Create Custom Log Source Types

You must be logged in as an Administrator to take this action.

To customize sub-rules, you can create your own log source type, clone the Catch-All base rule to your new log source type, and then add sub-rules based on the sample logs coming in.

For more information on base rules and sub-rules, see Message Processing Engine Rule Builder.

Create a New Log Source Type

1. On the main toolbar, click Deployment Manager.

2. On the Tools menu, click Knowledge, and then click Log Source Type Manager.
   The Log Source Type Manager appears.

3. In the top-left corner, click the green plus to create a new log source type.

4. Complete the Name and Abbreviation fields.

5. Select a Log Format from the list. In most cases, the format will be syslog.

6. (Optional) Complete the Brief Description and Additional Details fields.

7. Click OK.
   The new log source type appears at the bottom of the grid.

8. Click Close.

Create a New MPE Rule

1. On the Tools menu, click Knowledge, and then click MPE Rule Builder.
   The Rule Builder window appears.
2. In the Log Message Source Type Associations section on the right, expand Custom Log Source Types.
   The new log source type you added appears in this section. 
3. Select the check box for the new log source type. 

4. In the General section on the left, enter a rule name.

   

   When naming a rule, follow these accepted best practices:

   • When the matching log message contains a vendor message ID, such as an event ID in Windows Event Logs, include the ID in the name of the rule. This makes searching for the rule easier and also makes the rule more descriptive of the log that it matches.
   • If the rule matches a log from a logging system that generates logs for a wide variety of services, such as the Windows Application Event Log, include the service that generated the log message in the rule name.
   • Use rule names that contain a brief description of the action described by the log. For example: EVID 528 : Failed Authentication : Bad Username or Password
5. To associate the rule with a Common Event, click the icon to the right of the Common Event field.

6. Use the filters to select the Common Event you want, and then click OK.

   

   For more information on Common Events, see the Common Event Manager topic.

7. In the General section on the left, select Production in the Rule Status Field. Rules must be set to production for the log source type to be available in the Client Console.

8. In the Base-rule Regular Expression section, enter the following regex:  .*?
   

9. In the upper-left corner of the Rule Builder, click the black save icon, and then click the yellow folder to open the Rule Library.

10. In the menu on the left, search for the log message source type you created, and then click it to see the associate MPE Rule you created. 

11. After you verify it is there, you can close the Rule Browser.

Create a New Log Processing Policy

1. On the main SIEM toolbar, click Deployment Manager.
2. Click the Log Processing Policies tab.
3. In the top-left corner, click the green plus to create a new log processing policy.
   The Log Source Type Selector appears.
4. Use the filters to find the log source type you created in step 3 of Create a New Log Source Type. Select it, and then click OK.
5. Enter a name for the new MPE policy.
6. In the grid, select the Edit check box for the rule you want, right-click the rule, and then select Properties.
7. Select the Enabled check box but leave the rest of the default settings. 
8. To complete the policy creation, click OK, and then click OK again.
9. In the Log Processing Policies grid, use the filters to find the policy you created. 
10. Find the Policy ID column (by default, it is the last column on the right), and take note of the value there. 
    You need this value to create the Log Source Virtualization Template.

Configure the Log Source Virtualization Template

Before you complete this procedure, you need to create a log source virtualization template. For more information, see Create Log Source Virtualization Templates.

1. In the Client Console, click Deployment Manager on the main toolbar.
2. On the Tools menu, click Administration, and then click Log Source Virtualization Template Manager.

3. Right-click anywhere within the Log Source Virtualization Template Manager window, click Action, and then click Import.
   The Import dialog box displays.

4. Browse to the template you created.

5. Click Open.
   The Import Successful message appears.

6. After the template loads and is visible in the grid, click Close.
7. On the Deployment Manager tool bar, select the Log Sources tab.  
8. In the grid, double-click the custom parent log source you created in the Create a New Log Source Type procedure.
   The Log Message Source Properties dialog box appears.
9. Select the Log Source Virtualization tab, and then click Create Virtual Log Sources.
   The Create Virtual Log Sources dialog box appears.
   
10. Scroll to the bottom of the list to verify that the newly created log source is present. Then click Save.
    A confirmation message appears. 
11. To continue, click OK.
12. In the Log Sources grid, use the Log Source Name to find the newly added log source and double-click it. 
    The Log Message Source Properties dialog box appears.
13. To the right of the Log Message Source Type field, click the log message source type selector icon.
    The Log Source Type Selector appears. 
14. Use the filters to find the log source type you created, select it, and click OK. 
15. In the Log Message Processing Engine (MPE) Policy field, select the MPE policy you created in the Create a New Log Processing Policy procedure.
16. Click OK.