Problems with Sysmon v8 Parsing

[OlatundeIdowu]

I'm trying to parse sysmon logs in Netwitness and I've updated the winevent_nic parser to the latest one on github. The problem is mostly with reference.id = '1'. The parent process is not getting parsed which really reduces the value of the logs. Any help with this will be appreciated.

Regards,

Olatunde

[EricaChalfin]

Olatunde Idowu‌,

I've moved your question to the RSA NetWitness Platform" data-type="space space where it will be seen by the product's support engineers, other customers and partners.  Please bookmark this page and use it when you have product-specific questions.

Alternatively, from the RSA Customer Support" data-type="space‌ page, click on Ask A Question on the blue navigation bar and choose Ask A Product Related Question.  From there, scroll to RSA NetWitness Platform" data-type="space and click Ask A Question.  That way your question will appear in the correct space.

Regards,

Erica

[EricPartington]

can you provide a sample of those events to me via DM? I'd like to take a look and see what can be done

[OlatundeIdowu · Accepted solution]

Apparently the parent process was being parsed but the metakey was not enabled. I had to enable the process.src meta key using the 'findmissing' script and copied the ouput to the table-map-custom.xml file on the log decoder.