TrendMicro InterScan Web Security Suite Parsing Rule

Parsing Rule

Trend Micro InterScan Web Security

Details

IDTrend_Micro_InterScan_Web_Security_Suite_ParsingRule
From Version8.4.0

Rules (XQL)

[INGEST:vendor="trendmicro", product="iwss", target_dataset="trendmicro_iwss_raw", no_hit=keep]
filter _raw_log contains "tk_date_field"
| alter tmp_datetime_field = arrayindex(regextract(_raw_log, "tk_date_field=([^,]+)"), 0)
| alter _time = parse_timestamp("%F %X%z", tmp_datetime_field)
| fields - tmp_datetime_field;