Google SecOps has updated the list of supported default parsers.

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

• AIX system (AIX_SYSTEM)
• Apache (APACHE)
• AppOmni (APPOMNI)
• Armis Activities (ARMIS_ACTIVITIES)
• Atlassian Cloud Admin Audit (ATLASSIAN_AUDIT)
• Atlassian Bitbucket (ATLASSIAN_BITBUCKET)
• Linux Auditing System (AuditD) (AUDITD)
• AWS Cloudtrail (AWS_CLOUDTRAIL)
• AWS Inspector (AWS_INSPECTOR)
• AWS RDS (AWS_RDS)
• Microsoft Azure Activity (AZURE_ACTIVITY)
• Azure AD Directory Audit (AZURE_AD_AUDIT)
• Azure AD Organizational Context (AZURE_AD_CONTEXT)
• Azure AD Sign-In (AZURE_AD_SIGNIN)
• Azure App Service (AZURE_APP_SERVICE)
• Azure Firewall (AZURE_FIREWALL)
• Azure Application Gateway (AZURE_GATEWAY)
• Azure Key Vault logging (AZURE_KEYVAULT_AUDIT)
• Bitdefender (BITDEFENDER)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• Box (BOX)
• Zeek JSON (BRO_JSON)
• Check Point Sandblast (CHECKPOINT_EDR)
• Chrome Management (CHROME_MANAGEMENT)
• CipherTrust Manager (CIPHERTRUST_MANAGER)
• Cisco ACS (CISCO_ACS)
• Cisco ASA (CISCO_ASA_FIREWALL)
• Cisco Email Security (CISCO_EMAIL_SECURITY)
• Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
• Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
• Cisco IronPort (CISCO_IRONPORT)
• Cisco Meraki (CISCO_MERAKI)
• Cisco Umbrella Audit (CISCO_UMBRELLA_AUDIT)
• Cisco WLC/WCS (CISCO_WIRELESS)
• Citrix Netscaler (CITRIX_NETSCALER)
• Claroty Xdome (CLAROTY_XDOME)
• Claude Compliance Logs (CLAUDE_COMPLIANCE_LOGS)
• Cloudflare Audit (CLOUDFLARE_AUDIT)
• Corelight (CORELIGHT)
• Palo Alto Cortex XDR Alerts (CORTEX_XDR)
• CrowdStrike Alerts API (CS_ALERTS)
• CrowdStrike Falcon (CS_EDR)
• CrowdStrike Falcon Stream (CS_STREAM)
• CyberArk (CYBERARK)
• CyberArk Privileged Access Manager (PAM) (CYBERARK_PAM)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

• Amazon Bedrock Model Invocation Logging (AMAZON_BEDROCK_MODEL_INVOCATION_LOGGING)
• AppTrana Web Application Firewall (AWS_APPTRANA)
• Azure Machine Learning (AZURE_MACHINE_LEARNING)
• Bitstamp (BITSTAMP)
• Cloud 9 (CLOUD9)
• Cloudflare Brand Protection (CLOUDFLARE_BRAND_PROTECTION)
• Cloudflare Browser Isolation (CLOUDFLARE_BROWSER_ISOLATION)
• Delinea Cloud Platform (DELINEA_CLOUD_PLATFORM)
• Honeywell Cyber Proactive Defense (HONEYWELL_CPD)
• Huntress EDR (HUNTRESS_EDR)
• IBM Cloud Alert Notification (IBM_CLOUD_ALERT_NOTIFICATION)
• Meter Firewall NIDS (METER_FIREWALL_NIDS)
• OutSystems Cloud (OUTSYSTEMS_CLOUD)
• Staffbase Audit (STAFFBASE_AUDIT)
• Statsig (STATSIG)
• Temporal Cloud Audit Logs (TEMPORAL_CLOUD_AUDIT_LOGS)
• Twilio Segment (TWILIO_SEGMENT)