Add custom Advanced Syslog Parser rules

Type a unique, descriptive name for the rule, which appears in the Trellix ESM views when the rule matches a log (unless the message is mapped directly from the log text in the rule).

Assign tags to the rule to help find and group rule sets created for a given device or application in the policy editor. Anytime you use tags assigned to other rules, Trellix ESM automatically includes your tags into policies that use the rule set.

Select the default normalized ID, which views, correlation rules, and reports can use as a filter.

Enter a default severity value that the system can assign to log messages without severity values. The default is 25, valid values are 1–100 (1 is the lowest severity).

Group parsing rules by supported products, separating the events from other data sources and allowing the event to be reported for a specific product.

Select a process name (which is similar to the content string filter, but only applies to the process name found in the SYSLOG header). Syslog header formats vary widely, so use content strings when possible.

If a fixed string is always found in the log, add it as a content string. The content strings of an ASP rule identify each log. To speed up rule execution, include at least one content string in each ASP rule. This serves as a pre-filter for optimization - only logs that match the given content strings are considered for matching and parsing by the regular expressions. The log must contain all defined content strings.

Ensure there is at least one value in the content field section. Content strings are at least three characters long and be as unique as possible for the specific event. Include enough content matches to uniquely identify the log. Using one or more content fields in the ASP rule can improve the matching and parsing process on the Trellix Enterprise Security Manager - Event Receiver.

For example, if the log entry is in this format:<180>Jan 1 00:00:00 testhost ftpd[4325]: FTP LOGIN FROM test.org [192.168.1.1], anonymous, add content fields for ftpd and FTP LOGIN FROM.

The first regular expression determines if the ASP rule matches the log. The system uses additional expressions to capture values from the log.

Use named captures to identify capture groups. The label used for the named capture can consist of letters, numbers, and underscore characters but cannot begin with a number or include a space. The regular expression syntax for a named capture is: (?P<NAME>regular expression capture). For example, a named capture where host name is the name assigned to the capture group would be: Host\x3d(?P<hostname>\S+). When using named captures the Policy Editor displays the capture name instead of the capture number, in the right side of the Parsing tab.

Paste a sample log entry to be parsed. The system highlights parts of the log that match your regular expressions in blue.

ASP can pre-process certain logging formats to simplify the mapping of data. The following formats are available:

Key/Value — display what the regular expressions parse from the log samples. Key displays two numbers, separated by a colon. The first number indicates the used regular expression, and the second number indicates the capture group in that regular expression. If a captured value is the fourth capture in the third regular expression defined, the key would display 3:4.

The parser uses the content string (instead of a regular expression) for matching. Regular expressions are used only to parse messages.

If the log contains upper- or lowercase letters, write the expression in the same case then use the Case Insensitive option, enabling case insensitivity for all regular expressions defined in the parsing rule.

Date/timestamp of a log message can be parsed using the Time Format variables. Trellix ESM recognizes many standard date/timestamps automatically, but there can be unrecognized formats or ones that display differently. This section allows formatting the time to show up in the proper format when parsed.

Use Action Mapping option if there is an action found in the log to be mapped to an available Trellix ESM.

Severity mapping maps values in the log to a severity from 1–100. For example, a vendor might define their severity as either Low, Medium, or High in their logs. With the Severity Map section, the severity value can map Low as 25, Medium as 50, and High as 75.