Technical Tip: How to extract customized parsers into XML files

[mbenvenuti]

Description	This article describes how to extract customized parsers into XML files.
Scope	FortiSIEM.
Solution	For the FortiSIEM to comply with devices, it is sometimes necessary to modify or create parsers in Admin -> Devices -> Parsers. FortiSIEM saves the parsers by default in its database. It can be required to save those parsers in other locations for backup/versioning purposes or import them on another FortiSIEM. Here are the steps and the scripts to proceed with this extraction: Download the attached extract_parser_to_xml.sh file and put it in /tmp in super FortiSIEM. From super CLI as root: chmod +x /tmp/extract_parsers_to_xml.sh /tmp/extract_parsers_to_xml.sh /tmp/extracted_parsers.tar.gz is generated with all the customized parsers. Those parsers can now be stored for backup/versioning or used while creating or cloning a parser in GUI at Admin -> Device -> Parsers.