This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
      • Netwitness XDR
      • EC-Council Training
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
    • Role-Based Training
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Discussions
  • NetWitness Community
  • Discussions
  • Re: Packet Lua Parser - assistance
  • Options
    • Subscribe to RSS Feed
    • Mark Topic as New
    • Mark Topic as Read
    • Float this Topic for Current User
    • Bookmark
    • Subscribe
    • Mute
    • Printer Friendly Page

Packet Lua Parser - assistance

DavidGassman2
DavidGassman2 Occasional Contributor
Occasional Contributor
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2019-12-02 10:21 AM

I'm working on a packet parser that I could use some Community help with.

Essentially I'm trying to find a token and then register that token as meta in an existing key. Additionally, if more than one token is found in the session - register the others as well.

 

Here's what I've done thus far - but it's not producing the expected results:

 

+++++++++++++++++++++++++
local lua_findme = nw.createParser("lua_findme", "Finding tokens")

lua_findme:setKeys({
nwlanguagekey.create("threat.desc")
})


function lua_findme:magic(token)
nw.createMeta(self.keys["threat.desc"], token)
end

 

lua_findme:setCallbacks({
["badPassword"] = lua_findme.magic,
["SupportedEncryption"] = lua_findme.magic,
["AccountType"] = lua_findme.magic,
})

+++++++++++++++++++++++++

 

Essentially I've got a list of tokens that I want to be on the look out for and I want the parser to register meta for each finding. Ex: the parser should create meta 'badPassword' under threat.desc && also register 'AccountType' under threat.desc if it is found in that session.

 

Thanks in advance!

  • Community Thread
  • Discussion
  • Forum Thread
  • NetWitness
  • NW
  • NWP
  • RSA NetWitness
  • RSA NetWitness Platform
0 Likes
Reply
  • All forum topics
  • Previous Topic
  • Next Topic
4 REPLIES 4

WilliamMotley1
Frequent Contributor WilliamMotley1 Frequent Contributor
Frequent Contributor
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2019-12-02 10:40 AM

The value passed to the meta-callback function (to the variable "token") will be an index in the table self.tokens.  So to get the actual token use self.tokens[token], e.g.,

nw.createMeta(self.keys["threat.desc"], self.tokens[token])
2 Likes
Reply

DavidGassman2
DavidGassman2 Occasional Contributor
Occasional Contributor
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2019-12-02 12:03 PM

Thanks Bill

 

So after implementing the suggested change you provided, I'm seeing meta displaying as '1' or '2' under threat.desc vs. the token value itself.  Any idea what may be causing that?

0 Likes
Reply

WilliamMotley1
Frequent Contributor WilliamMotley1 Frequent Contributor
Frequent Contributor
In response to DavidGassman2
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2019-12-02 12:20 PM

That doesn't seem right.  "1", "2", etc is the index - the actual value of "token", and the meta that would have been registered from your original parser above.

 

Can you post your entire current parser?

0 Likes
Reply

DavidGassman2
DavidGassman2 Occasional Contributor
Occasional Contributor
In response to WilliamMotley1
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2019-12-10 09:42 AM

Thanks Bill - I figured out my issue. Thanks for your assistance with this. 

0 Likes
Reply
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.