Onboard Unknown Source to SC4S

loz — Tue, 14 Oct 2025 22:59:49 GMT

Hi all,

We are attempting to onboard Defender for IOT on prem sensor logs to SC4S.

These are currently being sent over port 514 in CEF format and have been written to the default config of the main index and cef sourcetype.

We have attempted to write a custom parser based on the example in the docs, to send the logs to our defined index and sourcetype. (https://splunk.github.io/splunk-connect-for-syslog/main/create-parser/.)

Are there any other steps we are missing?

Thank you!

Re: Onboard Unknown Source to SC4S

phanTom — Mon, 27 Oct 2025 08:23:11 GMT

@loz there is no need to create a default parser for this as the CEF parser exists. You simply need to redirect the data using the splunk_metadata.csv file as per the example here: https://splunk.github.io/splunk-connect-for-syslog/main/sources/base/cef/#splunk-metadata-with-cef-events