
  3. Search for and select Monitoring Metrics Publisher, then click Next.
  4. Set Assign access to to User, group, or service principal and click Select members.
  5. Search for and select the app registration you created in Step 1, then click Select.
  6. Click Review + assign and confirm the details before saving.
  7. Verify the assignment: on the DCR's Access Control (IAM) page, click Role assignments and confirm your app registration appears with the Monitoring Metrics Publisher role. Role assignments can take a few minutes to propagate — wait 5 minutes before testing.

4. Realm: Setup Output Feed ​

  1. Go to Destinations and select a destination of type SIEM.
  2. Click Add Output Feed.
  3. Select type: Microsoft Sentinel.
  4. Give the output feed a name and description of your choosing.
  5. Paste the Logs Ingestion URL you copied from the DCR JSON view into the Endpoint field. This should look like https://my-dcr-name.eastus-1.ingest.monitor.azure.com. Do not use a DCE URL — if your URL contains a zone suffix like .z1. it is a DCE URL and will not work.
  6. Paste the DCR Immutable ID into the DCR Immutable ID field. This should start with dcr-.
  7. Paste the client secret value into the Secret Value field.
  8. Paste the Tenant ID and Client ID into their corresponding fields.
  9. Select JSON as the format.
  10. Click Add to save the output feed.
  11. Once saved, click Edit on the output feed. For each connected source, enter the stream name in the Stream Name field. This is the value you copied from properties.dataFlows[0].streams[0] in the DCR JSON view (e.g. Custom-PaloCEFDCR).
    • For a custom table stream the name will be prefixed with Custom- (e.g. Custom-PaloCEFDCR)
    • For a Microsoft native table stream the name will be prefixed with Microsoft- (e.g. Microsoft-CommonSecurityLog)
    • The stream name must exactly match what is defined in your DCR's streamDeclarations — including capitalization

Stream Name

It takes about a minute to deploy the fabric update, after which data should start flowing to Microsoft Sentinel. Allow an additional 30–60 seconds for data to be ingested and indexed before querying with KQL.

Troubleshooting ​

Critical Failure: Authentication failure

The app registration does not have the Monitoring Metrics Publisher role on the DCR. Follow Step 3. Also verify the Client ID, Tenant ID, and Client Secret are correct and that the secret has not expired.

Client Error (400 Bad Request)

This is most commonly caused by one of the following:

  • Using a DCE URL instead of the DCR ingestion URL. Check that your endpoint does not contain .z1. or similar zone suffixes — if it does, you are using a DCE URL. Retrieve the correct URL from the DCR JSON view under properties.logsIngestion.endpoint.
  • The stream name does not match what is defined in the DCR's streamDeclarations. Open the DCR JSON view and confirm the stream name under properties.dataFlows[0].streams[0] exactly matches what you entered in the Realm console.
  • The DCR Immutable ID was entered incorrectly. Confirm it starts with dcr- and matches properties.immutableId in the DCR JSON view.

Data not appearing in the table

Even with a successful 200 response from the API, records can be silently dropped at ingestion time. Check the _LogOperation table in your Log Analytics workspace:

kql
_LogOperation
| where TimeGenerated > ago(1h)
| where Category == "Ingestion"
| where Level == "Warning" or Level == "Error"

Common causes include type mismatches between the data and the table schema, and TimeGenerated values more than 2 days in the past or 1 day in the future.

Resources ​

Custom Table Templates ​

Realm provided custom table templates.

