sdl-log-parser

Name: sdl-log-parser
Availability: InStock
Author: SentinelOne

Create and validate SentinelOne Singularity Data Lake log parsers from raw log samples.

59|30|Updated Aug 19, 2025

Search Tags:#SDL #log parsing #SentinelOne #OCSF #parser authoring

Ready to run

npx skills add https://github.com/Sentinel-One/ai-siem --skill sdl-log-parser

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sdl-log-parser
Source: https://github.com/Sentinel-One/ai-siem/tree/main/plugins/s1-secops-skills/skills/sdl-log-parser
Command: npx skills add https://github.com/Sentinel-One/ai-siem --skill sdl-log-parser

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill allows users to create, edit, debug, and validate SentinelOne Singularity Data Lake (SDL) log parsers. It automates the process of converting raw log samples into structured SDL parser definitions, which is essential for effective log analysis and event ingestion.

Core Features & Use Cases

Log Parser Authoring: Converts raw log samples into structured SDL parser definitions.
End-to-End Validation: Validates parsers by ingesting a sample through the deployed parser to confirm actual ingest path functionality.
Use Case: A user has a raw log file from a new vendor and wants to create a parser to extract relevant fields and format them as OCSF events for ingestion into the SDL. This skill can be used to write and validate the parser without manual testing.

Quick Start

Author a parser for the raw log file 'new-vendor.log' and validate it using the sdl-log-parser skill.

Frequently Asked Questions about sdl-log-parser

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create a SentinelOne Singularity Data Lake log parser from raw logs?▼

You can create an SDL log parser by converting raw log samples into structured parser definitions using augmented JSON, gron, mappings, and line groupers to extract fields and format them as OCSF events for ingestion.

What is the process for validating a Singularity Data Lake parser before deployment?▼

Validating an SDL parser involves ingesting a sample log through the deployed parser to confirm actual ingest path functionality and ensure the OCSF event extraction works correctly without manual testing.

Can I use OCSF formatting for ingesting custom vendor logs into the SDL?▼

Yes, you can format custom vendor logs as OCSF events by authoring a parser that extracts relevant fields from raw files and structures them for ingestion into the SentinelOne Singularity Data Lake.

Do I need to know the SDL schema to author log parsers?▼

Yes, you need knowledge of the SDL schema and parsing directives to effectively author and debug SentinelOne Singularity Data Lake log parsers, as this Skill is intended for security analysts and DevOps engineers.

What parsing techniques work with SentinelOne SDL log parser authoring?▼

SentinelOne SDL log parser authoring works with augmented JSON and various parsing techniques including gron, mappings, and line groupers to automate the conversion of raw log samples into structured definitions.

Why are my SDL log parsers not ingesting events correctly?▼

SDL log parsers may fail to ingest events correctly if the parsing directives are improperly configured or the raw logs do not match the expected schema, requiring end-to-end validation to debug the ingest path.