OCR Log Integration with SIEM

Products

• Data Loss Prevention

Issue/Introduction

Integration of OCR (Optical Character Recognition) logs with a SIEM solution to gain better visibility into OCR failures, enable proactive alerting, and monitor unsupported image size, resolution, or formats.

Resolution

Direct integration of OCR logs with a SIEM platform is not supported in DLP versions 16.0, 16.1, and 25.1. There is currently no built-in functionality to forward detailed OCR processing logs directly to a SIEM system.

As a workaround, customers may install a SIEM agent on the OCR server and monitor the relevant error codes referenced in the Error codes produced by OCR. However, this approach is supported on a best-effort basis only, and in-depth investigation or troubleshooting assistance for this configuration will not be available by Support. 

 

Additional Information

A feature request has been created to support this feature in the future release, please contact Broadcom Support for more details.