Skip to main content

How do we query the list of unparsed logs from the SIEM?

  • September 19, 2023
  • 9 replies
  • 9 views

Forum|alt.badge.img+3

How do we query the list of unparsed logs from the SIEM?

9 replies

Forum|alt.badge.img+6
  • Bronze 2
  • September 19, 2023

Do you mean logs that failed parsing?

You can do that with cbn_cli, e.g.
cbn_cli.py --region EUROPE error -l WORKSPACE_ACTIVITY -sd 2023-08-01T00:00:00Z -ed 2023-08-16T07:50:00Z


Forum|alt.badge.img+6
  • Bronze 2
  • September 19, 2023

I use the dashboard to see which log sources have failed logs. I dont know if theres an api call that allows you to see which log sources have recent fails.


Forum|alt.badge.img+3
  • Author
  • New Member
  • September 19, 2023

Yes @ion_ I ingested the unsupported logs via windows parser. I was able to view it the SIEM. Since I know the log, I queried it using the values from the raw log.


Forum|alt.badge.img+3
  • Author
  • New Member
  • September 19, 2023

Event Type is getting tagged as Unparsed Log but I trying to find the UDM field to filter these logs.

View files in slack


Forum|alt.badge.img+3
  • Author
  • New Member
  • September 19, 2023

Unfortunately, I don't have access to the CBN_CLI


Forum|alt.badge.img+6
  • Bronze 2
  • September 19, 2023

Okay, so im assuming you’re looking at raw log search here?

Try to search for the following in UDM:
metadata.log_type="WINEVTLOG" If this returns nothing then all of your logs aren’t parsing correctly

Note: “WINDOWS” needs to map to the log label you’re using.

View files in slack


Forum|alt.badge.img+6
  • Bronze 2
  • September 19, 2023

If you can safely redact a sample raw log enough to send it to me, I can run it against the default Windows Event parser and tell you what the issue is.

You’re going to run into issues if you can’t use cbn_cli though, if its possible to gain access I would recommend it


Forum|alt.badge.img+3
  • Author
  • New Member
  • September 19, 2023

What you said it correct.


Forum|alt.badge.img+3
  • Author
  • New Member
  • September 19, 2023

I will DM you