1
00:00:01,095 --> 00:00:06,207
This exercise uses two complex published Sophos X G firewall events.

2
00:00:06,854 --> 00:00:10,958
Enter Sophos and X G Firewall to identify the example.

3
00:00:11,636 --> 00:00:16,916
Paste the complete unchanged sample pair, including quoted and empty values.

4
00:00:17,539 --> 00:00:21,331
Analyze the source without manually removing difficult fields.

5
00:00:21,984 --> 00:00:26,544
These source records may have recognized values and still require review.

6
00:00:27,198 --> 00:00:32,502
Read Problem to review and Text not yet assigned to fields in the normal analysis
result.

7
00:00:33,151 --> 00:00:38,911
Keep fields that were already found. Do not force a passing total by deleting source
data.

8
00:00:39,575 --> 00:00:44,615
A partial result is an honest checkpoint, not a successful native parser package.