Investigator Setup

[MichaelPochan]

We currently have investigator 10.6 but have been unable to use it and would like to test lua parsers with it. 

From this error, I assume it's not connecting to our proxy, but I see no way to enter proxy information. 

Trying to do the enterprise install, which device should be point the remote collection to? Broker over 56003?

We haven't been successful tying it to any of our devices. 

[WilliamMotley1]

I can't help with your error, sorry.

However, for testing lua parsers you'd import pcaps into it - they will be parsed by the parsers enabled in Investigator.  You don't need to connect it to another device (e.g., broker).  Anything pulled from another device has already been parsed by Decoder.

[MichaelPochan]

Yeah, ideally I'd like to do the freeware version and import the pcaps I have to test with our parsers. Just can't get the registration down since I can't point it to our proxy. 

[GuyBruneau]

Michael,

Just make sure your proxy information is correctly entered in your browser and it should be able to connect to your Broker/Concentrator.

[Anonymous]

You can point it to any of your core appliances.  Decoder, Log decoder, Concentrator, or Broker.  While the native ports should work (50004, 50002, 50005 and 50003 respectively), if you are using SSL on those appliances, you may need to use different ports (56004, 56002, 56005 and 56003 respectively).  Remember you will also need an account on those appliances to connect.  This is not the same as your SA account.

Also, do you need the proxy?  Since this is essentially connecting directly to the appliance ports, you may not even need it.  However, if you are not able to connect to the ports, there could be other restrictions between you and the appliance.

Chris

[MichaelPochan]

Thanks Chris. I was only concerned about using the proxy for the freeware registration which I couldn't get to work. For the account on the appliances, is this something separate from the NwConsole account (ie just regular shell account?). 

[Anonymous]

No..that would be it.  The account used with NwConsole is local to the service (decoder, concentrator, broker).  If the admin account is not in use or the password had changed, you would just need to make sure you had and used an account, which could be added through SA.  You would go to Administration, Services, select the core service, and click View/Security.  From there, add the account you need.

Please note this is per appliance.