[
https://issues.apache.org/jira/browse/METRON-537?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15927909#comment-15927909
]
Simon Elliston Ball commented on METRON-537:
--------------------------------------------
This sounds like an excellent addition. If you have code on this, please do
submit a PR and we can review from there.
In terms of generalising a separated KV parsing, this could in theory make
sense for something like CEF, since that is essentially a non-delimited k=v
format, but I think the generalisation is not as urgent as getting a parse like
this into the project, so let's separate out that discussion.
> Create CheckPoint Firewall LEA parser
> -------------------------------------
>
> Key: METRON-537
> URL: https://issues.apache.org/jira/browse/METRON-537
> Project: Metron
> Issue Type: New Feature
> Reporter: Bas van de Lustgraaf
> Priority: Minor
> Labels: parser
>
> Parse checkpoint firewall logs. The format is as below:
> {code}loc=2352554|time=2016-11-03
> 16:58:31|action=accept|orig=10.10.10.10|i/f_dir=inbound|i/f_name=wqa78|has_accounting=0|uuid=<587a8ea7,00000003,7c898bc0,c0045800>|product=VPN-1
> & FireWall-1|__policy_id_tag=product=VPN-1 &
> FireWall-1[db_tag={440955DA-24D0-BE4E-A15A-D463D23784E0};mgmt=cp-sc;date=1478185265;policy_name=fw_policy]|src=192.168.2.1|s_port=53939|dst=1.1.1.9|service=3128|proto=tcp|rule=53|origin_sic_name=CN=na-fw1,O=domain.com.er5n2u|rule_uid={0CABE198-6E0D-44FF-A201-4F38EF72A146}|rule_name=dmz-prod|service_id=tcp-3128{code}
> Currently I have a working CheckPoint LEA parser (not production ready) that
> I can share so we can finish it together...
> Although, it might be a better idea to invest time in developing a General
> Key/Value parser, since the CheckPoint LEA format is k=v|k=v|k=v.
> Let me know.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
