Import Windows events stored as syslog in PCAPs

m4rkus · February 11, 2020, 11:26am

Hi,

I have PCAP files (hundreds of GB:s) with recorded syslog traffic (UDP/514) containing log events from Windows hosts. I would like to import and parse the data in Graylog. I would also like to preserve the PCAP timestamps and store those as an additional field for each log message, if possible. Which option(s) would you suggest?

Thanks!

system · February 25, 2020, 11:26am

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.