Skip to main content

Learn Parser Studio with real security logs

Watch five independent guided tutorials covering successful extraction, incomplete extraction, ChatGPT-assisted recovery and multiple log families from the same security product. The refreshed videos use the October 31, 2026 deployed Web UI, English narration, and bottom-of-screen captions.

Complete Parsing: Real Juniper SRX Logs

Watch a complete source-to-parser workflow using published Juniper SRX RT_FLOW events.

Partial Parsing: Complex Sophos XG Firewall Logs

Identify real unparsed regions without discarding already extracted Sophos Firewall fields.

Unrecognized Snort Alert: ChatGPT-Assisted Recovery

Use a reviewed bounded parser recipe with independent documented alert examples.

Multiple Event Types: Real FortiGate Traffic and Threat Logs

Create and test a single parser project using official FortiGate Traffic, Web Filter and IPS records.

RFC3164 Relay: Forwarded Security Logs

Practice with synthetic pre-relay and forwarded messages, declare relay01 and verify both events.

Follow along with the same samples

Copy without a file download: Every tutorial below also includes the exact original log text in copyable blocks immediately beneath its video, plus separate holdout alerts for the Snort case.
  1. Download the original practice logs, holdout examples and source credits.
  2. Keep your chosen training video open and launch Parser Studio in another browser tab.
  3. Open the relevant sample log file, copy its original event lines, and follow the click-by-click practice instructions directly below each embedded video.
  4. Pause or seek using the chapter timestamps shown on that video’s documentation page. Compare the actual parser results to the recorded expected behavior.
The Sophos partial-parsing exercise is intentionally unresolved: the point is to locate unsupported text while preserving recognized fields, not to force a false success state. The included Snort JSON proposal is optional and still requires review, independent tests and explicit approval.

Download or watch the whole collection

Use the individual pages above for videos and provenance details. You can also open all five dedicated video players.

What these examples demonstrate

  • RFC3164 relay: two synthetic security events wrapped with variable relay headers are recognized only after explicitly declaring relay01; original source bytes stay available for review.
  • Juniper SRX: complete extraction, field mapping and parser-file creation from published RT_FLOW examples.
  • Sophos XG: dozens of source values recognized in a complex log while unresolved text still requires an additional reviewed parsing rule.
  • Snort 3: a real alert_fast line that needs a tested, explicitly approved ChatGPT-assisted recipe.
  • FortiGate: combined Traffic, Web Filter and IPS samples; the documented traffic and web-filter examples share a session ID.
Successful source extraction in these samples does not prove native parser compatibility for every firmware or a verified live Stellar Cyber target installation. Never claim unsupported source regions were parsed or silently discard events.
Quickstart · Scenario playbooks · Create a parser now
Last modified on October 31, 2026