Created on 09-24-2018 07:24 AM - edited 09-16-2022 06:44 AM
Hi All,
I am pretty novice with Metron and just starting with this. However I am very well versed with ELK stack and have played a lot with ELK based SIEMs. Though I have few queries regarding Metron?
TIA
Blason R
Created 09-25-2018 02:56 AM
Hi team,
Any clue on parsers? Can someone please update?
Created 09-25-2018 01:18 PM
Yes....some parsers(Palo Alto,sourcefire,Fireeye,etc) are readily available on Metron.
You can view list of readily available parsers from Metron Management UI >> Create Sensor >> Parser Type
CSV parser can use with any comma seperated logs and Grok parser can use with any log by writing custom grok patterns.
Also you can create java custom parser for better performance and customization (deploy custom parser jar file to "METRN_HOME/parser_contrib" and restart metron rest,then you can able to view that custom parser in the list on metron management ui)
Refer this link for more about this
https://github.com/apache/metron/tree/master/metron-platform/metron-parsers
Created 09-25-2018 01:57 PM
Awesome!! Thanks for the reply.
BTW is there any sizing guide available for Metron?