Palo CEF ​

json
{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
            "type": "String",
            "metadata": {
                "description": "The name of the existing Log Analytics Workspace."
            }
        },
        "tableName": {
            "defaultValue": "PaloCEFTable_CL",
            "type": "String",
            "metadata": {
                "description": "The name of the custom table (will be suffixed with _CL)."
            }
        },
        "location": {
            "defaultValue": "[resourceGroup().location]",
            "type": "String",
            "metadata": {
                "description": "Location for the table resource."
            }
        }
    },
    "resources": [
        {
            "type": "Microsoft.OperationalInsights/workspaces/tables",
            "apiVersion": "2022-10-01",
            "name": "[concat(parameters('workspaceName'), '/', parameters('tableName'))]",
            "location": "[parameters('location')]",
            "properties": {
                "schema": {
                    "name": "[parameters('tableName')]",
                    "columns": [
                        {
                            "name": "TimeGenerated",
                            "type": "datetime",
                            "description": "The time at which the log record was generated by the source system."
                        },
                        {
                            "name": "RealmMetadata",
                            "type": "dynamic",
                            "description": "Realm.Security specific metadata"
                        },
                        {
                            "name": "PanOSRuleUUID",
                            "type": "string",
                            "description": "Custom field to identify the unique UUID of the matched rule on the Palo Alto device."
                        },
                        {
                            "name": "act",
                            "type": "string",
                            "description": "CEF Key (act) mapped to DeviceAction: The action mentioned in the event (e.g., Permit, Block, Drop)."
                        },
                        {
                            "name": "app",
                            "type": "string",
                            "description": "CEF Key (app) mapped to ApplicationProtocol: The protocol used in the application, such as HTTP or HTTPS."
                        },
                        {
                            "name": "cat",
                            "type": "string",
                            "description": "CEF Key (cat) mapped to DeviceEventCategory: Represents the category assigned by the originating device."
                        },
                        {
                            "name": "cefVersion",
                            "type": "int",
                            "description": "CEF Version field."
                        },
                        {
                            "name": "cn1",
                            "type": "int",
                            "description": "CEF Key (cn1) mapped to DeviceCustomNumber1."
                        },
                        {
                            "name": "cn1Label",
                            "type": "string",
                            "description": "CEF Key (cn1Label): Describes the purpose of the custom field cn1."
                        },
                        {
                            "name": "cn2",
                            "type": "int",
                            "description": "CEF Key (cn2) mapped to DeviceCustomNumber2."
                        },
                        {
                            "name": "cn2Label",
                            "type": "string",
                            "description": "CEF Key (cn2Label): Describes the purpose of the custom field cn2."
                        },
                        {
                            "name": "cn3",
                            "type": "int",
                            "description": "CEF Key (cn3) mapped to DeviceCustomNumber3."
                        },
                        {
                            "name": "cn3Label",
                            "type": "string",
                            "description": "CEF Key (cn3Label): Describes the purpose of the custom field cn3."
                        },
                        {
                            "name": "cnt",
                            "type": "string",
                            "description": "CEF Key (cnt) mapped to EventCount: A count associated with the event."
                        },
                        {
                            "name": "cs1",
                            "type": "string",
                            "description": "CEF Key (cs1) mapped to DeviceCustomString1."
                        },
                        {
                            "name": "cs1Label",
                            "type": "string",
                            "description": "CEF Key (cs1Label): Describes the purpose of the custom field cs1."
                        },
                        {
                            "name": "cs2",
                            "type": "string",
                            "description": "CEF Key (cs2) mapped to DeviceCustomString2."
                        },
                        {
                            "name": "cs2Label",
                            "type": "string",
                            "description": "CEF Key (cs2Label): Describes the purpose of the custom field cs2."
                        },
                        {
                            "name": "cs3",
                            "type": "string",
                            "description": "CEF Key (cs3) mapped to DeviceCustomString3."
                        },
                        {
                            "name": "cs3Label",
                            "type": "string",
                            "description": "CEF Key (cs3Label): Describes the purpose of the custom field cs3."
                        },
                        {
                            "name": "cs4",
                            "type": "string",
                            "description": "CEF Key (cs4) mapped to DeviceCustomString4."
                        },
                        {
                            "name": "cs4Label",
                            "type": "string",
                            "description": "CEF Key (cs4Label): Describes the purpose of the custom field cs4."
                        },
                        {
                            "name": "cs5",
                            "type": "string",
                            "description": "CEF Key (cs5) mapped to DeviceCustomString5."
                        },
                        {
                            "name": "cs5Label",
                            "type": "string",
                            "description": "CEF Key (cs5Label): Describes the purpose of the custom field cs5."
                        },
                        {
                            "name": "cs6",
                            "type": "string",
                            "description": "CEF Key (cs6) mapped to DeviceCustomString6."
                        },
