NetWitness Community

VladimirPrevin · ‎2017-09-28

hello,

has anyone had much luck introspecting the IM data model?

it seems like IM notifications module DOES NOT have access to the raw alert that just arrived data

<#list .data_model as key>
${key}
</#list>

data model: summary, lastUpdated, assigneeName, name, categories, id, priority, incidentLink, lastUpdatedByUserName, status,
main:
fmv: 2.3.19

am I introspecting it wrong?

VladimirPrevin · ‎2017-09-28

ps for ESA it's a lot more self explanatory - you can just iterate over the event keys and that's all . you can even reasonably easily do things like form investigate urls and format meta if need be

<#include "macros.ftl"/><html>
.....
<#if events?size > 0> <table cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td>
<#list events as metadata> <table>
<tbody>
<tr>
<td>
<table id="events" cellpadding="0" cellspacing="0">
<thead>
<tr>
<th scope="col">META</th>
<th scope="col">VALUE</th>
</tr>
</thead>
<#list metadata?keys?sort as key><tbody>
<tr>
<td><#if (metadata.device_type)?? >${metadata.device_type}...</#if><#if (metadata.event_desc)?? >${metadata.event_desc}...</#if>${key}</td>
<td><#if key == "time" || key == "event_time">${(metadata[key] * 1000)?number_to_datetime}<#elseif key == "esa_time"><@value_of metadata[key]?number_to_datetime/>
<#else>
<@value_of metadata[key]/>

</#if>
</td>
</tr>
</tbody>
</#list> </table>
</td>
</tr>
</tbody>
</table>
<#if metadata?? && (metadata.event_source_id)?? && (metadata.sessionid)?? >
<#assign esida = metadata.event_source_id >
<#assign sessionid = metadata.sessionid >
<#assign concentrators = {"a:port":dida, "222.222.22.222:56005":197, "cip:56005":202} >
<#assign replacebits = (":"+sessionid) >
<#assign esids = (esida?replace(replacebits,'')) >

<#if esida?? && esids?? && (concentrators[esids])?? >
<#assign deviceid = concentrators[esids] >
<#assign url=("https://saserver.domain.local/investigation/"+deviceid+"/reconstruction/"+sessionid+"/AUTO")>
<span style="font-size: 14px;">
View event meta: ${url}<br/></span>
<#else>
unable to form url inner
metadata.event_source_id: ${metadata.event_source_id!'-'}
metadata.sessionid: ${metadata.sessionid!'-'}
esida: ${esida!'-'}
replacebits: ${replacebits!'-'}
esids:${esids!'-'},
concentrators valof esids: ${concentrators[esids]!'-'}<br/>
</#if>

<#else><br/>unable to form a url outer ${metadata.event_source_id!'-'} ${metadata.sessionid!'-'}<br/>
</#if>
</#list> </td>
</tr>
</tbody>
</table>
</#if>.....

NetWitness Community

IM and ESA template object introspection