Vendor auto-decoding for syslog sources
An unconfigured syslog source no longer produces a bare generic shape: 13 vendor and host-log decoders now auto-detect and extract real fields, and 10 of them can also be selected explicitly.
This is a parsing-behaviour change under an existing option, not a new screen. If you are looking for where a log source's parser is chosen at all, see Collecting syslog from firewalls and appliances — the Registering a sender in the console section covers the wizard step where a device's parser is set, and everything below assumes you already have a source registered there.
The 13 decoders
Each one recognises and extracts fields from one vendor or host-log format. A line that matches none of them still falls back to the old generic RFC 3164/5424 envelope parse — nothing is worse off than before, and every line is still stored and searchable either way.
| Decoder | Format it recognises |
|---|---|
| Cisco ASA / FTD | The %ASA-n-nnnnnn: message-code syslog format. |
| Fortinet FortiGate | FortiOS key=value syslog — traffic, event/VPN and UTM logs share one shape. |
| Palo Alto Networks PAN-OS | The comma-separated PAN-OS syslog format. |
| pfSense / OPNsense | The filterlog: CSV format both projects share (pf(4)-derived). |
| Windows Security channel | Windows Security events, either the endpoint sensor's JSON record or rendered-EVTX XML forwarded by a third-party collector. |
| Linux auditd | Kernel audit records (type=... msg=audit(...)). |
| OpenSSH sshd | Accepted/Failed password or publickey lines, and preauth-disconnects — the messages a brute-force scan usually leaves behind. |
| sudo | A successful invocation, a denied one, and the PAM authentication-failure line after repeated wrong passwords. |
| Apache / nginx access log | The "combined" access-log format both servers default to. |
| Zeek | JSON conn.log, dns.log and http.log records. |
| Suricata EVE JSON | alert, flow, dns, http and tls EVE event types. |
| Microsoft Entra ID sign-in | The Graph signIns resource shape, however it reaches the receiver. |
| Microsoft 365 unified audit | Office 365 Management Activity API records. |
The mechanism, briefly: a generic pre-decoder strips the ordinary RFC 3164 syslog envelope (priority, timestamp, hostname, program name) if the line has one, leaving the vendor-specific body for a decoder to examine. A line that is not syslog-wrapped at all — a bare JSON line from Suricata or Zeek, say — is handed to the decoders unchanged. Auto-detection then tries every registered decoder in turn; the first one whose Matches check passes does the extraction, and its output is normalised through the same generic event mapper every other source without a bespoke mapper already goes through, so a decoded line is queryable and detectable immediately.
Selecting a decoder explicitly instead of auto-detecting
Ten of the thirteen decoders above are also registered as their own named parser, selectable directly rather than relying on auto-detect: fortigate, pfsense, windows_security, sshd, sudo, web_access, zeek, suricata_eve, entra_signin and m365_unified_audit. Naming one directly skips the auto-detect probe entirely — useful once you know exactly what a source sends and want to remove any (small) chance of a cross-match against a similar format.
What to read next
- Collecting syslog from firewalls and appliances — registering a sender, the per-device parser table, and where the parser selector lives in the console.
- How your logs are normalised — the common event schema every decoder's output lands in.
- What a firewall log actually becomes — field by field, for the appliance parsers this article's caution callout distinguishes from the new decoders.