This parser extracts fields from DELL ECS syslog messages, mapping them to the UDM. It handles UPDATE and DELETE event types specifically, extracting user and IP information for login/logout events. Other events are categorized as GENERIC_EVENT. It uses grok patterns to parse the message and mutate filters to populate UDM fields, dropping events that don't match the expected format.
Before you begin
Ensure that you have a Google Security Operations instance.
Ensure that you are using Windows 2016 or later, or a Linux host with systemd.
If running behind a proxy, ensure firewall ports are open.
Ensure that you have privileged access to Dell ECS.
Get Google SecOps ingestion authentication file
Sign in to the Google SecOps console.
Go to SIEM Settings > Collection Agents.
Download the Ingestion Authentication File. Save the file securely on the
system where Bindplane Agent will be installed.
Get Google SecOps customer ID
Sign in to the Google SecOps console.
Go to SIEM Settings > Profile.
Copy and save the Customer ID from the Organization Details section.
Install Bindplane Agent
Windows Installation
Open the Command Prompt or PowerShell as an administrator.
Configure Bindplane Agent to ingest Syslog and send to Google SecOps
Access the configuration file:
Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
Open the file using a text editor (for example, nano, vi, or Notepad).
Edit the config.yaml file as follows:
receivers:tcplog:# Replace the below port <54525> and IP <0.0.0.0> with your specific valueslisten_address:"0.0.0.0:54525"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the creds location below according the placement of the credentials file you downloadedcreds:'{jsonfileforcreds}'# Replace <customer_id> below with your actual ID that you copiedcustomer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# You can apply ingestion labels below as preferredingestion_labels:log_type:SYSLOGnamespace:dell_ecsraw_log_field:bodyservice:pipelines:logs/source0__chronicle_w_labels-0:receivers:-tcplogexporters:-chronicle/chronicle_w_labels
Replace the port and IP address as required in your infrastructure.
Replace <customer_id> with the actual customer ID.
In Linux, to restart the Bindplane Agent, run the following command:
sudosystemctlrestartbindplane-agent
In Windows, to restart the Bindplane Agent, you can either use the Services console or enter the following command:
net stop BindPlaneAgent && net start BindPlaneAgent
Configure Dell ECS to Forward Logs to the Syslog Server
Sign in to the ECS management portal using administrative credentials.
Go to Settings > Event Notifications > Syslog.
Click New Server.
Provide the following details:
Protocol: select either UDP or TCP (ensure it matches the protocol configured on the Syslog server).
Target: enter the IP address or Fully Qualified Domain Name (FQDN) of the Syslog server.
Port: enter the port number.
Severity: select Informational as the minimum severity level of logs to be forwarded.
Click Save.
UDM Mapping Table
Log Field
UDM Mapping
Logic
data
read_only_udm.metadata.description
If eventType is UPDATE, the description is extracted from the data field using a regular expression. If eventType is DELETE, the description is extracted from the data field using a regular expression and further processed to extract the user ID.
data
read_only_udm.principal.ip
If eventType is UPDATE, the IP address is extracted from the data field using a regular expression.
data
read_only_udm.target.resource.product_object_id
If eventType is DELETE, the URN token is extracted from the data field using a regular expression.
data
read_only_udm.target.user.userid
If eventType is UPDATE, the user ID is extracted from the data field using a regular expression. If eventType is DELETE, the user ID is extracted from the description field after initial processing of the data field.
eventType
read_only_udm.metadata.event_type
If eventType is UPDATE and a userid is extracted, the event type is set to USER_LOGIN. If eventType is DELETE and a userid is extracted, the event type is set to USER_LOGOUT. Otherwise, the event type is set to GENERIC_EVENT.
eventType
read_only_udm.metadata.product_event_type
The value is derived by concatenating the serviceType and eventType fields from the raw log, enclosed in square brackets and separated by " - ".
hostname
read_only_udm.principal.asset.hostname
The hostname is copied from the hostname field.
hostname
read_only_udm.principal.hostname
The hostname is copied from the hostname field.
