Parsers

A parser is an FPL processor script that takes a raw record as it arrives — usually a syslog line, sometimes a JSON document pushed to a HEC endpoint — decides whether it belongs to this feed, extracts the fields worth keeping, sets a correct timestamp and event type, and passes the result on to the pipeline. Every recipe below is a working script from a live deployment, so the fastest way to onboard one of these devices is to import the matching recipe and adjust it rather than start from an empty processor. The last few entries are not vendor-specific at all: they solve problems that recur across many sources.

Firewall and network device parsers

• Cisco Meraki — syslog event and traffic logs from Meraki appliances. See Cisco Meraki.
• Fortigate Firewall — key-value event and traffic logs from FortiGate NGFWs. See Fortinet FortiGate.
• PaloAlto Firewall — syslog from PAN-OS firewalls. See Palo Alto NGFW.
• Sonicwall Firewall — event and traffic logs from SonicWall firewalls. See SonicWall NGFW.
• Sonicwall VPN — SSL-VPN records, including WAF findings, from SonicWall appliances.
• Sophos UTM — packet-filter and related logs from Sophos UTM 9. See Sophos UTM.
• Peplink Device — event, URL and session logs from Peplink routers. See Peplink SD-WAN.

Server and endpoint parsers

• Linux Server — syslog from enterprise Linux servers. See Linux (RHEL) Syslog.
• Windows NXLog — Windows Event Log records forwarded by NXLog. See Windows Server.
• Bitdefender — GravityZone Event Push records arriving over HEC. See Bitdefender GravityZone.
• SentinelOne — alerts and events from the SentinelOne syslog integration. See SentinelOne EDR.
• SentinelOne Cloud Funnel — the fuller Cloud Funnel telemetry stream.
• Zimperium — mobile threat detections from the Zimperium syslog integration.

General-purpose recipes

• Passthrough — the minimal parser: prints what arrives and passes it through unchanged. The starting point for any new format.
• Time Adjustment — converts a device timestamp sent in local time to UTC, and stamps the collector onto the record. The fix for the single most common ingest problem.

Devices with no recipe yet

Check Point, Cisco ASA, Sophos Firewall (XG/XGS) and Varonis are supported integrations with no parser recipe in this section. Their integration pages state this explicitly rather than pointing at a near-miss recipe.

Related

• Cookbooks — the recipe library this belongs to.
• Report cookbooks — the other half of the library.
• FPL Reference — the language these recipes are written in.
• Regex and pattern parsers — extraction techniques used throughout these recipes.
• Normalization — the target schema a parser should produce.
• On-Prem / Syslog — the devices most of these recipes serve.