How it works

Parsleaf does the parser-writing job the way an experienced onboarding engineer does it, with the model doing the reading and writing and code doing the checking.

1. You paste sample logs

Paste raw lines straight from the source, a collector, or your SIEM's raw-log view. Twenty or more lines with several event types (allow and deny, login and logout, success and failure) give the best result, because the parser is only as complete as the shapes it has seen.

Pretty-printed JSON copied from a portal is fine; records are joined back into single lines. Up to 500 lines are used.

2. Parsleaf masks the data

Before any line reaches the AI model, IPs, usernames, hostnames, email addresses, MAC addresses and GUIDs are replaced with look-alike synthetic values. The structure is untouched, so the parser works on your real logs. See how we handle your logs.

3. The parser is written in three passes

1. Inventory. Every field in the sample is listed with its type, location, and example, and the distinct event types are identified.
2. Mapping. Each field is mapped to the SIEM's schema (UDM for Google SecOps) using a curated field reference, so no field names are invented. Fields that fit nowhere are kept as labels.
3. Generation. The parser is written against a guide of syntax rules learned from real SIEM errors, then checked by a linter with the mechanical rules those errors taught us. Anything the linter catches is sent back and regenerated before you see it.

4. You test it in your SIEM

Copy the parser and the test lines (one per distinct log shape, taken from what you pasted) into your SIEM's parser validator.

Google SecOps

1. SIEM Settings → Parsers → find the log type (or a custom one reserved for testing).
2. Three-dot menu → Create new parser (or Create new parser extension).
3. Paste the code. Paste the test lines into the validation pane. Run the validation.
4. Check the UDM output per line and the error panel.

5. If it fails, paste the error

Click No, I got an error, paste the message exactly as the SIEM shows it, and Parsleaf fixes the root cause wherever it occurs in the parser, not only at the reported line. Test again. Five fix rounds are included with every parser; most need zero or one. Every job is saved to your account, so you can come back to a parser and its history later.

If there is no error but a field is wrong or empty, describe what you see in the same box; that works too.

What you get

Which SIEMs

Google SecOps (CBN parsers and extensions, UDM) today. Microsoft Sentinel, Splunk and Elastic are next; each needs its own syntax guide, schema reference and validation loop before we switch it on, because a parser that only mostly works is worse than none.