What’s been your experience sharing log parsers with people on this community?
Has it been beneficial? Risky?
Is GitHub the most common way to share?
Sharing log parsers with people on this community
+8- Silver 2
+9- Bronze 1
I don't know that I've specifically seen folks share log parsers, but I think that Github would probably be a good way to do so. I don't see why it'd be too risky so long as doing so does not conflict with your company's policy on information sharing.
+1I've open sourced "helpers" to pull certain types of logs from 1Password and Slack and also detections/rules but not parsers because we rely on Google engineers to update/create parsers for us
+1I would definitely be a fan of open-sourcing custom parsers! The problem lies with the custom datatypes though. You need to request those via support. The way we look at it now is make the parser, run it for a few months and then ask chronicle to make it a default supported one.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.