Low-Code Event Log Parser Creation for New Device Formats
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data analytics platforms struggle to analyze event logs from new or modified devices due to the lack of technical knowledge and manual effort required to create or modify event log parsers, leading to inefficiencies and exposure to cyberattacks.
Innovation Solution
An event log analytics system that uses low-code techniques to generate parsers by identifying key-value pairs and allowing users to map event log keys to predefined fields, converting event logs into a standardized format for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If manual parser creation is used, then parser accuracy can be controlled, but system complexity and time consumption increase significantly
Solution Approach 1:
The system enables automatic parser generation where the event log data itself serves as the foundation for creating the parser. The processing device automatically extracts key-value pairs, identifies predefined fields, and generates parser code without requiring manual intervention, thus the system serves itself by transforming raw event logs into functional parsers autonomously
Solution Approach 2:
The system transforms event log parameters (keys and values) into parser configuration parameters. By automatically mapping event log key-value pairs to predefined fields and generating corresponding parser code, the system changes the representation of event log data into a standardized parser format that can be directly executed for event log analysis
2Ease of manufacture
If manual parser creation is used, then parser accuracy can be controlled, but time consumption increases
Solution Approach 1:
The system performs preliminary extraction and identification actions automatically. It pre-extracts key-value pairs from event logs, pre-identifies predefined fields, and pre-generates parser code before the actual event log analysis begins. This preliminary automation eliminates the time-consuming manual creation process while maintaining parser accuracy
Solution Approach 2:
The system replaces the mechanical manual process of parser creation with an automated computational process. Instead of manually writing and configuring parsers, the system uses algorithmic extraction, identification, and code generation mechanisms to automatically create parsers, significantly reducing time consumption while maintaining accuracy through structured processing
3Adaptability or versatility
If event log parsers are not created for new devices, then system simplicity is maintained, but ability to analyze new event logs is lost
Solution Approach 1:
The system dynamically adapts to new event log formats by automatically extracting key-value pairs and mapping them to predefined fields. The parser generation process is dynamic, creating customized parsers on-the-fly for new devices and event log types without requiring pre-configured templates, thus enhancing adaptability while managing complexity through automated processing
4Loss of time
If automated parser generation is used, then time consumption is reduced, but control over parser accuracy is reduced
Solution Approach 1:
The system incorporates feedback mechanisms where the automatically generated parser code is validated against the extracted event log data. The processing device uses the identified predefined fields and mapped key-value pairs to verify parser accuracy, ensuring that the automated generation process produces accurate parsers by feedback-checking the mapping between event log keys and predefined fields
Data Source
AI summary
A system may include one or more operations, which may include obtaining a first structured event log. The first structured event log may include one or more event log key-value pairs. The operations may further include identifying, among one or more predefined fields, a predefined field for an event log key of a first event log key-value pair of the one or more event log key-value pairs. The operations may include generating a portion of parser code to map the event log key of the first event log key-value pair to the identified predefined field. The operations may further include generating an event log parser that includes the portion of the parser code. The operations may further include causing the event log parser to be executed on a second structured event.