Forum Discussion
Syslog Message parser
Hi All,
I have below syslog message which need to be parsed. I tried to parse manually however, since its not being ingested as raw log so manually parsing does not work. Any help would be greatly appreciated regarding parsing below syslog message. Thanks.
APPTRACK_SESSION_CREATE: AppTrack session created 192.168.1.3/24026->8.8.8.8/61793 icmp UNKNOWN UNKNOWN 141.115.128.112/48006->8.8.8.8/61793 Wan-Out-1 N/A 1 audit-untrust zone-wan untrust 380677 N/A N/A UNKNOWN abc.1 N/A N/A N/A N/A
- There are lots of examples in the Sentinel github: https://github.com/Azure/Azure-Sentinel/search?q=syslog+syslogmessage
Typically people use extract or matches regex, but parse, parse-where or split also work, some of the ASIM parsers are very recent like this one: https://github.com/Azure/Azure-Sentinel/blob/2c16f2a009afd5cd8b6c2baf2d07a7beb8c79854/Parsers/ASimDns/Parsers/ASimDnsInfobloxNIOS.yaml
