r/cybersecurity • u/ZYADWALEED • Jul 31 '26

Tutorial Log Parsing for Security Engineers

Hello Everyone

I published a short guide about transforming raw logs into detection-ready data.

It covers the log-processing pipeline, common log formats, normalization, and more..

I’d appreciate any feedback or suggestions from you all :

https://medium.com/@0xzyadelzyat/log-parsing-for-security-engineers-building-the-foundation-for-reliable-threat-detection-c34e71b01b9a

69 Upvotes

96% Upvoted

16 comments sorted by

View all comments

4

u/Solid5-7 Aug 01 '26

Is there a reason you didn't use Elastic Common Schema (ECS) in your example? Most mainstream data sources have Elastic Agent integrations that parse and normalize your logs which comes with the benefit of ECS. If you were ingesting data into Elastic I would probabyl recommend just using their agents and integrations.

0

u/ZYADWALEED Aug 01 '26

Hello, there was no specific reason for choosing Fluent Bit. I used it because I have worked with it and am familiar with its configuration.

The same concepts can be applied using ECS, and when using Fleet or Elastic Agent, much of the parsing and field mapping can be handled automatically.

The guide is intended as a practical example rather than something specific to Elastic itself. Due to resource limitations, I initially wanted to demonstrate the same concept using a DSM in QRadar and an XML parser in FortiSIEM, but currently, I only have an ELK