2017-06-21 02:12 PM
Is there a way to gather a version information of currently deployed on log decoders parsers?
The command "/decoder/parsers devices" returns just list of parsers without version information.
2017-06-21 02:18 PM
You can run this on the Log Decoder via SSH:
find /etc/netwitness/ng/envision/etc/devices/ -name "*msg.xml" -type f -print -exec egrep -i "revision=|xml=" {} \;
Should give you an good starting point to understand the revisions of the parsers that exist if you need to compare it against another parser.
2017-06-21 02:59 PM
Thanks. I was thinking about some API call to gather that maybe through the Explore view. I am not very keen on giving the ssh root access to a person who just needs to know a parser's version.
Generally speaking, RSA SA has lots of different content across different devices but lacking a good manageability of it.
I technically can post the output of such a script to the SA server's http folder but it would be great to have this information out of the box.
2017-06-22 08:17 AM