How to alert based on multiple meta keys?

[UmaMaheshPadise]

Hi,

Scenerio:

A log is parsed into below meta keys

   aba = 'xxxx'

   dda = 'yyyy'

   .....

I have blacklist of aba,dda pair

      blacklisted_account,aba1,dda1

      blacklisted_account,aba2,dda2

I need to alert if any log has aba=aba1 and dda=dda1

                         OR               aba=aba2 and dda=dda2

I should not alert when aba=aba1 and dda=dda2

-----------
One solution i have in mind is as below which i am not sure works.

To create custom meta key which is created while log is parsed by SA

          abadda = aba||'!'||dda

Feed is    

      tags,abadda

       blacklisted_account,aba1!dda1
       blacklisted_account,aba2!dda2

ESPER Alert

      'blacklisted_account'=ANY(tags)              

-------------

Hence i am looking for a way to create abadda (a custom meta key carved out of existing metakeys)

Or

Alternative way to accomplish above alerting.

Thanks,

Uma Mahesh | 7068402149

ADP

[Anonymous]

Since this is being done outside of the feed wizard, you'd likely need to script the process. Once the xml is created, a cron job could be created to retrieve the updated CSV and create the feed file using the NwConsole syntax.  Once created, that file could be pushed to the decoders and a feed reload issued.

[UmaMaheshPadise]

So a cron job has to run on SA Broker

That does

1. Execute below commands in sequence

• CURL http://application/feeds/multiblacklist.csv

• NwConsole –c feed create multiblacklist.xml

• cp *.feed /etc/netwitness/ng/feeds

• NwConsole –c parsers feed op=notify

Uma

[Anonymous]

That would probably work.  SA server is one place.  NwConsole could be installed anywhere really.  As long as it can get the updated CSV and perform the other functions, it could be run from any system.