Complete Parsing: Real Juniper SRX Logs
English narration and permanently visible English captions accompany this recording of the October 31, 2026 Parser Studio Web UI. The examples come from published original manufacturer documentation or upstream-authored test fixtures, not from fabricated demo messages. Recording vs. corrected build: The October 31 video predates the RFC5424 SD extraction fix (Parser Studio PR #198). The old on-screen parsed completely label referred to source structure, not to verified individual security fields. The updated steps below apply after that PR is merged and deployed. The historical video itself has not been re-recorded. Watch in a dedicated video player · Download MP4 · English SRT captions · Read the English transcriptPractice along with the video
Keep this page open to pause or replay the demonstration while working in a second tab. Before you begin: Download all practice samples as a ZIP · Open Parser Studio Use the source files above exactly as shown in the video. Each file contains the public documented sample events used during the recording, with source attribution and SHA-256 checksums in the ZIP bundle.Copy the exact logs used in the video
Use the copy icon on each code block, then paste the entire content into Parser Studio. Each line is one unmodified event from the published source. Do not omit difficult events or replace values to force a passing result.Copy the two original Juniper SRX RT_FLOW events into Add Logs
Exact source: 1510 bytes · File:01-juniper-srx.log · Keep both lines when the file has two events.
Follow the current on-screen steps
- Open Auto Parser and enter Manufacturer: Juniper, Product: SRX. The firmware version of these examples is not asserted.
- Paste both unchanged source records into Add Logs and click Analyze Logs. On the corrected build, verify 2 of 2 log events structurally parsed. This confirms source structure, not completed field mapping or native execution.
- Enter Review Fields, compare independently extracted source/destination IP addresses, ports, zones, policy names and session IDs with the source, then open Map Fields. For the DENY event, check source IP
10.0.0.26, destination IP67.43.156.13, ports37233and161, and policyMgmtAccess-trust-cleanup. TheRT_FLOW_SESSION_DENYmessage ID does not prove that a normalizedactionfield was generated. - Review Stellar Cyber 7.0 mapping suggestions and vendor-only values. RFC5424 SD parameters are selectable under
syslog_sd.element_1.params.*in the corrected build; mappings still require review. Continue to Create Parser. - Click Run Final Test & Create Files. Only after it succeeds, choose Download Parser Package. No live target installation is implied.
Video chapter timestamps (October 31 recording)
The listed times come from the actual October 31 recording, not the retired version.
Expected review outcome
On the corrected code, both source records are structurally recognized: the CREATE event provides 30 independent SD-PARAM values and the DENY event provides 23. This is structural extraction, not automatic Stellar semantic certification. Verify IPs, ports, zones and policy against the original records, and verify actual generated-parser output. A passing sample test produces a DRAFT pair, not a certified Stellar DP deployment. Do not treat successful source extraction or generated files as evidence of full vendor/firmware coverage, target import acceptance, or live Stellar Cyber deployment compatibility.Recovery path
For a different log shape, keep the original records and examine the highlighted source spans, following the related workflow. Only apply additional parsing rules after different examples pass a separate regression test. Never delete failing events merely to obtain a passing total.Original log provenance
Customer logs may include private information. Review, sanitize and manually approve any excerpt before copying it into an external ChatGPT conversation. The Auto Parser does not automatically share those logs.