Does Common Event Format (CEF) not allow a custom ingestion pipeline?

Elastic Security SIEM
1

Hi,
CEF integration does not allow to add a custom ingestion policy? Is this correct?

2

That's not correct, there is a custom ingest pipeline that you can use, but the CEF decoding is done on the agent side, not on the Ingest Pipeline side.

3

Hi Leandro,
I have 2 integration policies of type CEF. The first one allows to insert custom ingestion policy, the second one does not. Here is the screenshot:

immagine
immagine1822×721 43.1 KB

4

Are the integrations on the same version in the policies?

Please share the other integration configuration as well.

5

Hi Leandro,
both the same version.
Here the screenshots:

immagine
immagine1108×641 47.5 KB

immagine
immagine1106×666 54.4 KB

immagine
immagine1103×663 47 KB

immagine
immagine1170×672 25.2 KB

immagine
immagine792×636 22.3 KB

immagine
immagine1067×662 36.8 KB

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.