Manage custom parsers

Users with the Super Admin or Admin role can manage custom parsers after creation. You can turn them on and off, edit their configuration, verify that they normalize data as expected, or delete them entirely.

Deploy a custom parser

By default, custom parsers are turned off when created. This gives you time to edit and test it using the GUI tools in Sophos XDR before turning it on. Once you are confident that your custom parser is ready to be deployed, do as follows:

1. Go to Security Operations > Integrations > Custom Parsers.
2. Click the Play icon in the Actions column for the parser you want to turn on.
3. Click Enable to confirm.

Deploying a parser is non-destructive. Sophos XDR continues to create generic events while also creating events for the configured destination schema.

Once your parser is turned on, events are created immediately. After data is received by Sophos XDR, verify that events are being normalized by searching for WHERE sensor_type=[your_sensor_type]. If data has been received by Sophos XDR, search results return that are normalized to the correct event types.

When deploying parent and child parsers, the parent must be turned on before any children.

Disable a custom parser

All child parsers of a given parent must be disabled or deleted before the parent can be disabled.

To disable a parser, do as follows:

1. Go to Security Operations > Integrations > Custom Parsers.
2. Click the Pause icon in the Actions column for the parser you want to disable.
3. Click Disable to confirm.

Once disabled, the parser stops producing events immediately. Generic events are still created as normal, but events are no longer sent to the additional schema specified in your disabled parser.

Delete a custom parser

To delete a parser, do as follows:

1. Go to Security Operations > Integrations > Custom Parsers.
2. Click the Trash icon in the Actions column for the parser you want to delete.
3. Click Delete to confirm.