Support parsing and addition of third-party application logs to the SIEM DB in JSON format 7.4.1
|
This information is also available in the FortiAnalyzer 7.4 Administration Guide: |
If third-party logs are in JSON format, the default Windows, Apache, and Nginx log parsers can parse generic field data from them. These default log parsers can also be updated in the GUI, if needed.
In Incidents & Events > Log Parser > Assigned Parsers, the third-party devices are automatically assigned to the appropriate log parser according to their logs in JSON format.
The Windows Event Log Parser can parse Windows logs in JSON format. For example, Event_Profile, Event_Serverity, and Host_Name. The complete content of JSON is inserted into Event_Msg field for future reference, if needed.
The Nginx Log Parser can parse Nginx server logs in JSON format. For example, Data_TimeStamp, Host_Name, and HTTP_Referrer. The complete content of JSON is inserted into Event_Msg field for future reference, if needed.
The Apache Log Parser can parse Apache server logs in JSON format. For example, Host_IP, Host_Name, and Application_Service. The complete content of JSON is inserted into Event_Msg field for future reference, if needed.
