Blueprints

Bindplane Blueprints

Explore pre-built Blueprints for common telemetry use cases. Each Blueprint combines processors that standardize, reduce, and transform telemetry data.

Get started Request demo

Deduplicate Windows Events Rendering Info

Removes duplicated Rendering Info from Windows events that can prevent them from parsing correctly. For full removal, Suppress Rendering Info can be enabled at the source.

Enrich FortiGate Security Events

Enriches FortiGate security events with MITRE ATT&CK context based on event type, subtype, and action.

Enrich Okta Security Logs

Enriches Okta authentication and administrative events with MITRE ATT&CK context based on event type and outcome.

Enrich Palo Alto Security Events

Enriches Palo Alto Networks firewall security events with MITRE ATT&CK context based on log type, subtype, action, and threat category.

Optimize Syslog for Elasticsearch

Optimizes syslog messages for Elasticsearch ingestion via OTLP. Rewrites RFC 3164 timestamps to RFC 5424 format, maps syslog severity and facility to OTLP severity and ECS fields, filters debug-level noise, deduplicates repeated messages, and normalizes field names for the Elastic Common Schema.

Parse FIX Protocol Messages

Parses raw FIX protocol (Financial Information eXchange) messages from financial trading gateways, extracts header, order relationship, and trade fields into a structured body map, normalizes the FIX timestamp, and prepares records for downstream log analytics.

Parse JSON

A bundle of processors for parsing JSON logs.

Parse NGINX

A basic NGINX format parser that extracts core fields, removes empty values, and parses the timestamp.

Parse Palo Alto Syslog

Parsing of all Palo Alto Syslog types with removal of null values and options for filtering out of info level, internal, allowed and specific DNS logs while also removing the start of messages.

Parse Palo Alto Threat Syslog

Parsing of all Palo Alto Threat Syslog types with removal of null values and options for filtering out of info level, internal, allowed and specific DNS logs while also removing the start of messages.

Parse Palo Alto Traffic Syslog

Parsing of all Palo Alto Traffic Syslog types with removal of null values and options for filtering out of info level, internal, allowed and specific DNS logs while also removing the start of messages.

Parse Splunk for Splunk Observability

A log parser for Splunk to Splunk observability.

Parse Timestamp

A bundle of processors for parsing a timestamp with regex.

Parse Windows Event XML

Parses raw Windows Event Log XML into a structured, name-keyed map.

Process Apache Common Logs for Elasticsearch

Optimizes Apache HTTP Server access logs (Common Log Format) for Elasticsearch ingestion via OTLP. Parses CLF fields, filters health check and static asset requests, maps HTTP status codes to OTLP severity levels, masks sensitive data, removes high-cardinality fields, samples successful responses, and deduplicates error bursts.

Process HTTP Logs for ClickHouse

Optimizes HTTP access and application logs for ClickHouse analytics. Normalizes HTTP fields, masks sensitive headers and query parameters, reduces high-cardinality request identifiers, and filters health checks.

Process Kubernetes Cluster Events for ClickHouse

Pre-processes Kubernetes cluster-level events for ClickHouse ingestion. Structures and normalizes event data for optimal ClickHouse compression, redacts sensitive information (secret references), ensures resource attributes are populated for the otel_logs schema, maps event types to OTLP severity levels, and deduplicates repeated warning events. Retains high-cardinality data for full visibility since ClickHouse handles large datasets efficiently.

Process Logs for ClickHouse

Comprehensive log hygiene pipeline for ClickHouse ingestion. Parses JSON bodies into structured attributes, coalesces common field name variants into standard names, parses severity into OTEL-standard levels, standardizes attribute naming conventions, masks sensitive data, and groups logs by resource for optimal ClickHouse compression and query performance.

Process NGINX Logs for Elasticsearch

Optimizes NGINX access and error logs for Elasticsearch ingestion via OTLP. Parses the combined log format, filters health check and static asset requests, maps HTTP status codes to OTLP severity levels, masks sensitive data, removes high-cardinality request identifiers, samples successful responses, and deduplicates error bursts.

Process Security Logs for ClickHouse

Optimizes security and audit logs for ClickHouse SIEM analytics. Preserves authentication events and security signals while masking PII, normalizing timestamps, and parsing event details.

Reduce CloudTrail Events

Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. This configuration will help you to remove verbose events such as read-only events with GET, LIST, Describe, or BatchGet parameters, from AWS CloudTrail.

Reduce Cluster Controller Event Noise

Filters high-volume, Kubernetes cluster-level controller events (Deployments, ReplicaSets, Jobs, CronJobs, HPA) while preserving all warnings and runtime failure signals.

Reduce CrowdStrike Falcon Log Volume for Google SecOps

Reduces CrowdStrike Falcon EDR log volume sent to Google SecOps by 30-50% by dropping high-volume, low-signal event types (sensor housekeeping, redundant process termination, benign DNS resolution, and routine network telemetry), pruning verbose fields from retained events, deduplicating repeated entries, and cleaning empty values — while preserving all detection, alert, authentication, and security-relevant events without exception.

Remove Windows Event Messages

Removes the Message element content from Windows Event XML logs to reduce log size while preserving the structured event data.

Rewrite Timestamps to RFC5424

A bundle of processors for rewriting a syslog message's rfc3164 timestamp into rfc5424 format.

Standardize Windows Events for Google SecOps

A bundle of processors for standardizing Google SecOps data.

Community Engagement

Join the Community

Become a part of our thriving community, where you can connect with like-minded individuals, collaborate on projects, and grow together.