                        {
                            "name": "cs6Label",
                            "type": "string",
                            "description": "CEF Key (cs6Label): Describes the purpose of the custom field cs6."
                        },
                        {
                            "name": "destinationTranslatedAddress",
                            "type": "string",
                            "description": "CEF Key (destinationTranslatedAddress): The post-translation destination IPv4 address."
                        },
                        {
                            "name": "destinationTranslatedPort",
                            "type": "int",
                            "description": "CEF Key (destinationTranslatedPort): The post-translation destination port."
                        },
                        {
                            "name": "deviceEventClassId",
                            "type": "string",
                            "description": "CEF Key (deviceEventClassId): Identifies the type of event reported."
                        },
                        {
                            "name": "deviceExternalId",
                            "type": "string",
                            "description": "CEF Key (deviceExternalId): An ID used by the originating device."
                        },
                        {
                            "name": "deviceInboundInterface",
                            "type": "string",
                            "description": "CEF Key (deviceInboundInterface): The input interface on the device where the packet was received."
                        },
                        {
                            "name": "deviceOutboundInterface",
                            "type": "string",
                            "description": "CEF Key (deviceOutboundInterface): The output interface on the device where the packet was sent."
                        },
                        {
                            "name": "deviceProduct",
                            "type": "string",
                            "description": "CEF Key (deviceProduct): Identifies the product of a vendor."
                        },
                        {
                            "name": "deviceVendor",
                            "type": "string",
                            "description": "CEF Key (deviceVendor): The vendor of the device generating the event."
                        },
                        {
                            "name": "deviceVersion",
                            "type": "string",
                            "description": "CEF Key (deviceVersion): Identifies the version of the product."
                        },
                        {
                            "name": "dpt",
                            "type": "int",
                            "description": "CEF Key (dpt) mapped to DestinationPort. Valid values: 0 - 65535."
                        },
                        {
                            "name": "dst",
                            "type": "string",
                            "description": "CEF Key (dst) mapped to DestinationIP: The destination IPv4 address."
                        },
                        {
                            "name": "duser",
                            "type": "string",
                            "description": "CEF Key (duser) mapped to DestinationUserName."
                        },
                        {
                            "name": "dvchost",
                            "type": "string",
                            "description": "CEF Key (dvchost) mapped to DeviceHostName: The FQDN associated with the device node."
                        },
                        {
                            "name": "externalId",
                            "type": "string",
                            "description": "CEF Key (externalId): An ID used by the originating device."
                        },
                        {
                            "name": "flexNumber1",
                            "type": "int",
                            "description": "CEF Key (flexNumber1) mapped to FlexNumber1."
                        },
                        {
                            "name": "flexNumber1Label",
                            "type": "string",
                            "description": "CEF Key (flexNumber1Label): Describes the purpose of the custom field flexNumber1."
                        },
                        {
                            "name": "name",
                            "type": "string",
                            "description": "CEF Key (name) mapped to Activity: A human-readable description of the event."
                        },
                        {
                            "name": "out",
                            "type": "string",
                            "description": "CEF Key (out) mapped to DeviceOutboundInterface."
                        },
                        {
                            "name": "proto",
                            "type": "string",
                            "description": "CEF Key (proto) mapped to Protocol (e.g., TCP, UDP)."
                        },
                        {
                            "name": "reason",
                            "type": "string",
                            "description": "CEF Key (reason): The reason the event was generated."
                        },
                        {
                            "name": "rt",
                            "type": "string",
                            "description": "CEF Key (rt) mapped to ReceiptTime: The time at which the event was received."
                        },
                        {
                            "name": "severity",
                            "type": "string",
                            "description": "CEF Key (severity): A string or integer describing the importance of the event."
                        },
                        {
                            "name": "sourceTranslatedAddress",
                            "type": "string",
                            "description": "CEF Key (sourceTranslatedAddress): The post-translation source IPv4 address."
                        },
                        {
                            "name": "sourceTranslatedPort",
                            "type": "int",
                            "description": "CEF Key (sourceTranslatedPort): The post-translation source port."
                        },
                        {
                            "name": "spt",
                            "type": "int",
                            "description": "CEF Key (spt) mapped to SourcePort. Valid values: 0 - 65535."
                        },
                        {
                            "name": "src",
                            "type": "string",
                            "description": "CEF Key (src) mapped to SourceIP: The source IPv4 address."
                        },
                        {
                            "name": "suser",
                            "type": "string",
                            "description": "CEF Key (suser) mapped to SourceUserName."
                        }
                    ]
                }
            }
        }
    ]
}

