Does Common Event Format (CEF) not allow a custom ingestion pipeline?

[Cristina_Marletta_Li (Cristina Marletta Livi)]

Hi,
CEF integration does not allow to add a custom ingestion policy? Is this correct?

[leandrojmp (Leandro Pereira)]

That's not correct, there is a custom ingest pipeline that you can use, but the CEF decoding is done on the agent side, not on the Ingest Pipeline side.

[Cristina_Marletta_Li (Cristina Marletta Livi)]

Hi Leandro,
I have 2 integration policies of type CEF. The first one allows to insert custom ingestion policy, the second one does not. Here is the screenshot:

[leandrojmp (Leandro Pereira)]

Are the integrations on the same version in the policies?

Please share the other integration configuration as well.

[Cristina_Marletta_Li (Cristina Marletta Livi)]

Hi Leandro,
both the same version.
Here the screenshots: