Skip to main content
fortivandis
fortivandis
New Member
August 15, 2021
Question

FortiSIEM Custom JSON Parser

  • August 15, 2021
  • 6 replies
  • 6223 views

Hi all. I'm having issues with this JSON custom parser. I'm trying to test it but I receive an error without any details or parser used. I tried everything and I'm not sure where to go next.

 

Here is the parser:

 

<eventFormatRecognizer>     <![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=jamf]]> </eventFormatRecognizer> <patternDefinitions>     <pattern name="patLazyNestedJSON">         <![CDATA[({[\s\S]*?})]]>     </pattern>     <pattern name="patGreedyNestedJSON">         <![CDATA[({[\s\S]*})]]>     </pattern>     <pattern name="patEventType">         <![CDATA[\w+]]>     </pattern> </patternDefinitions> <parsingInstructions>     <!-- Get the raw message and json data objects -->     <collectFieldsByRegex src="$_rawmsg">         <regex>             <![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:<_body:gPatMesgBodyMin>,\[json\]=<_json:gPatMesgBodyMin>\s*$]]>         </regex>     </collectFieldsByRegex>     <!-- parse out nested json objects -->     <collectFieldsByRegex src="$_json">         <regex>             <![CDATA["webhook":\s+<_webhook:patLazyNestedJSON>,\s+"event"]]>         </regex>     </collectFieldsByRegex>          <collectFieldsByRegex src="$_json">         <regex>             <![CDATA["event":\s+<_event:patGreedyNestedJSON>]]>         </regex>     </collectFieldsByRegex>     <!-- Collect attributes in [] -->     <collectAndSetAttrBySymbol sep=",[" src="$_body" symEnd="]=" symStart="["/>     <setEventAttribute attr="eventType">"JAMF-CLOUD-JSON"</setEventAttribute>          <collectAndSetAttrByJSON src="$_webhook">         <attrKeyMap attr="devName" key="name"/>     </collectAndSetAttrByJSON> </parsingInstructions>

 

 

 

 

 

And here is the raw JSON file

 

[PH_DEV_MON_CUSTOM_JSON]:[reptVendor]=jamf,[reptModel]=Cloud,[reptDevName]=jamf,[reptDevIpAddr]=10.47.7.9,[json]={ {   "webhook": {     "id": 2,     "name": "SIEM",     "webhookEvent": "ComputerPolicyFinished",     "eventTimestamp": 1628873569515   },   "event": {     "policyId": 219,     "successful": true,     "computer": {       "udid": "20FF5074-46DE-58D3-9702-546ADA164942",       "deviceName": "FVFXV1TWHV2F",       "model": "13-inch Retina MacBook Pro (Mid 2017)",       "macAddress": "38:F9:D3:4D:52:AC",       "alternateMacAddress": "46:00:B8:80:13:01",       "serialNumber": "FVFXV1TWHV2F",       "osVersion": "10.14.6",       "osBuild": "18G8022",       "userDirectoryID": "-1",       "username": "jsmith",       "realName": "John Smith",       "emailAddress": "test@test.com",       "phone": "",       "position": "Sales Analyst",       "department": "Sales",       "building": "New York",       "room": "",       "ipAddress": "100.50.100.200",       "reportedIpAddress": "192.168.1.158",       "jssID": 989     }   },   "event_type": "ComputerPolicyFinished" }

 

 

Note that when I test it I make sure to use a single line JSON.

Thanks for all the help and have a nice day

    6 replies

    cdurkin_FTNT
    Staff
    cdurkin_FTNT
    Staff
    August 16, 2021

    Hi...

     

    Hard to provide a full parser, but I can provide some tips here..

     

    Assuming this was your test event..

     

    {"webhook":{"id":2,"name":"SIEM","webhookEvent":"ComputerPolicyFinished","eventTimestamp":1628873569515},"event":{"policyId":219,"successful":true,"computer":{"udid":"20FF5074-46DE-58D3-9702-546ADA164942","deviceName":"FVFXV1TWHV2F","model":"13-inch Retina MacBook Pro (Mid 2017)","macAddress":"38:F9:D3:4D:52:AC","alternateMacAddress":"46:00:B8:80:13:01","serialNumber":"FVFXV1TWHV2F","osVersion":"10.14.6","osBuild":"18G8022","userDirectoryID":"-1","username":"jsmith","realName":"John Smith","emailAddress":"test@test.com","phone":"yyy","position":"Sales Analyst","department":"Sales","building":"New York","room":"yyy","ipAddress":"100.50.100.200","reportedIpAddress":"192.168.1.158","jssID":989}},"event_type":"ComputerPolicyFinished"}

     

    Then the JSON Parser Function would be..

     

    <collectAndSetAttrByJSON src="$_body"> <attrKeyMap attr="_id" key="webhook.id"/> <attrKeyMap attr="_name" key="webhook.name"/> <attrKeyMap attr="_webhookEvent" key="webhook.webhookEvent"/> <attrKeyMap attr="_eventTimestamp" key="webhook.eventTimestamp"/> <attrKeyMap attr="_policyId" key="event.policyId"/> <attrKeyMap attr="_successful" key="event.successful"/> <attrKeyMap attr="_udid" key="event.computer.udid"/> <attrKeyMap attr="_deviceName" key="event.computer.deviceName"/> <attrKeyMap attr="_model" key="event.computer.model"/> <attrKeyMap attr="_macAddress" key="event.computer.macAddress"/> <attrKeyMap attr="_alternateMacAddress" key="event.computer.alternateMacAddress"/> <attrKeyMap attr="_serialNumber" key="event.computer.serialNumber"/> <attrKeyMap attr="_osVersion" key="event.computer.osVersion"/> <attrKeyMap attr="_osBuild" key="event.computer.osBuild"/> <attrKeyMap attr="_userDirectoryID" key="event.computer.userDirectoryID"/> <attrKeyMap attr="_username" key="event.computer.username"/> <attrKeyMap attr="_realName" key="event.computer.realName"/> <attrKeyMap attr="_emailAddress" key="event.computer.emailAddress"/> <attrKeyMap attr="_phone" key="event.computer.phone"/> <attrKeyMap attr="_position" key="event.computer.position"/> <attrKeyMap attr="_department" key="event.computer.department"/> <attrKeyMap attr="_building" key="event.computer.building"/> <attrKeyMap attr="_room" key="event.computer.room"/> <attrKeyMap attr="_ipAddress" key="event.computer.ipAddress"/> <attrKeyMap attr="_reportedIpAddress" key="event.computer.reportedIpAddress"/> <attrKeyMap attr="_jssID" key="event.computer.jssID"/> <attrKeyMap attr="_event_type" key="event_type"/> </collectAndSetAttrByJSON>

     

    Obviously, here all the extracts are set to variables which you can change for attributes as required.

     

    Hope this helps.

     

    regards

    Chris Durkin

    fortivandis
    fortivandisAuthor
    New Member
    August 16, 2021

    Hi Chris,

    Thanks for the reply. I tried your solution but I still got an error. Unfortunately FortiSIEM

    doesn't tell me what the error is and instead just highlights the test area red.

    Thanks again for the help though!

    cdurkin_FTNT
    Staff
    cdurkin_FTNT
    Staff
    August 16, 2021

    Can you provide the full parser you tried?

     

    What was the error in RED?

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!