NetWitness Community

RSAAdmin · ‎2013-11-12

How to create custom parser in security analytics

Anonymous · ‎2013-11-12

Are you asking how to create a customer parser? There are a bunch of threads on the Community talking about creating custom parsers such as this one:

There is also documentation on this on the docs.netwitness site here: http://docs.netwitness.com/1-RSA_Security_Analytics_User_Guide/50_Administration_Module/1_The_Devices_View/3_Device_Config_View/04_Config_View_Decoder/5_Parsers

Anonymous · ‎2013-12-16

These links tell you how to upload a parser, I would like to know where the tool to build the parser is in SA?

RSAAdmin · ‎2013-12-17

The parsers themselves are built in your favorite text editor. I personally use notepad++ and add the parser extension into the XML language category for syntax highlighting. Alternatively, if you prefer you can use C:\Users\All Users\NetWitness\parsers\parsers.xsd in a text editor that supports it. I personally prefer the new Lua parser language over the older flex language. These are also created in a text editor.

RSAAdmin · ‎2013-12-18

Basically, go back and read the Envision documentation on this. It's no different. I do know that RSA has a parser tool similar to Arcsight's, that allows you to import your logs and it will parse like 80% of it. It's a back office tool so you need to really push to get it, but it's there. There is no "Security Analytics" documentation on creating custom parsers, and if you look at the SA docs on configuration of devices, there are about 21 docs. So don't hold your breath waiting for anything to help you out. Best of luck

Anonymous · ‎2014-02-04

Have any idea about that parser tool, from where we can get this?

RSAAdmin · ‎2015-02-03

I would also be interested in this parser..I havent been able to find much regarding this yet..

Anonymous · ‎2015-02-03

have you read this?

Parsers Book.zip

RSAAdmin · ‎2015-02-04

Thanks, That document appears to be dedicated towards packet parsers, not log parsers.

Anonymous · ‎2015-02-04

That is correct. I spoke with Will, who wrote that book, and he doesn't have an equivalent version for logs. The good news is that partially due to this thread we've identified this as a need, the bad news is we don't have immediate documentation that can help.