Ingesting a generic Syslog RFC 5424 into Chronicle?

[kbprogrammer]

Hi. I've got a RFC 5424 Syslog message I am attempting to ingest into Google Chronicle using the REST ingestion API.  The vendor is Mako Networks. I do not see a parser for this particular vendor listed here (https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers). 

Is there a vendor neutral Syslog parser for Chronicle? Do I need to convert this to UDM? Any guidance would be greatly appreciated? 

[Rene_Figueroa]

Hello @kbprogrammer,

The link you provided is for supported default parsers. Not all available log types have a parser, so it is possible to ingest a log even if there is no parser; the data will be unparsed though. 

For your case, if there is no "Mako Networks" log type under the supported data sets, requesting a new log type for it will be the first step:

https://cloud.google.com/chronicle/docs/supported-datasets

Please open a new support case and ask for a new log label for "Mako Networks" and provide the public documentation for this log source. Once the label is created, the next step will be for you to start sending logs and once we have the logs, you can request a parser for "Mako Networks".

[kbprogrammer · Accepted solution]

Hi! I did some research and the Mako Network logs conforms to the Netfilter spec (https://www.netfilter.org/) and luckily, there is a NETFILTER_IP parser already written. I had to do some debugging and formatting of the original syslog message coming from the mako devices before sending it to Chronicle as the Grok parser would fail to parse.