CSL

The Common Security Log (CSL) is a standardized schema used in Microsoft Sentinel. It is the shape of the CommonSecurityLog table, the Log Analytics table Sentinel's CEF connector writes into. Being a table schema rather than a published standard, it carries no version number.

DataStream converts to CSL with the Normalize processor. CSL is the only target format for which the destination table name can be set, so events can be routed to CommonSecurityLog or to a custom table of the same shape.

Common Fields:

Field Category	Fields	Description
Base Fields	TimeGenerated, Computer, Activity, Message, LogSeverity	Core fields for event identification and severity
Device Fields	DeviceVendor, DeviceProduct, DeviceVersion, DeviceEventClassID, DeviceAction	The reporting product and the event it classified
Identity Fields	SourceUserName, SourceUserID, SourceUserPrivileges, DestinationUserName, UserName	User identification on each side of the event
Network Fields	SourceIP, DestinationIP, SourcePort, DestinationPort, Protocol, ApplicationProtocol	Network communication endpoints
Volume Fields	SentBytes, ReceivedBytes, SourcePackets, DestinationPackets, NetworkBytes	Traffic volume, counted per direction

Schema Categories:

Category	Fields	Purpose
Session	StartTime, EndTime, Duration, CommunicationDirection, NetworkType	Session timing and direction
Process	ProcessName, ProcessID, ProcessCommandLine, ProcessParentName, ProcessParentCommandLine	Track process creation and execution
File	FileName, FilePath, FileHash, FileSize, FileType, FileCreateTime	Monitor file access and modifications. The OldFile* columns carry the prior state on a rename or replace
Registry	RegistryKey, RegistryValue, RegistryData	Track registry changes and access
DNS	DNSQuery, DNSQueryType, DNSAnswer, DNSReplyCode, DNSRecordType	DNS request and response detail
Syslog	SyslogHostName, SyslogAppName, SyslogFacility, SyslogSeverityLevel, SyslogMessage	Preserved syslog envelope
Rule	RuleName, RuleID, RuleCategory, RuleDescription, RuleVersion	The detection rule that produced the event

Custom Fields: CommonSecurityLog reserves numbered extension columns for vendor data that has no standard home — DeviceCustomString1 through DeviceCustomString6, DeviceCustomIPv6Address1 through 4, DeviceCustomFloatingPoint1 through 4, DeviceCustomDate1 and 2, FlexString1/2, FlexNumber1/2 and FlexDate1. Each has a matching ...Label column naming what the slot holds in that feed.