Default parser configuration and ingestion

Default parsers are prebuilt configurations that ingest logs from various sources and convert them into UDM events. This page provides a list of default parser documents. Each document includes detailed instructions on how to configure data sources and ensure proper ingestion and processing of logs.

• Collect Akamai DNS logs

• Collect Akamai WAF logs

• Collect Amazon CloudFront logs

• Collect Ansible AWX logs

• Collect Apigee logs

• Collect Apple macOS syslog data

• Collect Aqua Security logs

• Collect Aruba switch logs

• Collect Atlassian Bitbucket logs

• Collect Atlassian Jira logs

• Collect Auth0 logs

• Collect AWS CloudTrail logs

• Collect AWS GuardDuty logs

• Collect AWS RDS logs

• Collect AWS VPC Flow logs

• Collect Azion firewall logs

• Collect Bitdefender logs

• Install Carbon Black Event Forwarder

• Collect Chrome Enterprise Premium data logs

• Collect Chrome management logs

• Collect CircleCI audit logs

• Collect Cisco ASA firewall logs

• Collect Cisco ISE logs

• Collect Cisco Meraki logs

• Collect Cisco Secure Email Gateway logs

• Collect Cisco Secure ACS logs

• Collect Cloudflare logs

• Collect Cloudflare WAF logs

• Collect CloudPassage Halo logs

• Collect Cohesity logs

• Collect Corelight Sensor logs

• Collect CyberX logs

• Collect Datadog logs

• Collect Duo Activity logs

• Collect Fastly WAF logs

• Collect Fidelis Network logs

• Collect Fluentd logs

• Collect Forcepoint DLP logs

• Collect FortiWeb WAF logs

• Collect CrowdStrike Detection logs

• Collect CrowdStrike EDR logs

• Collect CrowdStrike IOC logs

• Collect F5 BIG-IP APM logs

• Collect F5 BIG-IP LTM logs

• Collect GitHub audit logs

• Collect GitLab logs

• Collect Google Cloud Audit Logs

• Collect Google Cloud Firewall logs

• Configure Google Cloud ingestion

• Collect Google Cloud Load Balancing logs

• Collect Google Cloud NAT logs

• Collect Google Kubernetes Engine (GKE) logs

• Send Google Workspace data to Google SecOps

• Collect Google Workspace logs

• Collect HashiCorp audit logs

• Collect Imperva Incapsula Web Application Firewall logs

• Collect Infoblox logs

• Collect Jamf Protect logs

• Collect Jamf Telemetry logs

• Collect Jenkins logs

• Collect JFrog Artifactory logs

• Collect Juniper Junos logs

• Collect Kemp Load Balancer logs

• Collect Lacework Cloud Security logs

• Collect Linux auditd and AIX systems logs

• Collect Linux auditd and Unix system logs

• Collect Microsoft 365 logs

• Collect Microsoft Azure Activity logs

• Collect Microsoft Azure AD logs

• Collect Microsoft Azure AD Audit logs

• Collect Microsoft Azure AD Context logs

• Collect Microsoft Azure DevOps audit logs

• Collect Microsoft Defender for Cloud Alert logs

• Collect Microsoft Defender for Endpoint logs

• Collect Microsoft Graph Activity logs

• Collect Microsoft Graph API alerts logs

• Collect Microsoft Intune logs

• Collect Microsoft Sentinel logs

• Collect Microsoft Windows AD data

• Collect Microsoft Windows DHCP data

• Collect Microsoft Windows DNS data

• Collect Microsoft Windows Event data

• Collect Microsoft Windows Sysmon data

• Collect Mimecast Secure Email Gateway logs

• Collect MISP IOC logs

• Collect Netgate pfSense logs

• Collect Netscaler logs

• Collect Netskope alert logs v1

• Collect Netskope alert logs v2

• Collect Netskope web proxy logs

• Collect NGINX logs

• Collect Nix System logs

• Collect ntopng logs

• Collect Nutanix Prism logs

• Collect Okta logs

• Collect OneLogin Single Sign-On (SSO) logs

• Collect Onfido logs

• Collect OpenCanary logs

• Collect OPNsense firewall logs

• Collect osquery logs

• Collect OSSEC logs

• Collect Palo Alto Cortex XDR alerts logs

• Collect Palo Alto Networks firewall logs

• Collect Palo Alto Networks IOC logs

• Collect Palo Alto Prisma Cloud logs

• Collect Palo Alto Prisma Cloud alert logs

• Collect Proofpoint On-Demand logs

• Collect Proofpoint TAP alerts logs

• Collect Pulse Secure logs

• Collect Qualys asset context logs

• Collect Qualys Continuous Monitoring logs

• Collect Qualys Scan logs

• Collect Qualys Virtual Scanner logs

• Collect Qualys Vulnerability Management logs

• Collect Rapid7 InsightIDR logs

• Collect reCAPTCHA Enterprise logs

• Collect RSA Authentication Manager logs

• Collect Salesforce logs

• Collect Security Command Center findings

• Collect SentinelOne Alert logs

• Collect SentinelOne Cloud Funnel logs

• Collect SentinelOne EDR logs

• Collect ServiceNow Security logs

• Collect SonicWall logs

• Collect Sophos UTM logs

• Collect Splunk CIM logs

• Collect Suricata Eve logs

• Collect Symantec Event Export logs

• Collect Synology logs

• Collect Sysdig logs

• Collect Thinkst Canary logs

• Collect ThreatConnect IOC logs

• Collect Trend Micro Cloud One logs

• Collect Tripwire logs

• Collect Twingate VPN logs

• Collect VMware ESXi logs

• Collect VMWare Workspace ONE UEM logs

• Collect WatchGuard Fireware logs

• Collect Wazuh logs

• Collect Wordpress CMS logs

• Collect Workday HCM logs

• Collect Zeek (Bro) logs

• Zscaler parsers overview

• Collect Zscaler DNS logs

• Collect Zscaler Firewall logs

• Collect Zscaler Internet Access logs

• Collect Zscaler web proxy logs