Skip to main content

Install Content from Content Hub

What is Content Hub?​

Content Hub provides pre-built pipeline templates for common device types and vendors. Templates handle log parsing, data extraction, field normalization, and format transformation for sources such as Cisco, Palo Alto, Microsoft, and others.

Browse Content Hub​

  1. Navigate to Content Hub

    • From the sidebar: Content Management > Content Hub

  2. Understand the Layout

    • Left sidebar: Three filters — Device type, Target and Device vendor. All three describe the content pack, not your own configuration
    • Search box: Find templates by name or keyword
    • Main area: Template cards showing available pipelines
    • Template cards: Show name, description, and installation status (with an Installed indicator for already-installed templates)

  3. Filter Templates

    The filters narrow the catalogue by the kind of equipment a pack was written for. None of them matches against the devices or targets you have configured, so there is nothing here to set from your own setup:

    • Device type offers eight broad categories — AI and ML, Cloud and SaaS Security, Data Analytics, Endpoint Security, Enterprise Applications, Identity and Access, Infrastructure and OS, and Network Security. There is no protocol here, so no Syslog entry
    • Target is named misleadingly: it lists device families such as Cisco Firepower, PA-Series and FortiGate, not output destinations. It has no File entry, and nothing in it refers to your targets
    • Device vendor lists manufacturers — Cisco, Palo Alto Networks, Fortinet and so on. This is the one to reach for when you know the equipment sending your logs

    For a syslog source, the useful move is usually the search box rather than the filters: search for the product name.

Find the Right Template​

  1. Review Available Templates

    • Look for templates that match your syslog source
    • Common options include generic syslog parsers, network device templates (Cisco, Juniper), and security device templates (Palo Alto, Fortinet)

  2. Examine Template Details Click on a template card to view its detail page with the following tabs:

    • General Overview: What the template does, supported device types, and processors used
    • Pipeline Overview: Processing logic and child pipelines (read-only until installed)
    • Route Overview (if available): Advanced route configuration included with the template
    • Log Transformation Overview: Before/after examples of data transformation
    • License Details: Template license information
    • Activity Logs: The install, update and uninstall history for this pack

Install Your First Template​

note

Select a template that matches your actual syslog source. Choosing the wrong template results in incorrect parsing. If unsure, start with a generic syslog parser.

  1. Select a Template

    • Choose a "Generic Syslog" or "Network Device" template
    • Click on the template card to view details

  2. Install the Template

    • Click Install content pack (top right)
    • If the template has dependencies or includes an advanced route, a configuration modal appears. Otherwise, the template installs immediately.

  3. Handle Dependencies (if prompted)

    • Required dependencies are automatically included and cannot be deselected
    • Optional dependencies can be selected or deselected as needed
    • Click Install to proceed

  4. Verify Installation

    • You are redirected to the installed pipeline's detail page
    • The template card on the Content Hub overview now shows an Installed indicator
    • The install button is replaced by an Actions menu with options such as See installed pipeline, Manage dependencies, and Install route (for packs that include a route)

When the Template Is Updated​

VirtualMetric revises content packs over time. When a newer version of a pack you installed becomes available, the pipeline shows a Pipeline update available alert and a Review update action, which opens a side-by-side diff of your current pipeline against the update.

From there, Accept Changes applies the update to the pipeline you are looking at, and Accept All Changes applies it to that pipeline and every child pipeline in the same review. Updates are accepted per pipeline, so customizations you made are yours to keep or replace.

For the full review workflow, see Content Hub Overview.

What's Next?​

Your processing pipeline is now ready to transform raw syslog data into structured, standardized format. Next, we connect everything together so data flows from your device through the pipeline to your target.

Next: Connect Everything with Routes to create the data flow path.