Microsoft Security Operations Analyst Associate SC-200 Practice Question

When you execute the cef_installer.py script with its default parameters, the script configures rsyslog on the collector to listen externally on TCP (and UDP) port 514. It also adds an IPTables rule that forwards any traffic received on port 514 to the Log Analytics agent's local listener on port 25226. Because of this configuration, all external devices must be configured to send their CEF-formatted Syslog messages to port 514 on the collector. Traffic sent to ports 25224, 25226, or 6514 will not be accepted from remote sources unless you override the script's defaults.