Request for Raw Event Samples

[JocLRojas]

Hi everyone,

We are currently working on refining and strengthening the data processing and correlation capabilities within UTMStack. To ensure that event parsing is as accurate as possible across real-world scenarios, we are looking for the community's support in collecting log samples.

We are requesting raw event logs from the following integrations:

• Network & Firewall: Sophos XG, Mikrotik, Palo Alto.
• Endpoint & EDR: Sophos Central, ESET, SentinelOne, Deceptive Bytes.

Formats and Organization:

To streamline the integration process, we prefer logs in their original format as delivered by each tool (JSON, Syslog, or CSV). If possible, please organize the information by clearly indicating the source (e.g., a file named sentinelone_events.json or a folder named mikrotik_syslogs/).

Critical Note on Privacy and Security:

Our priority is to ensure your infrastructure remains secure. Please, before sharing any logs, make sure to anonymize or sanitize sensitive data, such as:

• Real public IP addresses.
• Specific usernames or email addresses.
• Hostnames, internal domains, or license identifiers.

How can you contribute in an organized way?

1. Attachments: You can drag and drop files directly into this discussion thread (feel free to compress them into a .zip or .tar.gz file to maintain the folder structure per tool).

2. Public Repositories: You can host the logs in a public repository of your own and share the link here.

3. GitHub Gists: If you prefer sharing specific snippets, you can upload them as a GitHub Gist and paste the link here, indicating which technology each one corresponds to.

Any volume of events is a huge help in improving threat visibility and detection for all UTMStack users.

We greatly appreciate your time and contribution.

Best regards,

UTMStack Development Team