Extract actionable data from logs in syslog format.
The data you use to hunt threats comes from many sources and in many formats. ASP uses parsing rules to extract useful data from logs to create Trellix ESM events.
Trellix ESM provides predefined rules for parsing data from hundreds of third-party devices. You can add new ASP parsing rules or modify the predefined ones.
Parsing happens on a Receiver and the resulting events are sent to the Trellix ESM.
ASP uses a format similar to Snort: ACTION Protocol Src_ip Src_port -> Dst_ip Dst_port (keyword: option; keyword: option;...;)
Note
When concatenating literal values with a PCRE subcapture in versions 9.0.0 and later, put literals in quotes individually if they contain spaces or other characters and leave the PCRE subcapture references unquoted.