Data Collection Rule Templates ​

Realm provided DCR templates.

Palo CEF DCR ​

Note: outputTableName in the variables block is for documentation purposes only — it is not read by the deployment. The value that actually controls where data lands is dataFlows[0].outputStream, which must include both the Custom- prefix and _CL suffix.

json
{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "variables": {
        "dcrName": "PaloAltoCEF-API-Ingestion",
        "location": "EastUS",
        "workspaceResourceId": "/subscriptions/0000000-0000-0000-0000-0000000000000/resourceGroups/fizz/providers/Microsoft.OperationalInsights/workspaces/buzz",
        "logAnalyticsDestinationName": "logAnalyticsWorkspaceName",
        "inputStreamName": "Custom-PaloCEFDCR",
        "outputTableName": "PaloCEFTable"
    },
    "resources": [
        {
            "type": "Microsoft.Insights/dataCollectionRules",
            "apiVersion": "2023-03-11",
            "name": "[variables('dcrName')]",
            "location": "[variables('location')]",
            "kind": "Direct",
            "properties": {
                "streamDeclarations": {
                    "Custom-PaloCEFDCR": {
                        "columns": [
                            { "name": "TimeGenerated", "type": "datetime" },
                            { "name": "RealmMetadata", "type": "dynamic" },
                            { "name": "PanOSRuleUUID", "type": "string" },
                            { "name": "act", "type": "string" },
                            { "name": "app", "type": "string" },
                            { "name": "cat", "type": "string" },
                            { "name": "cefVersion", "type": "int" },
                            { "name": "cn1", "type": "int" },
                            { "name": "cn1Label", "type": "string" },
                            { "name": "cn2", "type": "int" },
                            { "name": "cn2Label", "type": "string" },
                            { "name": "cn3", "type": "int" },
                            { "name": "cn3Label", "type": "string" },
                            { "name": "cnt", "type": "string" },
                            { "name": "cs1", "type": "string" },
                            { "name": "cs1Label", "type": "string" },
                            { "name": "cs2", "type": "string" },
                            { "name": "cs2Label", "type": "string" },
                            { "name": "cs3", "type": "string" },
                            { "name": "cs3Label", "type": "string" },
                            { "name": "cs4", "type": "string" },
                            { "name": "cs4Label", "type": "string" },
                            { "name": "cs5", "type": "string" },
                            { "name": "cs5Label", "type": "string" },
                            { "name": "cs6", "type": "string" },
                            { "name": "cs6Label", "type": "string" },
                            { "name": "destinationTranslatedAddress", "type": "string" },
                            { "name": "destinationTranslatedPort", "type": "int" },
                            { "name": "deviceEventClassId", "type": "string" },
                            { "name": "deviceExternalId", "type": "string" },
                            { "name": "deviceInboundInterface", "type": "string" },
                            { "name": "deviceOutboundInterface", "type": "string" },
                            { "name": "deviceProduct", "type": "string" },
                            { "name": "deviceVendor", "type": "string" },
                            { "name": "deviceVersion", "type": "string" },
                            { "name": "dpt", "type": "int" },
                            { "name": "dst", "type": "string" },
                            { "name": "duser", "type": "string" },
                            { "name": "dvchost", "type": "string" },
                            { "name": "externalId", "type": "string" },
                            { "name": "flexNumber1", "type": "int" },
                            { "name": "flexNumber1Label", "type": "string" },
                            { "name": "activityName", "type": "string" },
                            { "name": "outboundInt", "type": "string" },
                            { "name": "proto", "type": "string" },
                            { "name": "reason", "type": "string" },
                            { "name": "rt", "type": "string" },
                            { "name": "severity", "type": "string" },
                            { "name": "sourceTranslatedAddress", "type": "string" },
                            { "name": "sourceTranslatedPort", "type": "int" },
                            { "name": "spt", "type": "int" },
                            { "name": "src", "type": "string" },
                            { "name": "suser", "type": "string" }
                        ]
                    }
                },
                "destinations": {
                    "logAnalytics": [
                        {
                            "workspaceResourceId": "[variables('workspaceResourceId')]",
                            "name": "[variables('logAnalyticsDestinationName')]"
                        }
                    ]
                },
                "dataFlows": [
                    {
                        "streams": [
                            "[variables('inputStreamName')]"
                        ],
                        "destinations": [
                            "[variables('logAnalyticsDestinationName')]"
                        ],
                        "transformKql": "source \n | project TimeGenerated, PanOSRuleUUID, act, app, cat, cefVersion, cn1, cn1Label, cn2, cn2Label, cn3, cn3Label, cnt, cs1, cs1Label, cs2, cs2Label, cs3, cs3Label, cs4, cs4Label, cs5, cs5Label, cs6, cs6Label, destinationTranslatedAddress, destinationTranslatedPort, deviceEventClassId, deviceExternalId, deviceInboundInterface, deviceOutboundInterface, deviceProduct, deviceVendor, deviceVersion, dpt, dst, duser, dvchost, externalId, flexNumber1, flexNumber1Label, proto, reason, rt, severity, sourceTranslatedAddress, sourceTranslatedPort, spt, src, suser, ActivityName=activityName, RealmMetadata=tostring(RealmMetadata)",
                        "outputStream": "Custom-PaloCEFTable_CL"
                    }
                ]
            }
        }
    ]
}

