Partial Parsing: Complex Sophos XG Firewall Logs
English narration and permanently visible English captions accompany this recording of the October 31, 2026 Parser Studio Web UI. The examples come from published original manufacturer documentation or upstream-authored test fixtures, not from fabricated demo messages. Watch in a dedicated video player · Download MP4 · English SRT captions · Read the English transcriptPractice along with the video
Keep this page open to pause or replay the demonstration while working in a second tab. Before you begin: Download all practice samples as a ZIP · Open Parser Studio Use the source files above exactly as shown in the video. Each file contains the public documented sample events used during the recording, with source attribution and SHA-256 checksums in the ZIP bundle.Copy the exact logs used in the video
Use the copy icon on each code block, then paste the entire content into Parser Studio. Each line is one unmodified event from the published source. Do not omit difficult events or replace values to force a passing result.Copy both complex Sophos XG Firewall events into Add Logs
Exact source: 1821 bytes · File:02-sophos-xg.log · Keep both lines when the file has two events.
Follow the current on-screen steps
- In Auto Parser, set manufacturer to Sophos and product to XG Firewall.
- Paste both original Sophos sample records without trimming quoted or empty values; click Analyze Logs.
- Verify 0 of 2 log events parsed completely for this deliberately difficult public fixture. This is partial extraction, not zero extracted fields.
- In the normal analysis result, inspect Problem to review, Values already found and Text not yet assigned to fields. The old Tools & Diagnostics menu is not part of the current workflow.
- Do not remove unresolved source text to obtain a false success state. Continue only after a new rule passes independent tests.
Video chapter timestamps (October 31 recording)
The listed times come from the actual October 31 recording, not the retired version.
Expected review outcome
The original long Sophos Firewall examples retain dozens of recognized source values, but neither sample is fully parsed. The video demonstrates diagnosis and the additional-rule workflow without claiming an unverified repair succeeded. Do not treat successful source extraction or generated files as evidence of full vendor/firmware coverage, target import acceptance, or live Stellar Cyber deployment compatibility.Recovery path
For a different log shape, keep the original records and examine the highlighted source spans, following the related workflow. Only apply additional parsing rules after different examples pass a separate regression test. Never delete failing events merely to obtain a passing total.Original log provenance
Customer logs may include private information. Review, sanitize and manually approve any excerpt before copying it into an external ChatGPT conversation. The Auto Parser does not automatically share those logs.