NetWitness Community

huanzhou1 · ‎2013-10-09

How to deploy the event source package created by ESI?

RSAAdmin · ‎2013-10-22

Hi, patriot3w

You need to create the parser the usual way in ESI. Then you need to take the event source package xml and ini files and put them in a new folder that you create in the parsers folder (/etc/netwitness/ng/envision/etc/devices) on log decoder.

There are limitations:

1) the parser/folder name should be in lowercase and must not contain any special characters

2) the parser content should be 2.0

For ODBC/file event sources you need to setup additional service configs.

I wonder why there is no documentation for this.

View solution in original post

RSAAdmin · ‎2013-10-22

Hi, patriot3w

You need to create the parser the usual way in ESI. Then you need to take the event source package xml and ini files and put them in a new folder that you create in the parsers folder (/etc/netwitness/ng/envision/etc/devices) on log decoder.

There are limitations:

1) the parser/folder name should be in lowercase and must not contain any special characters

2) the parser content should be 2.0

For ODBC/file event sources you need to setup additional service configs.

I wonder why there is no documentation for this.

huanzhou1 · ‎2013-10-22

can you find any document from internal?

RSAAdmin · ‎2013-10-22

I don't have any, I don't work for EMC/RSA

Just sharing my experience on SA/Envision. I gave quite a full overview of the process - just restart the decoder services after you upload the files. Also there's a document about ESI on SCOL.

huanzhou1 · ‎2013-10-22

Only has document on ESI, not on how to integrate with SA.

Also for SA, only documents is docs.netwitness.com which is very limited.

RSAAdmin · ‎2013-10-22

Yes, I know - can't do nothing about that.

So you should make event source package using ESU and docs from SCOL. After that you can deploy the xml and ini (located in your package e.g. yourdevice\update_content\etc\devices\yourdevice) file on log decoder:

1) Copy ini and xml from event source package to newly created folder in /etc/netwitness/ng/envision/etc/devices on SA log decoder

2) Make sure you used content 2.0 and have your new file's names in lowercase

3) Restart decoder services

That's it

huanzhou1 · ‎2013-10-22

Yes,i got it.

I manually modified the xml file, now it shows as parser.

How can ESI do below step?

----------------------------

2) the parser content should be 2.0

-----------------------------------

RSAAdmin · ‎2013-10-22

You should apply ESU (event source update) - client side to get the 2.0 tables in ESI. The ESU docs have the list of 2.0 tables.

You will get SA meta only for 2.0 tables.

huanzhou1 · ‎2013-10-22

Thanks a lot. Downloading now. Will try out.

huanzhou1 · ‎2013-10-22

The result xml(testing.xml) is not v20, i checked /etc/netwitness/ng/envision/etc/devices/aix, the xml file name is v20_pixmsg.xml, how to make it v20?