Google SecOps has updated the list of supported default parsers.

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

• Airlock Digital Application Allowlisting (AIRLOCK_DIGITAL) • AIX system (AIX_SYSTEM) • Akamai DataStream 2 (AKAMAI_DATASTREAM_2) • Akamai SIEM Connector (AKAMAI_SIEM_CONNECTOR) • Apache (APACHE) • Arcsight CEF (ARCSIGHT_CEF) • Armis Alerts (ARMIS_ALERTS) • Aruba Switch (ARUBA_SWITCH) • Atlassian Cloud Admin Audit (ATLASSIAN_AUDIT) • Linux Auditing System (AuditD) (AUDITD) • Avaya Aura Experience Portal (AVAYA_AURA) • AWS Cloudtrail (AWS_CLOUDTRAIL) • AWS CloudWatch (AWS_CLOUDWATCH) • AWS Control Tower (AWS_CONTROL_TOWER) • Microsoft Azure Activity (AZURE_ACTIVITY) • Azure AD (AZURE_AD) • Azure AD Organizational Context (AZURE_AD_CONTEXT) • Azure Application Gateway (AZURE_GATEWAY) • Azure Key Vault logging (AZURE_KEYVAULT_AUDIT) • Microsoft Azure Resource (AZURE_RESOURCE_LOGS) • Blue Coat Proxy (BLUECOAT_WEBPROXY) • BeyondTrust (BOMGAR) • Cato Networks (CATO_NETWORKS) • Check Point (CHECKPOINT_FIREWALL) • Check Point Harmony (CHECKPOINT_HARMONY) • Chrome Management (CHROME_MANAGEMENT) • ChromeOS XDR (CHROMEOS_XDR) • Cisco ASA (CISCO_ASA_FIREWALL) • Cisco Email Security (CISCO_EMAIL_SECURITY) • Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL) • Cisco FireSIGHT Management Center (CISCO_FIRESIGHT) • Cisco ISE (CISCO_ISE) • Cisco Router (CISCO_ROUTER) • Cisco Switch (CISCO_SWITCH) • Cisco UCM (CISCO_UCM) • Claroty Xdome (CLAROTY_XDOME) • Claude Compliance Logs (CLAUDE_COMPLIANCE_LOGS) • HP Aruba (ClearPass) (CLEARPASS) • Cloudflare (CLOUDFLARE) • Palo Alto Cortex XDR Alerts (CORTEX_XDR) • CrowdStrike Falcon (CS_EDR) • Darktrace (DARKTRACE) • EfficientIP DDI (EFFICIENTIP_DDI) • F5 ASM (F5_ASM) • F5 BIGIP LTM (F5_BIGIP_LTM) • Fastly CDN (FASTLY_CDN) • FireEye eMPS (FIREEYE_EMPS) • FireEye HX (FIREEYE_HX) • FireEye NX (FIREEYE_NX) • Forcepoint Proxy (FORCEPOINT_WEBPROXY) • FortiGate (FORTINET_FIREWALL) • Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER) • Fortinet FortiClient (FORTINET_FORTICLIENT) • Fortinet Switch (FORTINET_SWITCH) • GCP Cloud Audit (GCP_CLOUDAUDIT) • Security Command Center External Exposure (GCP_SECURITYCENTER_EXTERNAL_EXPOSURE) • Gitlab (GITLAB) • Google Threat Intelligence IOC (GTI_IOC) • AWS GuardDuty (GUARDDUTY) • Huawei Switches (HUAWEI_SWITCH) • IBM Security Access Manager (IBM_SAM) • Microsoft IIS (IIS) • Illumio Core (ILLUMIO_CORE) • Imperva SecureSphere Management (IMPERVA_SECURESPHERE) • Infoblox (INFOBLOX) • Infoblox DHCP (INFOBLOX_DHCP) • Jamf pro context (JAMF_PRO_CONTEXT) • Mobile Endpoint Security (LOOKOUT_MOBILE_ENDPOINT_SECURITY) • Apple macOS (MACOS) • McAfee IPS (MCAFEE_IPS) • Micro Focus iManager (MICROFOCUS_IMANAGER) • Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT) • Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL) • Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT) • Microsoft Sentinel (MICROSOFT_SENTINEL) • Microsoft SQL Server (MICROSOFT_SQL) • Mimecast URL Logs (MIMECAST_URL_LOGS) • MISP Threat Intelligence (MISP_IOC) • NetApp ONTAP (NETAPP_ONTAP) • Netskope V2 (NETSKOPE_ALERT_V2) • Unix system (NIX_SYSTEM) • Office 365 (OFFICE_365) • Okta (OKTA) • Onapsis (ONAPSIS) • OpenVPN (OPEN_VPN) • Oracle Fusion (ORACLE_FUSION) • Ping Identity (PING) • Proofpoint Sendmail Sentrion (PROOFPOINT_SENDMAIL_SENTRION) • SailPoint IAM (SAILPOINT_IAM) • Salesforce (SALESFORCE) • Sendmail (SENDMAIL) • Sentinelone Alerts (SENTINELONE_ALERT) • ServiceNow Audit (SERVICENOW_AUDIT) • ServiceNow CMDB (SERVICENOW_CMDB) • ServiceNow Security (SERVICENOW_SECURITY) • SonicWall (SONIC_FIREWALL) • STIX Threat Intelligence (STIX) • Tanium Threat Response (TANIUM_THREAT_RESPONSE) • Thinkst Canary (THINKST_CANARY) • ThreatConnect IOC V3 (THREATCONNECT_IOC_V3) • ThreatLocker Platform (THREATLOCKER) • Varonis (VARONIS) • VMware ESXi (VMWARE_ESX) • Windows DNS (WINDOWS_DNS) • Windows Event (WINEVTLOG) • Windows Event (XML) (WINEVTLOG_XML) • wiz.io (WIZ_IO) • Workspace Activities (WORKSPACE_ACTIVITY) • Zoom Operation Logs (ZOOM_OPERATION_LOGS)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

• Adobe Experience Platform (ADOBE_EXPERIENCE_PLATFORM) • AudioCodes Session Border Controller (AUDIOCODES_SBC) • Azure Application Gateway for Containers (AZURE_GATEWAY_CONTAINERS) • Azure Logic Apps (AZURE_LOGIC_APPS) • Azure NAT Gateway Flow (AZURE_NATGW_FLOW) • Broadcom DX NetOps Spectrum (BROADCOM_DX_NETOPS_SPECTRUM) • Carto Activity (CARTO_ACTIVITY) • Claude Code Observability (CLAUDE_CODE_OBSERVABILITY) • Cyble Attack Surface Management (CYBLE_ASM) • Cyble Brand Intelligence & Protection (CYBLE_BIP) • Darkweb IQ (DARKWEB_IQ) • Ellio Threat Intelligence (ELLIO_THREAT_INTEL) • Exeon NDR (EXEON_NDR) • Gravitee (GRAVITEE) • Kaspersky anti targeted attack (KASPERSKY_ANTI_TARGETED_ATTACK) • Microsoft Copilot Interaction (MICROSOFT_COPILOT_INTERACTION) • OSTTRA MarkitWire (OSTTRA_MARKITWIRE) • Proofpoint Adaptive Email Security (PROOFPOINT_ADAPTIVE_EMAIL_SECURITY) • Secomea GateManager (SECOMEA_GATEMANAGER) • Trend Micro Vision One Risk Event (TRENDMICRO_VISION_ONE_RISK_EVENT) • TXOne EdgeIPS (TXONE_EDGEIPS) • Vectra Respond UX (VECTRA_RUX) • Zoho CRM (ZOHO_CRM)