Parser Cisco

[ClaudeChouinard]

I loke for a parser for Cisco Catalyst (switch) ?

[EricPartington]

https://community.rsa.com/community/products/netwitness/parser-network/event-sources

does this help?

[ClaudeChouinard]

I already saw.
There is nothing for the Cisco catalyst (switch) series 3500 and 3600.

[Anonymous]

Due it is still arriving by syslog you could identify on which event IDs you are interested and then create a Parser using Log Parser Tool:

https://community.rsa.com/docs/DOC-85202 

[ClaudeChouinard]

Thanks for the information but my problem is that I am a Novice and I have no idea how this tools works.

Is there video or guide on the use of this Tools.

[AkramHamed]

Free On-Demand Learning Course:  RSA NetWitness Log Parser Tool 

[EricPartington]

Just because the specific version of the device is not listed, there may be a parser already for catalyst switches in general or cisco switches that already parses the format of your specific devices. 

Probably best to enable logging, turn on the cisco switch parser and see what parses and what does not then determine what your next steps are from there.  Some may need custom parsing, some may extract data from the parser tokens capability in 11.2.

Eric

[ClaudeChouinard]

Merci pour l'information  !

[Anonymous]

besides the information already shared there is a link to user guide on parser tool release notes.I encourage you to read it.

https://community.rsa.com/docs/DOC-85017 

[ClaudeChouinard]

Merci