Creating a Parser Strategy
How to Process Windows Logs.
Windows Event Logs are a foundational source of audit data for understanding system activity. However, they can be extremely noisy without a clear analysis strategy. Fortunately, Microsoft provides a list of key events and their severity to guide your focus. Fluency will show you how to implement this list effectively
- Filter based on a list.
- Avoid hardcoding the events to be reviewed and enriched. Fluency’s EntityInfo feature allows you to upload and maintain these lists as a spreadsheet.
- Route based on Need.
- Fluency enables routing based on any logic. You can store data for long-term needs, discard it if unnecessary, or route it for analysis if it’s critical.
- Improve Workflow.
- By tailoring analysis and storage to specific needs, false positives are minimized, costs are reduced, and search performance is enhanced.
Parse and Filter Window Event Logs cleanly.
Windows Event Logs are the most common native logs generated by Microsoft Windows. However, their complex format, designed for human readability, can result in noisy and overwhelming data.
GitHub OpenSource Library
Accelerate Deplyment
Don't work alone. Fluency has a strong collection of documentation, but also large collection of code examples on our Github repository. Here are more examples of how to use Fluency.
- Fluency Processing Language.
- Fluency uses the Fluency Processing Language, which is a subset of JavaScript and GoLang.
- Modular.
- Code addresses a phase of the data flow process. In this manner, the complexity of connecting to data sources and data sinks are separated from the parsing and routing.
- Tons of Examples.
- The Git Repository is to make life easier. These are code snippets that are in use and address many of the most common flow needs.
