Showing results for 
Search instead for 
Did you mean: 

While upgrading the SIEM, do the parsers need to be rewritten.

In one of our projects, the client has asked to create parsers and alarms for the SIEM 9.4, followed by doing the same again for the 9.5 version.

My question here is, if they have planned to upgrade the SIEM itself, is it required to have parsers for 9.4 and 9.5 separately? Because what I think finally they are going to use the upgraded one.

And if yes, is there any scope to export the parsers from 9.4 to 9.5?

Any challenges while deploying parsers and alarms on 9.5 compared to 9.4?