Default parser configuration and ingestion

Default parsers are prebuilt configurations that ingest logs from various sources and convert them into UDM events. This page provides a list of default parser documents. Each document includes detailed instructions on how to configure data sources and ensure proper ingestion and processing of logs.

• Collect Akamai DNS logs

• Collect Akamai WAF logs

• Collect Amazon CloudFront logs

• Collect Ansible AWX logs

• Collect Apigee logs

• Collect Apple macOS syslog data

• Collect Aqua Security logs

• Collect Aruba switch logs

• Collect Atlassian Bitbucket logs

• Collect Atlassian Jira logs

• Collect Auth0 logs

• Collect AWS Aurora logs

• Collect AWS CloudTrail logs

• Collect AWS CloudWatch logs

• Collect AWS Config logs

• Collect AWS Control Tower logs

• Collect AWS Elastic Load Balancing logs

• Collect AWS Elastic MapReduce logs

• Collect AWS GuardDuty logs

• Collect AWS Key Management Service logs

• Collect AWS Macie logs

• Collect AWS Network Firewall logs

• Collect AWS RDS logs

• Collect AWS Route 53 logs

• Collect AWS S3 server access logs

• Collect AWS Security Hub logs

• Collect AWS Session Manager logs

• Collect AWS VPC Flow logs

• Collect AWS VPN logs

• Collect AWS WAF logs

• Collect Azion firewall logs

• Collect Azure AD Sign-In logs

• Collect Azure API Management logs

• Collect Azure APP Service logs

• Collect Azure Application Gateway logs

• Collect Azure Firewall logs

• Collect Azure Storage Audit logs

• Collect Azure VPN logs

• Collect Azure WAF logs

• Collect BeyondTrust Remote Support logs

• Collect Bitdefender logs

• Collect BlueCat DDI logs

• Collect BMC Helix Discovery logs

• Collect Brocade ServerIron logs

• Collect Brocade switch logs

• Collect Carbon Black App Control logs

• Collect Carbon Black EDR logs

• Install Carbon Black Event Forwarder

• Collect Check Point firewall logs

• Collect Chrome Enterprise Premium data logs

• Collect Chrome management logs

• Collect CircleCI audit logs

• Collect Cisco ASA firewall logs

• Collect Cisco ISE logs

• Collect Cisco Meraki logs

• Collect Cisco Secure Email Gateway logs

• Collect Cisco Secure ACS logs

• Collect Cloud Compute context logs

• Collect Cloud Compute logs

• Collect Cloud Identity Devices logs

• Collect Cloud Identity Device Users logs

• Collect Cloud Intrusion Detection System (Cloud IDS) logs

• Collect Cloud IoT logs

• Collect Cloud Identity and Access Management (IAM) Analysis logs

• Collect Cloud Next Generation Firewall Enterprise logs

• Collect Cloud Run logs

• Collect Cloud Security Command Center Error logs

• Collect Cloud Security Command Center Observation logs

• Collect Cloud Security Command Center Posture Violation logs

• Collect Cloud Security Command Center Toxic Combination logs

• Collect Cloud Security Command Center Unspecified logs

• Collect Cloud SQL logs

• Collect Cloud Storage context logs

• Collect Cloud Secure Web Proxy logs

• Collect Cloud VPC Flow Logs

• Collect Cloudflare logs

• Collect Cloudflare WAF logs

• Collect CloudPassage Halo logs

• Collect Cohesity logs

• Collect Corelight Sensor logs

• Collect CrowdStrike Falcon logs

• Collect CrowdStrike Falcon Stream logs

• Collect CyberArk EPM logs

• Collect CyberArk PAM logs

• Collect CyberX logs

• Collect Datadog logs

• Collect Delinea Secret Server logs

• Collect Dell ECS logs

• Collect Dell switch logs

• Collect Duo Activity logs

• Collect F5 BIG-IP APM logs

• Collect F5 BIG-IP LTM logs

• Collect Fastly WAF logs

• Collect Fidelis Network logs

• Collect FireEye NX logs

• Collect Fluentd logs

• Collect Forcepoint DLP logs

• Collect FortiWeb WAF logs

• Collect GitHub audit logs

• Collect GitLab logs

• Collect Google Cloud Audit Logs

• Collect Google Cloud Firewall logs

• Collect Google Cloud Load Balancing logs

• Collect Google Cloud NAT logs

• Collect Google Kubernetes Engine (GKE) logs

• Send Google Workspace data to Google SecOps

• Collect Google Workspace logs

