Sending Cisco Device Syslog in CEF into Microsoft Sentinel

grant-luong — Tue, 04 Nov 2025 19:16:08 GMT

These are the 2 documentations that we followed to ingest Cisco device syslog into our Sentinel instance:

https://learn.microsoft.com/en-us/azure/sentinel/forward-syslog-monitor-agent

eStreamer eNcore for Sentinel Operations Guide v4.0.9 - Cisco

Issue 1: The problem with our current working setup is that the syslog is not in Common Event Format (CEF). What I understand is that the Microsoft Azure Monitoring Agent (AMA) only collects/monitors/ingests syslog into Microsoft Sentinel. The Microsoft AMA does not convert the syslog into CEF. The formatting of Cisco device syslog has always been determined at the Cisco device end.

Issue 2: In our case, we want CEF format and Cisco has always utilized the Cisco eStreamer integration to send its Cisco devices' syslog in CEF into 3rd party SIEMs (like Splunk, Sentinel, etc...). The issue is that Cisco eStreamer (eNcore client) solution is EOL and unsupported, is there a plan to replace Cisco's ability to send its device syslog in CEF?

Cisco eStreamer (eNcore client) solution is EOL/unsupported and we need a solution to ingest Cisco syslog in CEF into our Microsoft Sentinel. Is there a way to do this?

Thanks in advance.

Re: Sending Cisco Device Syslog in CEF into Microsoft Sentinel

nspasov — Sat, 08 Nov 2025 15:13:46 GMT

There are no current plans to support CEF format for Syslog. If this is an important functionality, please reach out to your Cisco account team and request that they file and enhancement request on your behalf.

Thank you for rating helpful posts!

topic Sending Cisco Device Syslog in CEF into Microsoft Sentinel in Network Security

Sending Cisco Device Syslog in CEF into Microsoft Sentinel

Re: Sending Cisco Device Syslog in CEF into Microsoft Sentinel