Skip to main content

Appendix

Supporting material that sits outside the main task flow: working code to copy, and techniques for extending the platform past what the built-in screens cover. Nothing here is required to run the platform — these are the pages you come to once data is flowing and you want to do more with it.

In this section​

Cookbooks​

A library of working FPL code taken from real deployments. Each recipe is a complete, functioning script meant to be copied into a processor and adapted rather than read as a tutorial.

  • Parsers — processor scripts that turn a specific vendor's raw output into normalized events. Recipes cover firewalls and network devices (Cisco Meraki, FortiGate, Palo Alto, SonicWall, Sophos UTM, Peplink), servers and endpoints (Linux, Windows via NXLog, Bitdefender, SentinelOne, Zimperium), plus two general-purpose recipes: Passthrough, the minimal parser to start any new format from, and Time Adjustment, the fix for the most common ingest problem.
  • Reports — report scripts that query the data lake and assemble tables for dashboards and scheduled delivery. These split into operational accounting (EventIngress for volume and cost questions, LoadResources_AD for loading Active Directory assets) and security summaries (BehaviorSummary, AzureAD_Logins, Office365_UserActivityInvestigation).

Advanced Use Cases​

Techniques that combine several features rather than configuring one. Reports covers authoring reports in FPL, building widgets and scheduling the result; Metrics covers emitting custom counters from inside a processor so that operational numbers can be charted and alerted on like any other telemetry.

Where to look first​

  • FPL Reference — the language every recipe here is written in.
  • Processors — where parser and metric code runs in the pipeline.
  • Normalization — the schema a parser should produce.
  • Reports — the main report documentation these recipes support.