1
00:00:01,333 --> 00:00:05,893
Learn to parse security events after a Syslog relay adds its own outer header.

2
00:00:06,535 --> 00:00:13,087
For this synthetic lab, enter Training as the manufacturer and Relay K V demo as the
product.

3
00:00:13,756 --> 00:00:19,036
Paste the two complete post-relay records. Both start with the Syslog priority
marker.

4
00:00:19,685 --> 00:00:24,845
Open Optional declare Syslog forwarder hostnames and enter relay zero one.

5
00:00:25,482 --> 00:00:31,194
Check that both relay headers are recognized, with zero unsafe or unmatched records.

6
00:00:31,851 --> 00:00:36,939
Apply declared relay profile. This keeps the original source text intact.

7
00:00:37,595 --> 00:00:43,499
Click Analyze Logs. The demonstrated source returns two of two events completely
parsed.

8
00:00:44,154 --> 00:00:49,674
Confirm source and destination I P, action, protocol and session I D.

9
00:00:50,335 --> 00:00:56,839
Continue to Review Fields and verify the original event payload has not been confused
with the relay host.

10
00:00:57,492 --> 00:01:02,628
Continue to Map Fields and check the Stellar Cyber seven point zero recommendations.

11
00:01:03,281 --> 00:01:08,417
Continue to Create Parser and run the final test only when the results are
acceptable.

12
00:01:09,081 --> 00:01:15,273
Run Final Test and Create Files. A downloaded parser is not a live data processor
test.

13
00:01:15,930 --> 00:01:21,978
Use the separate holdout relay log to verify the rule does not only match the
original example.