DCR for CommonSecurityLog Table (Palo CEF) ​

Use this template if you are sending Palo Alto CEF data to the native CommonSecurityLog table.

json
{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "dcrName": {
            "defaultValue": "Rlm-Palo-CEF-DCR",
            "type": "String",
            "metadata": {
                "description": "Name of the Data Collection Rule."
            }
        },
        "location": {
            "defaultValue": "EastUS",
            "type": "String",
            "metadata": {
                "description": "Location for the DCR. Must match the Log Analytics Workspace region."
            }
        },
        "workspaceResourceId": {
            "defaultValue": "/subscriptions/0000000-0000-0000-0000-0000000000000/resourceGroups/fizz/providers/Microsoft.OperationalInsights/workspaces/buzz",
            "type": "String",
            "metadata": {
                "description": "Full Resource ID of the target Log Analytics Workspace."
            }
        },
        "logAnalyticsDestinationName": {
            "defaultValue": "analytics-workspace-name",
            "type": "String",
            "metadata": {
                "description": "The name used for the destination workspace within the DCR definition."
            }
        },
        "inputStreamName": {
            "defaultValue": "Custom-PaloCEFDCR",
            "type": "String",
            "metadata": {
                "description": "The name of the custom input stream used in the Logs Ingestion API URL."
            }
        }
    },
    "variables": {
        "outputStreamName": "Microsoft-CommonSecurityLog"
    },
    "resources": [
        {
            "type": "Microsoft.Insights/dataCollectionRules",
            "apiVersion": "2023-03-11",
            "name": "[parameters('dcrName')]",
            "location": "[parameters('location')]",
            "kind": "Direct",
            "properties": {
                "streamDeclarations": {
                    "[parameters('inputStreamName')]": {
                        "columns": [
                            { "name": "TimeGenerated", "type": "datetime" },
                            { "name": "RealmMetadata", "type": "dynamic" },
                            { "name": "act", "type": "string" },
                            { "name": "app", "type": "string" },
                            { "name": "cat", "type": "string" },
                            { "name": "cefVersion", "type": "int" },
                            { "name": "cn1", "type": "int" },
                            { "name": "cn1Label", "type": "string" },
                            { "name": "cn2", "type": "int" },
                            { "name": "cn2Label", "type": "string" },
                            { "name": "cn3", "type": "int" },
                            { "name": "cn3Label", "type": "string" },
                            { "name": "cnt", "type": "string" },
                            { "name": "cs1", "type": "string" },
                            { "name": "cs1Label", "type": "string" },
                            { "name": "cs2", "type": "string" },
                            { "name": "cs2Label", "type": "string" },
                            { "name": "cs3", "type": "string" },
                            { "name": "cs3Label", "type": "string" },
                            { "name": "cs4", "type": "string" },
                            { "name": "cs4Label", "type": "string" },
                            { "name": "cs5", "type": "string" },
                            { "name": "cs5Label", "type": "string" },
                            { "name": "cs6", "type": "string" },
                            { "name": "cs6Label", "type": "string" },
                            { "name": "destinationTranslatedAddress", "type": "string" },
                            { "name": "destinationTranslatedPort", "type": "int" },
                            { "name": "deviceEventClassId", "type": "string" },
                            { "name": "deviceExternalId", "type": "string" },
                            { "name": "deviceInboundInterface", "type": "string" },
                            { "name": "deviceOutboundInterface", "type": "string" },
                            { "name": "deviceProduct", "type": "string" },
