satellite-no
commented
2 years ago @rjha-splunk Here is sample parser we came up with for Sophos logs if this helps. Apologies on not having more sample logs, being that this is firewall it gets large very quickly before more sourcetypes come in.
# Sophos Firewall XG Parser
block parser sophos_firewall_xg-parser() {
channel {
rewrite {
r_set_splunk_dest_default(
index('firewall')
sourcetype('sophos:xg:logs')
vendor('sophos')
product('xg')
class('logs')
template('t_msg_only')
);
};
# ATP
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:atp')
class('atp')
condition(message('log_type="ATP"' type(string) flags(substring)))
);
};
# Anti Spam
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:anti_spam')
class('anti_spam')
condition(message('log_type="Anti-Spam"' type(string) flags(substring)))
);
};
# Anti Virus
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:anti_virus')
class('anti_virus')
condition(message('log_type="Anti-Virus"' type(string) flags(substring)))
);
};
# Content Filtering
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:content_filtering')
class('content_filtering')
condition(message('log_type="Content Filtering"' type(string) flags(substring)))
);
};
# Event
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:event')
class('event')
condition(message('log_type="Event"' type(string) flags(substring)))
);
};
# Firewall
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:firewall')
class('firewall')
condition(message('log_type="Firewall"' type(string) flags(substring)))
);
};
# SSL
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:ssl')
class('ssl')
condition(message('log_type="SSL"' type(string) flags(substring)))
);
};
# Sandbox
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:sandbox')
class('sandbox')
condition(message('log_type="Sandbox"' type(string) flags(substring)))
);
};
# System Health
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:system_health')
class('system_health')
condition(message('log_type="System Health"' type(string) flags(substring)))
);
};
# Heartbeat
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:heartbeat')
class('heartbeat')
condition(message('log_type="Heartbeat"' type(string) flags(substring)))
);
};
# WAF
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:waf')
class('waf')
condition(message('log_type="WAF"' type(string) flags(substring)))
);
};
# Wireless Protection
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:wireless_protection')
class('wireless_protection')
condition(message('log_type="Wireless Protection"' type(string) flags(substring)))
);
};
# IDP
rewrite {
r_set_splunk_dest_update_v2(
sourcetype('sophos:xg:idp')
class('idp')
condition(message('log_type="IDP"' type(string) flags(substring)))
);
};
};
};
application sophos_firewall_xg[sc4s-syslog] {
filter {
(
message("device=\"SFW\"" type(string) flags(substring)) and
message("log_type=" type(string) flags(substring))
)
;
};
parser { sophos_firewall_xg-parser(); };
};
rjha-splunk
Please add a new log parser for Sophos Firewall data.
TA: https://splunkbase.splunk.com/app/6187/ Sourcetypes: