App Rule Lookup

[JoeGumke]

I have an interesting use case that I need a solution for.

Use Case: Need to identify if user credentials are contained in the url string of a web request.

Log source : proxy logs

Requirements : Want to build an app rule to leverage to query/reporting/esa rule usage that looks at, and identifies if the user requesting the web request (user.src) is contained within the URL string of the webrequest.

The problem is that i'm not sure if its feasible within this product to do lookups of tags within another tag?

So essentially, i'd want to do an app rule that does this, but not sure if possible. The contains only allows for string matches right? Not tag values?

user.src tag is contained within the URL tag?

[JoeGumke]

thanks william. Is there a log version of this available?

I was playing around yesterday, and attempting to build one, but ran into a snag...

Is we able to only make a callback to one tag through a function?

In all of the LUA parsers, I've only seen one tag make a callback, is it possible to call back 2 or more tags in one function? So the below user.src, could be user.src and device.type calling lua_userInURL.srcUserCheck

[WilliamMotley1]

It should work on a log decoder as-is.  On a packet decoder it won't work, but only because neither user.src nor url are keys used by packets.

You can get callbacks for multiple keys.  The parser I posted above gets callbacks for both user.src and url.

If you mean "can multiple callbacks call the same function", then yes:

    someParser:setCallbacks({

      ["foo"] = someParser.functionA,

      ["bar"] = someParser.functionA,

      ["hello"] = someParser.functionB,

      ["world"] = someParser.functionB

    })

Both "foo" and "bar" call functionA.  Both "hello" and "world" call functionB.

[JoeGumke]

thanks william. I just tried on our UAT decoder, and it doesnt work. I can send you a sample log if needed.

[WilliamMotley1]

I wouldn't need the actual log message, just the meta produced from the log.

Also make sure /decoder/parsers/config lua.enabled = yes

[Anonymous]

Also make sure the 'nwll.lua' file is in the /etc/netwitness/ng/parsers directory.

It is not on a log decoder by default.

Chris

[WilliamMotley1]

Actually, nwll isn't necessary for the parser posted above.

It isn't a general requirement for all lua parsers.  Parsers that explicitly require it will have a line like:

    local nwll = require('nwll')