                            { "name": "deviceVendor", "type": "string" },
                            { "name": "deviceVersion", "type": "string" },
                            { "name": "dpt", "type": "int" },
                            { "name": "dst", "type": "string" },
                            { "name": "duser", "type": "string" },
                            { "name": "dvchost", "type": "string" },
                            { "name": "externalId", "type": "string" },
                            { "name": "flexNumber1", "type": "int" },
                            { "name": "flexNumber1Label", "type": "string" },
                            { "name": "activityName", "type": "string" },
                            { "name": "outboundInt", "type": "string" },
                            { "name": "proto", "type": "string" },
                            { "name": "reason", "type": "string" },
                            { "name": "rt", "type": "string" },
                            { "name": "severity", "type": "string" },
                            { "name": "sourceTranslatedAddress", "type": "string" },
                            { "name": "sourceTranslatedPort", "type": "int" },
                            { "name": "spt", "type": "int" },
                            { "name": "src", "type": "string" },
                            { "name": "suser", "type": "string" }
                        ]
                    }
                },
                "destinations": {
                    "logAnalytics": [
                        {
                            "workspaceResourceId": "[parameters('workspaceResourceId')]",
                            "name": "[parameters('logAnalyticsDestinationName')]"
                        }
                    ]
                },
                "dataFlows": [
                    {
                        "streams": [
                            "[parameters('inputStreamName')]"
                        ],
                        "destinations": [
                            "[parameters('logAnalyticsDestinationName')]"
                        ],
                        "outputStream": "[variables('outputStreamName')]",
                        "transformKql": "source | project TimeGenerated,AdditionalExtensions=tostring(RealmMetadata), Activity=tostring(activityName), ApplicationProtocol=tostring(app), DeviceEventCategory=tostring(cat), DestinationPort=toint(dpt), DestinationIP=tostring(dst), DestinationUserName=tostring(duser), DeviceHostName=tostring(dvchost), Protocol=tostring(proto), Reason=tostring(reason), ReceiptTime=tostring(rt), LogSeverity=tostring(severity), SourcePort=toint(spt), SourceIP=tostring(src), SourceUserName=tostring(suser), DeviceAction=tostring(act), DeviceVersion=tostring(cefVersion), DeviceCustomNumber1=toint(cn1), DeviceCustomNumber1Label=tostring(cn1Label), DeviceCustomNumber2=toint(cn2), DeviceCustomNumber2Label=tostring(cn2Label), DeviceCustomNumber3=toint(cn3), DeviceCustomNumber3Label=tostring(cn3Label), EventCount=toint(cnt), DeviceCustomString1=tostring(cs1), DeviceCustomString1Label=tostring(cs1Label), DeviceCustomString2=tostring(cs2), DeviceCustomString2Label=tostring(cs2Label),DeviceCustomString3=tostring(cs3), DeviceCustomString3Label=tostring(cs3Label), DeviceCustomString4=tostring(cs4), DeviceCustomString4Label=tostring(cs4Label), DeviceCustomString5=tostring(cs5), DeviceCustomString5Label=tostring(cs5Label), DeviceCustomString6=tostring(cs6), DeviceCustomString6Label=tostring(cs6Label), DestinationTranslatedAddress=tostring(destinationTranslatedAddress), DestinationTranslatedPort=toint(destinationTranslatedPort), DeviceEventClassID=tostring(deviceEventClassId), DeviceExternalID=tostring(deviceExternalId), DeviceInboundInterface=tostring(deviceInboundInterface), DeviceOutboundInterface=tostring(deviceOutboundInterface), DeviceProduct=tostring(deviceProduct), DeviceVendor=tostring(deviceVendor), SourceTranslatedAddress=tostring(sourceTranslatedAddress), SourceTranslatedPort=toint(sourceTranslatedPort)"
                    }
                ]
            }
        }
    ]
}

DCR for CommonSecurityLog Table (Zscaler Cloud NSS) ​

Use this template if you are sending Zscaler Cloud NSS data to the native CommonSecurityLog table.

