> Source: [sk177524](https://support.checkpoint.com/results/sk/sk177524)

# sk177524 - Custom log parser for Microsoft Defender for Cloud Apps

| Property | Value |
|----------|-------|
| Solution ID | sk177524 |
| Date Created | 2022-01-23 |
| Last Modified | 2025-01-21 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.10, R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 |
| OS | Gaia |

## Symptoms

- Missing log attributes in Microsoft Defender for Cloud Apps continuous upload feature:
Target App URL, Username, Total Traffic and Uploaded bytes.

## Cause

The log parser that is part of the continuous upload feature from Microsoft Defender for Cloud Apps is missing these Check Point log attributes:

* Target App URLs
* Username
* Total Traffic
* Uploaded bytes

## Solution

The workaround is to use the custom log parser feature until the continuous log parser feature is fixed in Microsoft Defender for Cloud Apps.

1. Connect to the command line on the Check Point Management Server.

2. Log in to the Expert mode.

3. On a Multi-Domain Security Management Server, go to the context of the applicable Domain Management Server:

   `mdsenv <IP Address or Name of Domain Management Server>`
4. Export the log entries into a CSV file:

   `fwm logexport -n -p -i $FWDIR/log/fw.log > /var/log/LogExport.csv`

   Notes:
   * For information about the "`fwm logexport`" command, see the [CLI Reference Guide](https://support.checkpoint.com/product/184) for your version (in the "Resource" section, click "Documentation").

   * MS Defender for Cloud Apps can accept log files with the size of up to 1 Gb.

5. Transfer the CSV file (`/var/log/LogExport.csv`) from the Management Server to your computer.

6. In Microsoft Defender for Cloud Apps, create a new snapshot report using a custom log format.

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177524/Picture2202201240916013.png)
7. Enter the Parser information.

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177524/Picture3202201240917291.png)
8. Upload the CSV file (`LogExport.csv`):

   **Note** - Depending on the log file size, it can take up to 24 hours.

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177524/Picture4202201211005251.png)

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177524/Picture5202201211005362.png)
9. Review the log report.

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177524/Picture6202201211006191.png)

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177524/Picture7202201211006312.png)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content