Parsing rule and data model Rule

[Praveen0108]

Hi Everyone,

We are currently ingesting syslog data from our Aruba switches into Cortex XSIAM/XDR using the HPE Switch content pack, but the logs are not automatically normalizing into XDM fields.

In our environment, when we query other datasets like Office 365, Zscaler, or AWS, the logs are automatically parsed and normalized into xdm.* fields upon querying. We are expecting the same behavior for hpe_switch_raw, but it is currently showing only raw unparsed logs.

Here are the details of our setup:

• Ingestion Path: Aruba Switch Syslog → Broker VM (UDP 514) → XSIAM

• Syslog Target Settings: vendor = HPE, product = Switch, Format: auto-detect

• Default Ingestion Rule Generated: [INGEST:vendor="HPE", product="Switch", target_dataset="hpe_switch_raw", no_hit=drop]

• Issue: The dataset hpe_switch_raw is successfully created and logs are being ingested. However, when querying the dataset, only basic metadata fields appear (_time, _vendor, _product, _raw_log, _broker_ip_address, etc.). The data normalization into xdm.* fields is not happening automatically like it does for our other log sources.

Sample Raw Logs:

Plaintext

<46>Jul 27 15:52:26 172.17.15.8 00435 ports: ST1-CMDR: port 1/44 is Blocked by STP
<46>Jul 27 15:52:32 172.17.156.8 00076 ports: ST1-CMDR: port 1/44 is now on-line

What We Observed:

1. The HPE Switch Content Pack includes a Data Modeling Rule (DMR) with regextract logic.

2. When testing the regextract logic directly in an XQL query, the fields extract correctly.

3. However, out of the box, when we simply query dataset = hpe_switch_raw, the logs remain unparsed in the _raw_log field without default XDM normalization.

Questions:

1. Is the default Data Modeling Rule (DMR) sufficient to get parsed/normalized fields automatically when querying the dataset, or do we need to write a custom Ingestion Parsing Rule (PR) for HPE/Aruba switches?

2. Could the leading Syslog Priority Tag (<46>) in the raw log be breaking the Content Pack DMR regex matching?

3. What is the best practice to get this dataset fully parsed and normalized out of the box like AWS, Zscaler, and Office 365?

Thanks in advance for your guidance!