log_type
read_only_udm.metadata.log_type
The log type is set to DELL_ECS. The mechanism is hardcoded to MECHANISM_UNSPECIFIED. The event timestamp is copied from the timestamp field of the raw log entry. The product name is hardcoded to ECS. The vendor name is hardcoded to DELL. If eventType is DELETE, the resource type is hardcoded to CREDENTIAL.
timestamp
read_only_udm.metadata.event_timestamp
The event timestamp is taken from the timestamp field of the raw log entry.
timestamp
timestamp
The timestamp is parsed from the timestamp field of the raw log entry.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThis guide details how to collect and parse Dell ECS logs for ingestion into Google SecOps, supporting \u003ccode\u003eUPDATE\u003c/code\u003e and \u003ccode\u003eDELETE\u003c/code\u003e event types and mapping them to the UDM.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves downloading a Google SecOps ingestion authentication file and customer ID, then installing and configuring the Bindplane Agent on either Windows or Linux to receive and forward the logs.\u003c/p\u003e\n"],["\u003cp\u003eDell ECS must be configured to forward logs to the Syslog server, specifying the protocol, target, port, and severity level of logs to be transmitted.\u003c/p\u003e\n"],["\u003cp\u003eThe UDM mapping table outlines how various fields from the Dell ECS logs, such as data, eventType, hostname, and timestamp, are translated into UDM fields within Google SecOps, categorizing events as \u003ccode\u003eUSER_LOGIN\u003c/code\u003e, \u003ccode\u003eUSER_LOGOUT\u003c/code\u003e, or \u003ccode\u003eGENERIC_EVENT\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe parser is newly created as of March 18, 2024 and this document is considered under the Pre-GA Offerings Terms.\u003c/p\u003e\n"]]],[],null,["# Collect Dell ECS logs\n=====================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis parser extracts fields from DELL ECS syslog messages, mapping them to the UDM. It handles **`UPDATE`** and **`DELETE`** event types specifically, extracting user and IP information for login/logout events. Other events are categorized as **`GENERIC_EVENT`**. It uses grok patterns to parse the message and mutate filters to populate UDM fields, dropping events that don't match the expected format.\n\nBefore you begin\n----------------\n\n- Ensure that you have a Google Security Operations instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with `systemd`.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n- Ensure that you have privileged access to Dell ECS.\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane Agent will be installed.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall Bindplane Agent\n-----------------------\n\n### Windows Installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\n### Linux Installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\n### Additional Installation Resources\n\n- For additional installation options, consult this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure Bindplane Agent to ingest Syslog and send to Google SecOps\n--------------------------------------------------------------------\n\n1. Access the configuration file:\n\n - Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n - Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n tcplog:\n # Replace the below port \u003c54525\u003e and IP \u003c0.0.0.0\u003e with your specific values\n listen_address: \"0.0.0.0:54525\" \n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the creds location below according the placement of the credentials file you downloaded\n creds: '{ json file for creds }'\n # Replace \u003ccustomer_id\u003e below with your actual ID that you copied\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # You can apply ingestion labels below as preferred\n ingestion_labels:\n log_type: SYSLOG\n namespace: dell_ecs\n raw_log_field: body\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - tcplog\n exporters:\n - chronicle/chronicle_w_labels\n\n3. Replace the port and IP address as required in your infrastructure.\n\n4. Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n\n5. Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the\n [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/dell-ecs#get-auth-file) section.\n\nRestart Bindplane Agent to apply the changes\n--------------------------------------------\n\n- In Linux, to restart the Bindplane Agent, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n- In Windows, to restart the Bindplane Agent, you can either use the **Services** console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nConfigure Dell ECS to Forward Logs to the Syslog Server\n-------------------------------------------------------\n\n1. Sign in to the ECS management portal using administrative credentials.\n2. Go to **Settings \\\u003e Event Notifications \\\u003e Syslog**.\n3. Click **New Server**.\n4. Provide the following details:\n - **Protocol** : select either **UDP** or **TCP** (ensure it matches the protocol configured on the Syslog server).\n - **Target** : enter the **IP address** or **Fully Qualified Domain Name** (FQDN) of the Syslog server.\n - **Port** : enter the **port number**.\n - **Severity** : select **Informational** as the minimum severity level of logs to be forwarded.\n5. Click **Save**.\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
