PAM360 Parser

[adem_netsys]

Hi

I have a PAM360 Parser, but it can miss users. Does anyone have a parser related to this?

[FSM_FTNT]

Can you export a broader sample of event in CSV format from FortiSIEM and send to me direct? I will have a look.

Do you know if there is a logging guide?

[adem_netsys]

I have a parser that I have shared above, where it takes ResourceAudit or UserAudit as User information, but in some cases this place comes as N/A and I need to get the user information from "user_example" at the end of the log.

Jul 8 12:39:18 XXM01 UserAudit:N/A:EXAMPLE01.example.com User_Logged_Out 2024/07/08 12:39:17 Success XXM01 -User_Example:N/A