How to Change Meta in Event Reconstruction

[RenatoGoncalves]

Hello,

We recently saw a log with both ports, source and destiny and we noticed that the event reconstruction only show on port:

Here's the log:

Sep 27 2018 10:58:45: %CHKPNT-6-050100: accept,100.07.200.106,inbound,bond50.1000,10.0.00.000,40020,83.240.149.119,443, ,tcp,42, , , , , , , , , , , , , , , , , , , , , , , ,27Sep2018 10:58:45,0,VPN-1 & FireWall-1,000.07.200.106,00023,10.3.205.7,0, , , ,https, , , , , , , , , , , , , , , , , , , , , , , ,051110, , , , , , , , ,74,1, , , , , ,{0CB00B0B-2000-40D3-B0C0-0020603010F0},BP0G0A000 FE, , ,

Now notice the Event Reconstruction:

I thought that maybe it was a problem with the parser...but open RSA Log Parser Tool and try it, putting a firewall log against the xml file for the model of our firewall and i noticed that both ports are parsed.

Is their anyway to change the meta that appears in Event Reconstruction? I that case i choose to appear both ports.....                                                                                      

[EricPartington]

not sure what your question is, please add more details.

[RenatoGoncalves]

In the last picture you can see that in the log parser tool, with the checkpoint parser it parsed both tcp ports: 50165 and 80.

In the raw log you can see that it has both ports, in the case port 80 and port 443 but when i click in view meta it only shows one of them: Destiny Port.

I want to know if its possible to show both ports, as they are in the log and are well parsed in the log parser tool

[EricPartington]

my guess is that the first port is the source port and the second is the destination port.

check your table-map.xml on the log decoder, by default the ip.srcport is not indexed (transient)

<mapping envisionName="sport" nwName="ip.srcport" flags="Transient" format="UInt16"  nullTokens="-|(null)|N/A"/>

To see this data and have it preserved you need to take that line, add it to the table-map-custom.xml file on your log decoders and change the Transient to None

<mapping envisionName="sport" nwName="ip.srcport" flags="None" format="UInt16"  nullTokens="-|(null)|N/A"/>

Now restart your log decoder service to make that take effect.

You can push out the table-map-custom.xml to your other log decoders where you will need to restart their log decoder services if you want to keep all your table-map-custom.xml in sync.

[RenatoGoncalves]

Hello Eric,

After i edited the file nothing has changed.....its necessary to do something else?

[EricPartington]

did you restart the service after the change?

how did you verify that the change did not work?

[RenatoGoncalves]

Hi Eric

Yes i restarted...

I opened a log, clicked in view meta and it still does not appear...

[EricPartington]

I would open a support ticket with RSA to see if they can help you remotely solve this.