Skip to main content
OsamaFattoh
Explorer II
August 26, 2026
Question

Parser orders

  • August 26, 2026
  • 1 reply
  • 24 views

Hello all,

I am developing a new parser, but it currently appears at the bottom of the parser list. Is there a way to move it directly to the top without having to move it one position at a time? Moving it manually is very time-consuming.

Also, if I assign a specific parser to a device through the CMDB, will all logs/events coming from that device or link be processed by that parser, even if the event format does not match the parser's expected format?

1 reply

Muttahar_Rehman
Explorer II
August 31, 2026

Hi,
 

there is no built-in "move to top" or bulk reorder function in the FortiSIEM parser editor.
 
When you assign a parser to a device through the CMDB, FortiSIEM will attempt to use that parser first for events from that device.
 

For custom parser development:

  1. Place the parser as high as practical in the parser order.
  2. Test with representative logs.
  3. Assign it to a test device in the CMDB.
Thanks, R3hsec
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!