Report from IPDB

[Anonymous]

Hello,

Somebody can help me retrieve events from IPDB located at RSA enVision ES? I read and do all what I find here: https://sadocs.emc.com/0_en-us/095_10.3_User_Guide/13_Device_and_Service_Configuration/IPDB_Extractor_Service_Configurat…

I retrieve devicelist, but can't rectrieve data (events). If I create simpe rule, for example "select ip.src, ip.dst" and "where event.cat.name like '%'" and event source - my devicelist - I receive blank report. I try written any terms in where field and all time I receive blank report.

[huanzhou1]

can you share your configuration?

[Anonymous]

How I can do it?

[huanzhou1]

can share your /etc/fstab? and mount output? do you use NAS? if yes, can share the share info?

[Anonymous]

I use RSA enVision wiouth NAS. Strings at /etc/fstab:

//10.10.0.111/envision-es /var/netwitness/ipdbextractor/ipdb/envision-es cifs au

to,nouser,noexec,ro,credentials=/root/cred 0 0

//10.10.0.111/csd /var/netwitness/ipdbextractor/devicelocation cifs auto,nouser,

noexec,ro,credentials=/root/cred 0 0

Strings at /root/cred:

username=rsasa

password=password

[huanzhou1]

//10.10.0.111/envision-es  is for which path? your node name is envision-es?

[Anonymous]

\\10.10.0.111\envision-es = E:\nic\lsnode\data\ENVISION-ES

Yes, nodename is ENVISION-ES.

[huanzhou1]

i had issue with multiple storages, but single storage is working fine.

can you do ls /var/netwitness/ipdbextractor/ipdb/envision-es

and can share the IPDB rule you created?

[Anonymous]

Rule for example "select ip.src,ip.dst". Event source - list with:

NIC:ENVISION:ENVISION-ES:winevent_nic:10.0.0.21

NIC:ENVISION:ENVISION-ES:winevent_nic:10.0.0.22

NIC:ENVISION:ENVISION-ES:winevent_nic:10.0.0.25

NIC:ENVISION:ENVISION-ES:winevent_nic:10.0.0.26

NIC:ENVISION:ENVISION-ES:winevent_nic:10.0.0.37

[root@SA-WebServer ~]# ls /var/netwitness/ipdbextractor/ipdb/envision-es

ciscoasa     epolicy     mswsus  rhlinux  vmware_esx_esxi  winevent_nic

ciscorouter  msexchange  nic     unknown  vmware_vc

[huanzhou1]

can you share the rule you created?