Supported log types and default parsers

This document contains information about Google Security Operations integrations for data ingestion. It summarizes the devices and the associated ingestion label ( log_type ) field in the Ingestion API and data_type in a Forwarder configuration that Google SecOps supports.

For information on how to request or create log types, see Request prebuilt and create custom log types .

• Supported log types with a default parser

• Supported log types without a default parser

Supported log types with a default parser

Parsers normalize raw log data into structured Unified Data Model (UDM) format. This section lists supported devices, and the associated ingestion label ( log_type field in the Ingestion API and data_type in a Forwarder configuration), that also have a prebuilt default parser. The default parser is supported by Google SecOps as long as the device's raw logs are received in the required format.

For a list of supported log types without a default parser, see Supported log types without a default parser .

The Formatcolumn indicates the high-level structure of the raw log, as:

• CSV: Comma Separated Values
• JSON: JavaScript Object Notation
• SYSLOG: syslog formatted message
• KV: key-value pair
• XML: Extensible Markup Language
• SYSLOG + KV: syslog header with key-value body
• SYSLOG + JSON: syslog header with JSON body
• SYSLOG + XML: syslog header with XML body
• LEEF: Log Event Extended Format
• CEF: Common Event Format

These changes are applied to newly ingested logs. Parser changes are not applied retroactively to previously ingested logs.