In a Microsoft Sentinel workspace, Common Event Format (CEF) data is stored in the CommonSecurityLog table.
When you configure your data connectors (such as the "Common Event Format (CEF) via AMA" connector) to ingest logs from security devices and appliances, the ingested data is automatically parsed into the schema of this table, making it ready for threat hunting, detection rules, and workbook creation.
Key Details to Remember:
Table Name: CommonSecurityLog
Standardization: Unlike raw Syslog data--which is often stored in the Syslog table and may require additional parsing--CEF data is pre-normalized by the ingestion process, allowing you to query standardized fields (such as DeviceAction, ApplicationProtocol, or DeviceEventCategory) directly.
Querying: You can use Kusto Query Language (KQL) in the Logs blade of your Log Analytics workspace to access this data:
CommonSecurityLog
| take 10
Reference:
https://learn.microsoft.com/en-us/azure/sentinel/cef-name-mapping