Hello team,
We have recently ingested the AWS GuardDuty logs to our Secops platform but they are not getting parsed as expected. We do not face such issues with the rest of the feeds from AWS platform such as CloudTrail, EC2 VPCs, AWS Config. There is no error message but there appears a tag "UNPARSED_RAW_LOG
How are you ingesting these? Are they in unmodified JSON? If so it's possible these are messages that haven't been considered in the parser and would need a support ticket to get updated, you can create a parser extension in the mean time.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.