json
{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "dcrName": {
            "defaultValue": "Rlm-Zscaler-NSS-DCR",
            "type": "String",
            "metadata": {
                "description": "Name of the Data Collection Rule for Zscaler NSS."
            }
        },
        "location": {
            "defaultValue": "EastUS",
            "type": "String",
            "metadata": {
                "description": "Location for the DCR."
            }
        },
        "workspaceResourceId": {
            "type": "String",
            "metadata": {
                "description": "Full Resource ID of the target Log Analytics Workspace."
            }
        },
        "logAnalyticsDestinationName": {
            "defaultValue": "la-workspace",
            "type": "String"
        },
        "inputStreamName": {
            "defaultValue": "Custom-ZscalerNSS",
            "type": "String"
        }
    },
    "variables": {
        "outputStreamName": "Microsoft-CommonSecurityLog"
    },
    "resources": [
        {
            "type": "Microsoft.Insights/dataCollectionRules",
            "apiVersion": "2023-03-11",
            "name": "[parameters('dcrName')]",
            "location": "[parameters('location')]",
            "kind": "Direct",
            "properties": {
                "streamDeclarations": {
                    "[parameters('inputStreamName')]": {
                        "columns": [
                            { "name": "TimeGenerated", "type": "datetime" },
                            { "name": "RealmMetadata", "type": "dynamic" },
                            { "name": "vendor", "type": "string" },
                            { "name": "product", "type": "string" },
                            { "name": "version", "type": "string" },
                            { "name": "act", "type": "string" },
                            { "name": "Severity", "type": "string" },
                            { "name": "deviceEventClassId", "type": "string" },
                            { "name": "suser", "type": "string" },
                            { "name": "src", "type": "string" },
                            { "name": "dst", "type": "string" },
                            { "name": "dpt", "type": "int" },
                            { "name": "cat", "type": "string" },
                            { "name": "cs1", "type": "string" },
                            { "name": "cs1Label", "type": "string" },
                            { "name": "cs2", "type": "string" },
                            { "name": "cs2Label", "type": "string" },
                            { "name": "cs3", "type": "string" },
                            { "name": "cs3Label", "type": "string" },
                            { "name": "cs4", "type": "string" },
                            { "name": "cs4Label", "type": "string" },
                            { "name": "cs5", "type": "string" },
                            { "name": "cs5Label", "type": "string" },
                            { "name": "cs6", "type": "string" },
                            { "name": "cs6Label", "type": "string" },
                            { "name": "cn1", "type": "int" },
                            { "name": "cn1Label", "type": "string" },
                            { "name": "flexString1", "type": "string" },
                            { "name": "flexString1Label", "type": "string" },
                            { "name": "flexString2", "type": "string" },
                            { "name": "flexString2Label", "type": "string" },
                            { "name": "spriv", "type": "string" },
                            { "name": "suid", "type": "string" },
                            { "name": "dvchost", "type": "string" }
                        ]
                    }
                },
                "destinations": {
                    "logAnalytics": [
                        {
                            "workspaceResourceId": "[parameters('workspaceResourceId')]",
                            "name": "[parameters('logAnalyticsDestinationName')]"
                        }
                    ]
                },
                "dataFlows": [
                    {
                        "streams": [ "[parameters('inputStreamName')]" ],
                        "destinations": [ "[parameters('logAnalyticsDestinationName')]" ],
                        "outputStream": "[variables('outputStreamName')]",
                        "transformKql": "source | project TimeGenerated, AdditionalExtensions=tostring(RealmMetadata), DeviceVendor=tostring(vendor), DeviceProduct=tostring(product), DeviceVersion=tostring(version), DeviceAction=tostring(act), LogSeverity=tostring(Severity), DeviceEventClassID=tostring(deviceEventClassId), SourceUserName=tostring(suser), SourceAddress=tostring(src), DestinationAddress=tostring(dst), DestinationPort=toint(dpt), DeviceCategory=tostring(cat), DeviceCustomString1=tostring(cs1), DeviceCustomString1Label=tostring(cs1Label), DeviceCustomString2=tostring(cs2), DeviceCustomString2Label=tostring(cs2Label), DeviceCustomString3=tostring(cs3), DeviceCustomString3Label=tostring(cs3Label), DeviceCustomString4=tostring(cs4), DeviceCustomString4Label=tostring(cs4Label), DeviceCustomString5=tostring(spriv), DeviceCustomString5Label='Zscaler_Privilege', DeviceCustomString6=tostring(suid), DeviceCustomString6Label='Zscaler_UID', DeviceCustomNumber1=toint(cn1), DeviceCustomNumber1Label=tostring(cn1Label), FlexString1=tostring(flexString1), FlexString1Label=tostring(flexString1Label), FlexString2=tostring(flexString2), FlexString2Label=tostring(flexString2Label), Computer=tostring(dvchost)"
                    }
                ]
            }
        }
    ]
}