Parsing rule and data model Rule

[Praveen0108]

Hi Everyone,

We are currently ingesting syslog data from our Aruba switches into Cortex XSIAM/XDR using the HPE Switch content pack, but the logs are not automatically normalizing into XDM fields.

In our environment, when we query other datasets like Office 365, Zscaler, or AWS, the logs are automatically parsed and normalized into xdm.* fields upon querying. We are expecting the same behavior for hpe_switch_raw, but it is currently showing only raw unparsed logs.

Here are the details of our setup:

• Ingestion Path: Aruba Switch Syslog → Broker VM (UDP 514) → XSIAM

• Syslog Target Settings: vendor = HPE, product = Switch, Format: auto-detect

• Default Ingestion Rule Generated: [INGEST:vendor="HPE", product="Switch", target_dataset="hpe_switch_raw", no_hit=drop]

• Issue: The dataset hpe_switch_raw is successfully created and logs are being ingested. However, when querying the dataset, only basic metadata fields appear (_time, _vendor, _product, _raw_log, _broker_ip_address, etc.). The data normalization into xdm.* fields is not happening automatically like it does for our other log sources.

Sample Raw Logs:

Plaintext

<46>Jul 27 15:52:26 172.17.15.8 00435 ports: ST1-CMDR: port 1/44 is Blocked by STP
<46>Jul 27 15:52:32 172.17.156.8 00076 ports: ST1-CMDR: port 1/44 is now on-line

What We Observed:

1. The HPE Switch Content Pack includes a Data Modeling Rule (DMR) with regextract logic.

2. When testing the regextract logic directly in an XQL query, the fields extract correctly.

3. However, out of the box, when we simply query dataset = hpe_switch_raw, the logs remain unparsed in the _raw_log field without default XDM normalization.

Questions:

1. Is the default Data Modeling Rule (DMR) sufficient to get parsed/normalized fields automatically when querying the dataset, or do we need to write a custom Ingestion Parsing Rule (PR) for HPE/Aruba switches?

2. Could the leading Syslog Priority Tag (<46>) in the raw log be breaking the Content Pack DMR regex matching?

3. What is the best practice to get this dataset fully parsed and normalized out of the box like AWS, Zscaler, and Office 365?

Thanks in advance for your guidance!

[susekar]

Hello @Praveen0108 ,

Greetings for the day.

-The behavior you're seeing is expected when querying the raw dataset. The hpe_switch_raw dataset contains the original logs, while XDM fields are populated through Data Modeling Rules (DMRs) at query time.

To check the normalized fields, try: datamodel dataset = hpe_switch_raw | fields xdm.*



-The <46> Syslog priority tag can also prevent the default modeling rule from matching the log format correctly.

Recommended steps:

• Verify the raw log format, including the <46> tag.
• Check whether the existing Data Modeling Rule matches your log format.
• If the default rule does not match, create or modify a custom modeling rule.
• If you need fields to be populated directly during ingestion, consider using Ingestion Rules.
  
  

Note: This should help determine whether the issue is with the dataset query or the normalization rule itself.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar