Question

Your SOC needs to ingest CEF-formatted logs from a Palo Alto firewall into Microsoft Sentinel. The firewall forwards logs over Syslog to a dedicated Linux VM that will act as a collector. You must ensure the CEF messages are parsed correctly and appear in the CommonSecurityLog table. What should you deploy on the Linux collector VM?

Accepted Answer

The Azure Monitor Agent (AMA) with a Data Collection Rule (DCR) configured for CEF via Syslog

Answer

The Log Analytics agent (MMA) with the legacy Syslog data connector only

Answer

The Azure Arc agent alone, relying on built-in Syslog forwarding

Answer

A Logic App playbook that polls the firewall's REST API for events