Skip to main content

Video 05 — Syslog relay-forwarded security logs

This refreshed tutorial was recorded from the actual October 31, 2026 Parser Studio Web UI. It shows the declared relay hostname controls, the two-event analysis result, field review, target mapping and the creation-stage decision. Watch in the standalone player · Download MP4 · English SRT captions · English narration transcript

Practice along with the video

This synthetic training case is not an official vendor log and not a recording of a live Syslog stream. It reproduces a valid RFC3164 relay wrapper around two sample security-event bodies, with separate holdout test data.

Copy the exact recorded relay sample

Follow the on-screen steps

  1. Open Parser Studio, choose Auto Parser, enter Manufacturer: Training and Product: Relay KV demo, then paste both complete wrapped log lines.
  2. Expand Optional: declare Syslog forwarder hostnames, type relay01, and set Maximum declared hops to 1. Verify the preview shows 2 of 2 events recognized, 0 unsafe, 0 not matching a declared relay.
  3. Click Apply declared relay profile, then Analyze Logs. The October 31 public UI returned 2 of 2 log events parsed completely for this exact fixture.
  4. Inspect Review Fields for srcip, dstip, action, proto, and sessionid. Continue through Map Fields and review proposed Stellar Cyber 7.0 names and types.
  5. Proceed to Create Parser and run Run Final Test & Create Files only when enabled and source coverage is complete. Download the generated draft if its final test passes.
  6. Re-run a separate validation with 05-relay-holdout.log. No live relay transport or target import is demonstrated.

Video chapters from the current recording

Expected review outcome

The demonstrated browser run confirms two declared relay envelopes and two fully extracted events, with no discarded source record. A parser package is a local artifact; successful production receive and native runtime compatibility remain not verified.

Recovery path

If the preview recognizes fewer than two relay headers, check the full <134>Oct 31 ... relay01 forwarder: prefixes and the exact declared hostname. Do not try to remove variable Syslog timestamps by the Optional: mark a forwarded prefix or trailing suffix control: that is a literal boundary review, not a generated parser rule. Full click-by-click written scenario · All tutorials
Last modified on October 31, 2026