• Collect HashiCorp audit logs

• Collect IBM Security Verify Access logs

• Collect Illumio Core logs

• Collect Imperva Incapsula Web Application Firewall logs

• Collect Infoblox logs

• Collect Jamf Protect logs

• Collect Jamf Telemetry logs

• Collect Jamf Threat Events logs

• Collect Jenkins logs

• Collect JFrog Artifactory logs

• Collect Juniper Junos logs

• Collect Kemp Load Balancer logs

• Collect Lacework Cloud Security logs

• Collect Linux auditd and AIX systems logs

• Collect Linux auditd and Unix system logs

• Collect McAfee Firewall Enterprise logs

• Collect Microsoft 365 logs

• Collect Microsoft Azure Activity logs

• Collect Microsoft Azure AD logs

• Collect Microsoft Azure AD Audit logs

• Collect Microsoft Azure AD Context logs

• Collect Microsoft Azure DevOps audit logs

• Collect Microsoft SQL Server logs

• Collect Microsoft Azure Key Vault logging logs

• Collect Microsoft Defender for Cloud Alert logs

• Collect Microsoft Defender for Endpoint logs

• Collect Microsoft Graph Activity logs

• Collect Microsoft Graph API alerts logs

• Collect Microsoft Intune logs

• Collect Microsoft Sentinel logs

• Collect Microsoft Windows AD data

• Collect Microsoft Windows DHCP data

• Collect Microsoft Windows DNS data

• Collect Microsoft Windows Event data

• Collect Microsoft Windows Sysmon data

• Collect Mimecast Secure Email Gateway logs

• Collect MISP IOC logs

• Collect NetApp ONTAP logs

• Collect Netgate pfSense logs

• Collect Netscaler logs

• Collect Netskope alert logs v1

• Collect Netskope alert logs v2

• Collect Netskope web proxy logs

• Collect NGINX logs

• Collect Nix System logs

• Collect ntopng logs

• Collect Nutanix Prism logs

• Collect Okta logs

• Collect OneLogin Single Sign-On (SSO) logs

• Collect Onfido logs

• Collect OpenCanary logs

• Collect OPNsense firewall logs

• Collect osquery logs

• Collect OSSEC logs

• Collect Palo Alto Cortex XDR alerts logs

• Collect Palo Alto Networks firewall logs

• Collect Palo Alto Networks IOC logs

• Collect Palo Alto Prisma Cloud logs

• Collect Palo Alto Prisma Cloud alert logs

• Collect Proofpoint On-Demand logs

• Collect Proofpoint TAP alerts logs

• Collect Pulse Secure logs

• Collect Qualys asset context logs

• Collect Qualys Continuous Monitoring logs

• Collect Qualys Scan logs

• Collect Qualys Virtual Scanner logs

• Collect Qualys Vulnerability Management logs

• Collect Radware WAF logs

• Collect Rapid7 InsightIDR logs

• Collect reCAPTCHA Enterprise logs

• Collect RSA Authentication Manager logs

• Collect Salesforce logs

• Collect Security Command Center findings

• Collect SentinelOne Alert logs

• Collect SentinelOne Cloud Funnel logs

• Collect SentinelOne EDR logs

• Collect SentinelOne Deep Visibility logs

• Collect ServiceNow Security logs

• Collect SonicWall logs

• Collect Sophos UTM logs

• Collect Splunk CIM logs

• Collect Suricata Eve logs

• Collect Symantec Event Export logs

• Collect Synology logs

• Collect Sysdig logs

• Collect Thinkst Canary logs

• Collect ThreatConnect IOC logs

• Collect Trend Micro Apex One logs

• Collect Trend Micro Cloud One logs

• Collect Trend Micro Deep Security logs

• Collect Tripwire logs

• Collect Twingate VPN logs

• Collect Versa Networks Secure Access Service Edge (SASE) logs

• Collect VMware ESXi logs

• Collect VMware Networking and Security Virtualization (NSX) Manager logs

• Collect VMware Workspace ONE UEM logs

• Collect WatchGuard Fireware logs

• Collect Wazuh logs

• Collect Wordpress CMS logs

• Collect Workday HCM logs

• Collect Zeek (Bro) logs

• Zscaler parsers overview

• Collect Zscaler CASB logs

• Collect Zscaler DLP logs

• Collect Zscaler DNS logs

• Collect Zscaler Firewall logs

• Collect Zscaler Internet Access logs

• Collect Zscaler Tunnel logs

• Collect Zscaler VPN logs

• Collect Zscaler web proxy logs

• Collect Zscaler ZPA logs

• Collect Zscaler ZPA Audit logs

Need more help? Get answers from Community members and Google SecOps professionals.