Skip to main content
mbenvenuti
Staff
Staff
February 28, 2025

Technical Tip: How to start creating a customized parser

  • February 28, 2025
  • 0 replies
  • 707 views
Description This article describes how to start creating a customized parser.
Scope FortiSIEM.
Solution

When it is required to create a new parser, it is a good practice to start from an existing parser with the below steps :

  • Go to the Admin -> Device support -> Parsers.
  • Disable the original system parser.
  • Clone and edit the cloned parser.
  • Add the required custom lines.
  • Validate.
  • Test using the sample provided.
  • Enable and apply this parser in GUI.