How to write a Parser

[YossiNagar]

Hi,

I want to lern by myself how to write a parsers to Security Analytics.

There is kind of documentation that can help me to understand how to do that?

Thanks,

Yossi.

[KhaledGamal]

Hi Yossi,

If you mean log parsers, then you could use the ESI tool. I have attached a document which can help you get started with understanding how it works. If you mean Packet parser then you would have to learn LUA language to write them.

Thanks and BR

Khaled

[KhaledGamal]

Hi Yossi,

I have also attached a more detailed PDF that might help you.

Best regards,

Khaled

[YossiNagar]

Thank you very much Khaled, I'll look into the file you uploaded for me.

Appriciate your help.

Yossi.

[KhaledGamal]

You are always welcome.

[JohnSnider]

For Lua parser writing, check out Bill Motley's (parser guru) un-official book on Lua parser writing...

https://community.rsa.com/docs/DOC-41370

[YossiNagar]

I'll Check it, thank you!

[pranavsankar1]

Hey Yossi ,

If you want to write/learn parser stuffs using ESI tool kindly got  through below link.

RSA ESI 106 - YouTube

Thanks !

Regards

Pranav Sankar

[YossiNagar]

Thank you Pranav!

I'm looking for a video like this one for a long time..

Appriciate that,

Yossi.

[pranavsankar1]

always welcome