About lukas-lr

lukas-lr · 12-14-2023

Hi everyone,Is there a way to delete a field value by using a parser extension? I want to "move" a value from one UDM field to the other, leaving the UDM field used by the default parser empty. However, I could not find an explicit way to set it to n...

lukas-lr · 12-12-2023

Hi everyone,Does anyone know how the asset enrichment with the parsers for Windows events is supposed to work? I feel like a lot of parser extensions is required to get consistent IDs.We are ingesting Windows events as WINEVTLOG and AD asset data as ...

lukas-lr · 12-07-2023

Hi everyone,Is there a way to get the length of a string in YARA-L? For example, I'd like to alert on DNS queries longer than a certain threshold.

lukas-lr · 11-21-2023

Hi All,We are already ingesting logs from Dell EMC PowerStore (with a custom parser), but there is also a requirement to ingest logs from Dell Compellent/SC Series and Dell EqualLogic - the predecessors of PowerStore, as far as I know.Does anyone hav...

lukas-lr · 11-21-2023

Hi all,My client wants to ingest logs from their Huawei OceanStor Pacific appliances, but there is no datatype for this log source as of now. How can I request one? And is there a "generic" data type which I can use to ingest the logs and develop a p...

lukas-lr · 12-28-2023

Hi, the date filter should automatically set the "@timestamp" field, which is then used as the log timestamp in Chronicle

lukas-lr · 12-27-2023

Hi aravind,Are you sure your date field always contains a valid date? If the format is unstable, you can add more formats to the match array. If it is not always a date, you could check for example with something likeif [date] =~ /\d+-\d+\d+T\d+:\d+\...

lukas-lr · 12-27-2023

The problem might be that you use the same variable name for the original string and the dictionary. I.e. try to change your code toif [startTime] != "" and [startTime] != "--" { mutate { convert => { "startTime" => "string" } on_error => "status_alr...

lukas-lr · 12-27-2023

Hi manoj06,After extracting the fields from the JSON, you can use one of date { match => ["endTimeISO", "yyyy-MM-ddTHH:mm:ss.SSSZZ"] } date { match => ["startTimeISO", "yyyy-MM-ddTHH:mm:ss.SSSZZ"] } date { match => ["eventTimeISO", "yyyy-MM-ddTHH:mm:...

lukas-lr · 12-18-2023

Thank you for the reply and the code example. I'll think about which way to normalize it works better for us

My Stats

Adam_Roberts's Bio

Badges lukas-lr Earned

Recent Activity

Use parser extension to remove field mapping

Windows Parsers and Asset Enrichment

Use string length in YARA-L rule

Ingesting logs from legacy Dell Storages

Require new data type for Huawei OceanStor

Re: How can I parse Timestamp?

Re: How can I parse Timestamp?

Re: Understanding convert in parsing

Re: How can I parse Timestamp?

Re: Windows Parsers and Asset Enrichment