Send events in uncompressed format using Ingestion API

[yashdatabahn]

Hi Team, 

I am trying to send data to SecOps in UDM format using the Ingestion API. After sending the data, the rawevent  field shows some gibberish values instead of the actual rawevent (my JSON UDM payload). This might be due to compression ? . How can I ingest the data in UDM while keeping the rawevent field intact?

Thanks in advance

[DanDye]

Hi yashdatabahn,

I was also surprised by that gibberish when I first saw it and learned the cause from Chris Martin's blog post "Creating UDM Objects in Python":

Q. Why does a UDM Event appear as gibberish?

A UDM event appears to be stored in Proto3 format (Google Protocol Buffer format). At the time of writing Chronicle SIEM doesn’t support rendering Proto3 in the event viewer, hence they appear with some gibberish characters...The easiest option is to turn off the Raw Log tab and use the UDM Events tab only.