Paste a log. Get the parser.
Parsleaf reads your sample logs, writes the parser your SIEM needs, and keeps fixing it from your SIEM's own error messages until it passes. A day of parser work, done in minutes.
You paste this
<189>date=2026-10-10 time=08:04:06 devname="FGT-HQ-01" type="traffic" subtype="forward" srcip=10.0.0.14 srcport=57636 dstip=10.0.0.15 dstport=443 proto=6 action="deny" policyid=4 sentbyte=99824 rcvdbyte=562436
Your SIEM gets this
A FortiGate traffic line, mapped to UDM by a parser Parsleaf wrote and validated in Google SecOps. Values shown are synthetic.
Built from real tenant errors
Every mistake a SIEM has thrown at us became a rule the generator cannot break again: repeated fields, integer types, enum values, drop traps, timestamp zones. The first draft is usually the last.
Your logs stay yours
IPs, usernames, hosts, emails and IDs are replaced with look-alike values before any AI model sees a line. Parsleaf stores nothing beyond the session you are in. Details.
Extensions too
When the vendor parser almost works, ask for an extension in plain words: “map the leading IP to observer.ip”. You get a parser extension that leaves the rest untouched.
How a parser gets made
- 1. PasteTwenty-odd lines, mixed event types. Masked on the spot.
- 2. GenerateFields are inventoried, mapped to the schema, and the parser is written and linted. Two to four minutes.
- 3. TestCopy the parser and the test lines into your SIEM's parser validator.
- 4. FixGot an error? Paste it. The root cause is fixed everywhere it occurs, and you test again. Five rounds included.
$30 per parser. $20 per extension.
Fix rounds included. No subscription. Packs for teams.