Skip to content

Configure Receivers

The Configure module is where incoming audit log data is shaped into structured records. Receivers define how raw log data arriving from collection modules is parsed, normalized, and mapped to environments and categories defined in the Define module. Transformation rules within each receiver extract field values, convert data types, and enrich log data before it is stored in the database.

Understanding receivers:

Receivers are the entry points for audit log data into LT Auditor MP. Each receiver defines:

  • How incoming logs are parsed and processed
  • Which environment and category the logs belong to
  • Transformation rules to extract and normalize data fields
  • Validation rules for incoming log data

A receiver must be configured for each log source before data from that source will be correctly structured and stored in the platform.

Accessing the Configure module:

  1. Log in to the LT Auditor MP web portal
  2. Navigate to Configure in the main navigation menu
  3. The Configure page displays all configured receivers

Creating a receiver:

  1. Navigate to the Configure page
  2. Click Add Receiver
  3. Configure the basic information:
Field Description
Name A descriptive name for the receiver
Description Purpose and scope of this receiver
Environment Select the target environment defined in the Define module
Category Select the target log category within that environment
Active Status Enable or disable the receiver
  1. Navigate to the Rules tab to configure transformation rules — see below
  2. Click Save

Receiver transformation rules:

Transformation rules define how raw log data is converted into structured audit records. Each receiver can contain multiple rules evaluated in priority order.

Creating a transformation rule:

  1. Open the receiver configuration
  2. Navigate to the Rules tab
  3. Click Add Rule
  4. Configure the rule:
Field Description
Rule Name A descriptive identifier for this rule
Condition Optional condition defining when this rule applies
Field Mappings Map incoming log fields to database columns defined in the category
Transformations Apply data transformations to the mapped fields
Priority The execution order of this rule relative to others
  1. Click Save

Supported transformation types:

Type Description
Field Extraction Extract values from log text using patterns
Data Type Conversion Convert strings to numbers, dates, and other types
Conditional Mapping Apply different field mappings based on log content
Calculated Fields Create derived fields from existing data
Lookup / Enrichment Add contextual data from external sources

Testing receivers:

Before deploying a receiver to production, test it against sample logs to confirm the transformation rules are working as expected.

Testing with sample logs:

  1. Open the receiver configuration
  2. Click Test with Sample Logs
  3. The system fetches sample logs from the collector
  4. Review the parsed output and confirm:
    • All fields are extracted correctly
    • Data types are appropriate
    • Transformations produce the expected results
  5. Adjust transformation rules as needed and re-test before activating

Parsing a single sample log:

  1. In the receiver configuration click Parse Sample Log
  2. Select a sample log entry
  3. Review the parsed fields:
Field Description
Raw Log The original unprocessed log entry
Parsed Fields The field values extracted by the transformation rules
Matched Rules Which transformation rules were applied to this log
  1. Identify any parsing issues and adjust receiver rules accordingly

Receiver history:

LT Auditor MP maintains a version history of receiver configurations:

  1. Open a receiver
  2. Click View History
  3. Review previous versions with timestamps
  4. Revert to a previous version if needed

This is useful when a recent configuration change has caused parsing issues and you need to restore a previously working configuration.

Duplicating a receiver:

To create a similar receiver quickly without starting from scratch:

  1. Select an existing receiver
  2. Click Duplicate
  3. Modify the name and any specific configuration as needed
  4. Click Save

Collector configuration:

Collectors are the services that receive forwarded log data from collection modules and pass it to the LT Auditor MP server. Collector connection settings are managed separately from receiver configuration:

  1. Navigate to Admin → Collector Details
  2. Configure collector connection settings:
Setting Description
Collector URL The endpoint where collectors send log data
Authentication API keys or tokens for secure communication
Rate Limits Controls for log ingestion rate
  1. Save the configuration

[Your administrator should confirm the collector connection settings for your deployment and ensure all collection modules are correctly pointing to the configured collector endpoint.]

Best practices:

  • Start with simple field extraction rules before adding complex transformations — validate each step before building on it
  • Always test receivers with real sample logs from your environment before activating them in production
  • Use descriptive rule names and descriptions to document complex transformation logic so other administrators can maintain them
  • Keep transformation rules efficient — complex rules applied to high log volumes can impact ingestion performance
  • Use the version history to track changes and revert quickly if a configuration change causes problems
  • Duplicate existing receivers as a starting point when adding support for similar log sources

[Your administrator should document all configured receivers and the transformation logic they apply so the configuration is auditable and maintainable by any team member.]