Course Overview
In this course, one will learn how to create custom parsers to extend the integration capability of FortiSIEM to a greater range of devices and custom applications. One will learn how parsers identify the type of device or application that sent the data, extract & save key information from the log, & map the device type and log information to an event type.
Prerequisites
You must have an understanding of the topics covered in the following courses, or have equivalent experience:
- NSE 4 FortiGate Security
- NSE 4 FortiGate Infrastructure
- NSE 5 FortiSIEM
It is also recommended that you have knowledge of programming languages and regular expressions.
Audience Profile
Cybersecurity professionals responsible for creating custom parsers on FortiSIEM should attend this course.
Learning Objectives
After accomplishment of this course, you should be able to:
- Examine how FortiSIEM determines which parsers to use
- Review parser terminology and steps to develop a parser
- Recognize different log types and structures
- Review basic & advanced regex patterns
- Utilize tools for regex validation and development
- Recognize appropriate uses of global & local patterns
- Define local and global patterns
- Recognize common string patterns in event logs
- Develop event format recognizers
- Configure parsing instructions to extract and map data
- Create collectFieldsByRegex functions
- Create setEventAttribute functions
- Add comments to parser code
- Construct conditional matching logic capabilities in parsers
- Parse & normalize date and time from logs
- Add, categorize, & query the CMDB for new parser events
- Construct parsers for various log types
- Control extracted strings from logs
- Execute calculations on variables or attributes
- Compute event severity with syslog priority values
- Utilize advanced functions to parse JSON logs
- Allow FortiSIEM support for logs in other language
Content Outline
Introduction
Regular Expressions
Event Format Recognizers
Parsing Instructions
Switch-Case Constructs
Custom CMDB Event Types
Choose-When Constructs
Key Value Pair Logs
Value List Logs
Advanced Features
FAQs
A: To attend the training session you should have an operational Desktops or Laptops with required specification along with good internet connection to access the labs.
A: We would always recommend you to attend the live session to practice & clarify the doubts instantly and get more value from your investment. However, due to some contingency if you have to skip the class Radiant Techlearning would help you with the recorded session of that particular day. However, those recorded sessions are not meant only for personal consumption and NOT for distribution or any commercial use.
A: Radiant Techlearning has a data center containing the Virtual Training environment for the purpose of participant’s hand-on-practice.
Participants can easily access these labs over Cloud with the help of remote desktop connection.
Radiant virtual labs provide you the flexibility to learn from anywhere in the world and in any time zone.
A: The learners will be enthralled as we engage them in real world and industry Oriented projects during the training program. These projects will improve your skills and knowledge and you will gain better experience. These real time projects, they will help you a lot in your future tasks and assignments.