SIEM & UEBA

I've a problem with creating a custom parser. 

I've added the Device, created a Custom Event, added a simple parser (with Recognizer etc) and a test log message.

The XML validates ok, but when I use the Test button, I get an "Errors" message (but no other details).

My parser is listed under the 'Parser Used' column.

I cloned some other existing parsers (such as CiscoSEParser) and tried the test function there.

They also fails with "Errors"

Why do clones of 'production' parsers fail the Test ?

thanks,

Hello,

to pass the test, you also need an appropriate syslog message to test the custom parser against.

Sincerely

Harald

If is based on another parser you must disable it before clone it, in the error message sometimes you will see that the error is because another parser is handling the test message. I'm attaching a quick document that you can use as a reference, however, keep in mind that the parser used in that example is already fixed on 4.10.

In Reply to Morgan Doyle:

I've a problem with creating a custom parser. 

I've added the Device, created a Custom Event, added a simple parser (with Recognizer etc) and a test log message.

The XML validates ok, but when I use the Test button, I get an "Errors" message (but no other details).

My parser is listed under the 'Parser Used' column.

I cloned some other existing parsers (such as CiscoSEParser) and tried the test function there.

They also fails with "Errors"

Why do clones of 'production' parsers fail the Test ?

 

thanks,

-

Rolando Antón

Attachment(s)

FSM_Fixing_parsers_v1.pdf   2.92 MB 1 version