Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
LogRhythm Custom MPE Rules - Parsing the Custom Log Sources
Rating: 3.9 out of 5(26 ratings)
111 students

LogRhythm Custom MPE Rules - Parsing the Custom Log Sources

Parse Custom Log Sources by using Regular Expressions
Created byMuhammad Adeel
Last updated 10/2022
English
English [Auto],

What you'll learn

  • Regex Overview & Basic Regex Writing.
  • Log Types - single-line & multi-line log.
  • MPE – Policy, rule builder, Base Rule and Sub Rules.
  • LogRhythm Fields and tags.
  • Custom Log Source Creation & Integration.
  • Create Custom Parser in MPE Rule Builder.
  • MPE Performance Monitoring & Troubleshooting.

Course content

8 sections • 11 lectures • 2h 0m total length

  • Course Introduction4:14

    Learn to parse custom log sources with regex in LogRhythm's MPE rules. Build and integrate custom parsers for single line logs and multi line logs, understand fields, tags, and performance.

  • Teaser 01 - Custom Log Source creation and integration2:27

    Create a new custom log source in the system monitor, enable collecting from all txt files in the directory, and tail logs to verify parsing.

  • Teaser 02 - Custom Parser creation in MPE Rule builder2:00

    Create and test a base rule regex to parse the user agent field in custom MPE rules, then add checks to capture and build common events from these fields.

  • Teaser 03 - Checking parsed logs after creating custom parser successfully2:22

    Open the web console to review past logs and verify parsing accuracy. See that all logs and common events parse correctly after creating the custom parser.

Requirements

  • Basic understanding of LogRhythm Siem Administration

Description


Hello everyone, and welcome to the LogRhythm Custom MPE Rules Course. in this course, we will Parse Custom Log Sources by using Regular Expressions

My name is Adeel and I am a Cyber Security Engineer with more than 10 years of experience.

I will be your instructor in this course.

If you are working on LogRhythm SIEM as an administrator and you have custom log sources in your environment that you want to integrate with LogRhythm, then this is the perfect course for you.

Also, if you want to learn about custom parsing in LogRhythm and want to know how parsing works in LogRhythm, you can join this course.

By the time you are done with this course, you are going to be skilled in writing regex in LogRhythm, creating custom parsers in LogRhythm, and also integrating custom log sources with LogRhythm.

My goal in this course is to help you with creating and applying a custom parser and integrating custom log sources.

I want to take a few minutes and I want to walk through the curriculum because I need you to understand what you are going to learn before you jump into the course material.

Let’s go ahead and take a look at that right now.

This course is broken up into 7 main sections.

Number one is Regex Overview & Basic Regex Writing.

Number two is log types—single-line and multi-line log.

Number three is the Message Processing Engine – Policy, Rule Builder, Base Rule, and Sub Rules.

Number four is LogRhythm fields and tags.

Number five is Custom Log Source Creation & Integration.

Number six is Custom Parser Creation.

Number Seven is MPE Performance Monitoring.

Who this course is for:

  • LogRhythm Administrators
  • LogRhythm Analysts
  • System Engineers

Report abuse