topic Re: Anyone using Common Event Format (CEF) with Dynatrace? in Log Analytics

Anyone using Common Event Format (CEF) with Dynatrace?

AntonioSousa — Mon, 05 Jun 2023 19:07:41 GMT

Common Event Format (CEF) is an open logging and auditing format, that is quite used in the SIEM market. Being able to send events&logs from the Dynatrace AppSec monitoring to SIEM platforms seems quite an important use-case to me. It isn't supported by Dynatrace, but before putting in a Product Idea, would like to know if eventually someone went the extensions route to be able to get these events to SIEM?

Re: Anyone using Common Event Format (CEF) with Dynatrace?

ChadTurner — Thu, 22 Jun 2023 13:07:34 GMT

great question and great future RFE 🙂

Re: Anyone using Common Event Format (CEF) with Dynatrace?

jegron — Thu, 22 Jun 2023 19:23:05 GMT

I am using FluentD to ingest Syslog and output it in Dynatrace : https://www.dynatrace.com/support/help/observe-and-explore/logs/log-monitoring/acquire-log-data/send-syslogs-via-fluentd

Maybe you can use CEF input plugin in the same way: https://github.com/lunardial/fluent-plugin-parser_cef

Re: Anyone using Common Event Format (CEF) with Dynatrace?

adam_gardner — Fri, 23 Jun 2023 05:33:11 GMT

I took a CEF example from this page then used logpusher to send it to Dynatrace via an OpenTelemetry collector. (see this video for how to use logpusher).

I then used DQL to filter my incoming log lines:

fetch logs, scanLimitGBytes: 1
| filter matchesPhrase(content, "act=blocked")
| sort timestamp desc

Re: Anyone using Common Event Format (CEF) with Dynatrace?

AntonioSousa — Fri, 23 Jun 2023 09:11:07 GMT

@adam_gardner,

It's the other way around: I want to get the Dynatrace AppSec events to a SIEM platform.

Re: Anyone using Common Event Format (CEF) with Dynatrace?

adam_gardner — Mon, 26 Jun 2023 00:47:27 GMT

Ahh OK. I misread the initial post. In which case, this seems like a very sensible think to build as an app / workflow.

Re: Anyone using Common Event Format (CEF) with Dynatrace?

radek_jasinski — Mon, 26 Jun 2023 07:35:15 GMT

Yes, this is a good direction for the development of AppSec in DT. I have a similar case at my client and it would be nice to send this information to another tool.

Re: Anyone using Common Event Format (CEF) with Dynatrace?

AntonioSousa — Mon, 26 Jun 2023 08:15:51 GMT

Yes, @adam_gardner gave a good solution for SaaS environments. In this case, it's a Managed environment though...