This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Discussions
Announcement Banner

Users are unable to open Netwitness Support Cases via email. Please open support cases via portal or by phone

View Details
  • NetWitness Community
  • Discussions
  • LUA and meta concatenation
  • Options
    • Subscribe to RSS Feed
    • Mark Topic as New
    • Mark Topic as Read
    • Float this Topic for Current User
    • Bookmark
    • Subscribe
    • Mute
    • Printer Friendly Page

LUA and meta concatenation

AlessandroZatt1
AlessandroZatt1 Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content

‎2015-03-19 08:23 AM

Hi all,

I'm starting to work on a LUA script.

Is it possible with Lua to create a new meta based on a concation of two othe meta?

 

For example:

 

MyMeta=device.type + device.ip

 

Many thanks.

 

Alessandro

  • Community Thread
  • Discussion
  • Forum Thread
  • logdecoder
  • Lua
  • meta
  • NetWitness
  • NW
  • NWP
  • RSA NetWitness
  • RSA NetWitness Platform
0 Likes
Share
Reply
  • All forum topics
  • Previous Topic
  • Next Topic
2 REPLIES 2

RSAAdmin
RSAAdmin Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content

‎2015-03-19 08:44 AM

Try two dots

 

 

Programming in Lua : 3.4

0 Likes
Share
Reply

RSAAdmin
RSAAdmin Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content

‎2015-03-19 01:04 PM

You can get meta-callbacks for device.type and device.ip, concatenate them, and register the result.

 

That's the short answer.  Long answer is it can get tricky.

 

You won't know which will be registered first, so you have to take that into account.  You'll have to use a global to hold the values between the two callback functions, so you have to be sure to reset them at session begin.  If there's a possibility of multiple values for one or the other, you'd want to take that into account.

 

The below is completely untested, unsupported, and probably has numerous typos.  Test before production use.  Use at your own risk.

 

local concatDevice = nw.createParser("device_info", "concatenate device type and device ip")

 

concatDevice:setKeys({

  nwlanguagekey.create("MyMeta")

})

 

function concatDevice:sessionBegin()

    self.deviceType = nil

    self.deviceIP = nil

end

 

function concatDevice:onDeviceType(idx, vlu)

    if self.deviceIP then

        nw.createMeta(self.keys.MyMeta, vlu .. " " .. self.deviceIP)

        self.deviceIP = nil

    else

        self.deviceType = vlu

    end

end

 

function concatDevice:onDeviceIP(idx, vlu)

    if self.deviceType then

        nw.createMeta(self.keys.MyMeta, self.deviceType .. " " .. vlu)

        self.deviceType = nil

    else

        self.deviceIP = vlu

    end

end

 

concatDevice:setCallbacks({

    [nwevents.OnSessionBegin] = concatDevice.sessionBegin,

    [nwlanguagekey.create("device.type")] = concatDevice.onDeviceType,

    [nwlanguagekey.create("device.ip")] = concatDevice.onDeviceIP,

})

 

Note that this doesn't account for the possibility of multiple values.  For example, if device.type is registered twice for a session before device.ip, then the second value will clobber the first.

 

You'll want to add "MyMeta" to your custom index xml's if you need it indexed at higher than level=IndexNone.

0 Likes
Share
Reply
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.