Classifiers

Classifiers are dealing with identification of incoming data to the Logmanager. Messages from all devices, servers and services, which are sending to the Logmanager, must be defined in this section. If the device is not defined, message goes thru the system, but no additional information is added and parsing of the message is not done.

Classifiers List shows all classifications defined in the system.

Table shows all information available: Name (name of the classification), Description (description of the classification), Condition (condition, which must be met by the incoming message) and Tags (more info in the chapter: Tags).

Filter fields are above the table, and data may be filtered by any single column. In case of using filters above more columns, an AND term is applied.

Default classification is shown in the example.

Classification can contain one rule, when there is only one classification for one device. In case of servers, classification can be defined so that one classification includes more rules for all services, which are sending messages to the Logmanager from the server. Classification may be created, where a list of IP addresses is defined for one type of devices, from which the messages are sent to the Logmanager.

Classifier must contain a block to create overall condition. It is automatically in the blockly schema.

Classifier can end with blocks:

• pass to parser: final block for transfer of the message to parser,
• pass to template: final block for transfer of the message to next classification.

If the classifier is not ending with a block pass to parser or pass to template, it means that the message is automatically forwarded to the next classifier in alphabetical order.

A many of Classifier can be created containing different conditions. If the message does not comply with any condition in any classifiers, message goes automatically to the last classifier, which can contain general conditions. By this can be achieved that every message gets into the parser and is processed.

Example:

• Classifier 1:
  • Contains conditions by source IP addresses.
  • E.g. if the message arrived from IP address 190.0.2.1, then forward the message to parser cisco-asa.
  • If the message has not ended in any condition, continues to Classifier 2.
• Classifier 2:
  • Contains conditions by source program name.
  • E.g. if the message arrived from sshd program, forward the message to parser openssh.
  • If the message has not ended in any condition continues to Classifier 3.
• Classifier 3:
  • Contains general conditions.
  • E.g. if the message begins with {” chars, forward the message to the JSON parser.

If you need to add a new classification, click on the green plus icon in the main table in the upper right corner.

Enter following data into the prepared form:

• Name: name of the classification rule,
• Description: description of the classification rule,
• Type: type of the classification:
  • Classifier: creates a classification rule,
  • Template: creates a classification template. More in the Classifier templates chapter,

Rules are created with Events processing in blockly.

Rule which includes a condition “incoming message is from IP address 1.1.1.10” is shown in the example. If the condition is met, message is pass to the “apache” parser and user tag “webserver” is added to all these messages.

Adding of the classification is done by clicking on the Create button, canceling of the completed form and returning back to the main table is done by clicking on the Cancel button.

Editing of the classification can be started by clicking on the blue pencil icon, which is shown by every row.

Form identical with the form for adding of a new classification is now shown. Change of the classification is done by clicking on the save button, canceling of the completed form and return back to the main table is done by clicking on the Cancel button.

When editing, a test message can be entered for the classifiers. The test window requires that the same test message must be inserted in JSON format as is stored in LM system. (same format as for Alerts).

You can get a test message in: Logs ‣ Dashboards ‣ and then open any dashboard and find the message received in Logmanager you want to test. The message must be copied in JSON format, which can be found in the event overview.

Example how to get a test message:

Open Logs ‣ Dashboards ‣ and click on Log overview. At the bottom you will find the All Events table, in which you click on the event of your choice. In its description, you will find a View button in the upper left corner, which switches the display of formats. Switch to JSON format and copy the entire message to the test window.

Please be aware that testing window only shows live result of test message of your specific classifier. Message is propably gonna me modified at Parsers and can be also modified at Alerts.

Please be also aware that tags are not stripped from test message in test process. Due to this behaviour final message can have less tags.

Deletion of a classification is done by clicking on the red cross icon, which is shown by every classification.

After clicking on the cross a new dialog window delete a classifier is opened and the name of the classifier to be deleted is shown for checking. To continue and delete the classification, click on the yes button, to cancel, click on the no button.