Supported log types and default parsers

This document contains information about Google Security Operations SIEM integrations for data ingestion. It summarizes the devices supported by Google Security Operations SIEM, and lists their associated ingestion label (log_type for Ingestion APIs or data_type for Forwarder configurations).

• Supported log types with a default parser

• Supported log types without a default parser

Supported log types with a default parser

Parsers normalize raw log data into structured Unified Data Model format. This section lists supported devices that have a prebuilt default parser, and their associated ingestion label (log_type for Ingestion APIs or data_type for Forwarder configurations). Default parsers are supported by Google Security Operations as long as the device's raw logs are received in the required format.

For a list of supported log types without a default parser, see Supported log types without a default parser.

The Format column indicates the high-level structure of the raw log, as:

• CSV: Comma Separated Values
• JSON: JavaScript Object Notation
• SYSLOG: syslog formatted message
• KV: key-value pair
• XML: Extensible Markup Language
• SYSLOG + KV: syslog header with key-value body
• SYSLOG + JSON: syslog header with JSON body
• SYSLOG + XML: syslog header with XML body
• LEEF: Log Event Extended Format
• CEF: Common Event Format

These changes are applied to newly ingested logs. Parser changes are not applied retroactively to previously ingested logs.

Supported log types without a default parser

Google Security Operations SIEM does not provide a default parser for these log types. You can ingest raw logs from these devices using the Google Security Operations SIEM Ingestion API or the Google Security Operations SIEM forwarder. Google Security Operations SIEM will not normalize the data to structured Unified Data Model format.

You can create a custom parser to normalize these logs. You can also search raw logs.