Parser Inability to Enable

Forum|Forum|2 years ago
May 15, 2024
3 replies
3439 views

Hi,

I have installed an agent on my windows 2008 R2 machine and I am getting the logs here but the logs are not parsed because the raw message is split into several parts, to try to fix this I disable the default parser but it does not test and does not produce a positive / negative output. I do not encounter such a problem in my test environment. When I want to validate the rule in the default, it gives an error in the xml, but it was working before, it is not possible to have an error because it is the system parser. Ekran görüntüsü 2024-05-15 163125.png

cdurkin_FTNT

Staff

Can you show an example "raw message is split into several parts"

Go to analytics where the events are coming in .. and also identify which event parser is being used.

adem_netsysAuthor

Explorer III

Hi @cdurkin_FTNT

The problem here is that it doesn't show which parser it uses, but in my test environment I found that it parses properly when I edit the raw message and remove the spaces.

Data><Data Name='AccessList'>%%1538 				%%1541 				%%4417 				%%4418 				%%4420 				%%4423 				%%4424 				</Data><Data Name='AccessReason'>%%1538:	%%1804 				%%1541:	%%1801	D:(A;ID;FA;;;SY) 				%%4417:	%%1801	D:(A;ID;FA;;;SY) 				%%4418:	%%1801	D:(A;ID;FA;;;SY) 				%%4420:	%%1801	D:(A;ID;FA;;;SY) 				%%4423:	%%1801	D:(A;ID;FA;;;SY) 				%%4424:	%%1801	D:(A;ID;FA;;;SY)

cdurkin_FTNT

Staff

Thanks.

Would really need a full csv export of the event .. and FortiSIEM version and agent version.

Message me privately if needed.

samdharar

New Member

I'm also facing the same problem on ForiSIEM 7.1.3, the testing goes on forever and can't enable the custom parser.

adem_netsysAuthor

Explorer III

@samdharar

Did you find a solution or is the situation the same?

samdharar

New Member

It goes on still, even when trying to enable previously tested parsers. So its sure that its not behaving this way due to some error in the parser. Its something wrong with the FortiSIEM nodes/appliances. I do get a proxy error few seconds after I start the testing for the parser.

KarlH

Explorer II

Linking my issue here. I cannot get my parser to enable validation passes and testing passes Does Fortinet have any explanation? other then its wonky I cannot follow the steps in the 7.1.3 user guide. they don't work. It's an endless loop of validating and testing.

https://community.fortinet.com/t5/FortiSIEM-Discussions/Cannot-Enable-a-new-parser-which-passes-validation-and-testing/m-p/353449#M1535

Sign up

Login with SSO

Login to the community

Login with SSO