Snare Detecting As A Ciscorouter parser

[DeepanshuSood1]

Hi,

I had integrated almost 10 windows machines from snare method, but when I check the logs from those machines then all the logs from the windows machines are detecting as under "ciscorouter".

I had opened a case regarding the same with RSA CS, so as per them they are saying that our engineering team is working on the same to fix is for you.

But here the problem, the customer can't live with this kind of issue for too long time.

So is there any one who had faced the same issue and resolved it too.

Kindly advise.

Regards,

Deepanshu Sood.

[DavidWaugh1]

Hi can you paste some anonymised log samples so that we can take a look.

[DavidWaugh1]

You can also bind parsers to ip addresses:

https://rsaportal.force.com/customer/articles/How_To/a67284-How-to-direct-the-RSA-Security-Analytics-Log-Decoder-to-use-a-specific-device-parser-when-collecting-logs-from-a-given-event-source-10-3-4-and-higher

[DeepanshuSood1 · Accepted solution]

HI David,

My issue get solved now and almost 80% of the logs are going under the right parser, i.e., winevent_snare.

I followed one solution available on the knowledge base, applied the same and the issue get resolved.

Thanks for your suggestion.

Regards,

Deepanshu Sood.

[jeffshurtliff]

Hi Deepanshu,

I'm glad to hear your issue was fixed.  Do you happen to remember which knowledge base article resolved your issue?

Thanks,

Jeff

[DeepanshuSood1]

This is the one. Thanks.

https://rsaportal.force.com/customer/articles/Break_Fix/Logs-from-Windows-snare-agents-are-showing-not-parsing-as-event-…

Regards,

Deepanshu Sood.