Can Sentinel’s KQL query extract JSON from syslog data from CSW / Tetration on Centos?
Below is an example syslog message coming into Sentinel from Cisco Secure Workload (formerly Tetration): Alert[11]: [WARNING] {"keyId":"SEN::u0mvypu37b9fwimpr4zn168c2ht159n6xdhwtaanm-upgrade_srv_check_in","eventTime":"1684974923000","alertTime":"1684974949559","alertText":"Agent Inactive: centos7","severity":"MEDIUM","tenantId":"000457","type":"SENSOR","alertDetails":"{"details":{"AgentType":"ENFORCER","Bios":"57D84D56-0000-0000-7E3C-9DD10F02AFD5","CurrentVersion":"3.7.1.40-enforcer","DesiredVersion":"","HostName":"centos7","IP":"1.1.1.1 (Gateway IP)","LastConfigFetchAt":"2023-05-03 15:47:53 +0000 UTC","Platform":"CentOS-7.9"},"agent_uuid":"u0mvypu37b9fwimpr4zn168c2ht159n6xdhwtaanm","scope_name":"MYLAB","scope_id":"f5qeybblv5oktpnte4ccrf5pw","vrf_id":700457}","rootScopeId":"f5qeybblv5oktpnte4ccrf5pw"} Need assistance in parsing this as there is currently no existing parsers for this product.…