Universal Normalizer
StandardUniversal Normalizer enables you to normalize structured logs, extract their fields and rename those fields to comply with Logpoint taxonomy and add labels. It provides a generic interface to create, install and update a custom compiled normalizer for JSON, CEF, LEEF, CSV, XML and Key-Value pair log types.
Enhancements
Universal Normalizer has been updated with an improved layout for a better user experience. All features work as before, and your existing configurations are retained on upgrade.
The updated layout is available in Guardsix SIEM v7.11.0 and later.
You can now clone a vendor normalisation package. A Clone icon in the Actions column of vendor packages opens the package with its configuration pre-filled, and only the Application Name is editable. The clone is saved as a custom package with a
Custom name prefix, is registered as a separate application, and can then be edited, so you can adapt a vendor package without changing the original.
This feature is only supported for Guardsix SIEM v7.11.0 or later.
Error and validation messages are shorter and easier to understand. Importing a package in which all installations fail now shows a concise message, and validation messages for parseable fields now read
Invalid regex pattern in parseable field and Parseable field is empty.
Bug Fix
PLUG-17950
Post-processing rules could not read fields produced by an earlier rule if the field name contained upper-case letters. As a result, chained rules, such as a Norm rule applied to a field extracted by JSON post-processing, did not extract the expected fields.
Past Releases
Universal Normalizer v5.10.0 ▾
Bug Fixes
PLUG-16677
Universal Normalizer displayed a norm_id even when normalization failed, creating incorrect results.
PLUG-16888
When using a custom JSON compiled normalizer, special characters were incorrectly parsed.
Universal Normalizer v5.9.0 ▾
Enhancement
PLUG-15943
Universal Normalizer v5.9.0 now supports post-processing nested JSON data structures for correct log normalization.
Universal Normalizer v5.8.0 ▾
Bug Fix
PLUG-13122
The regex used as a Log identifier is now fully sanitized, preventing any possibility of Remote Code Execution.
Universal Normalizer v5.7.0 ▾
Enhancement
PLUG-13122
The regex used as a Log identifier is now fully sanitized, preventing any possibility of Remote Code Execution.
Once you update Universal Normalizer to v5.7.0, you need to go to Settings > Configuration > Universal Normalizer and update your normalizers.
Support
If you have any questions or require assistance, create support ticket.
Comments
Article is closed for comments.