Transitioning to Lua Parsers

[Anonymous]

Is there any matrix of the new lua parsers and the old parser(s) they replace?  Some of them are obvious, others less so.  Anybody have experience switching over?

[RSAAdmin]

Correct, if you have HTTP_lua enabled you shouldn't need NTLMSSP_lua as well.

- Bill

[RSAAdmin]

Great information! Is there an easy way to remove the old flex parsers, or is it a manual/scripted process?

[Anonymous]

In regards to the packers lua parser, you indicate it replaces the existing packers parser.  Does this include all of the malware_packers_X parsers and javascript_packers?

[RSAAdmin]

> Great information! Is there an easy way to remove the old flex parsers, or is

> it a manual/scripted process?

Its a manual process for now unfortunately.

[RSAAdmin · Accepted solution]

> In regards to the packers lua parser, you indicate it replaces the existing

> packers parser.  Does this include all of the malware_packers_X parsers

> and javascript_packers?

The 'packers' flex parser file actually contains all of the individual malware_packers_X  parsers.  The 'packers' lua parser replaces all of them.

The 'javascript' flex parser file contains 'javascript_suspicious', 'javascript_packers', and 'javascript_shellcode' parsers.  The 'fingerprint_javascript_lua' parser replaces all of them.

[huanzhou1]

will it become a KB link？

[Anonymous]

Any word on the availability of some of these parsers unencrypted, for demonstration purposes?  It would be useful for custom parser creation.

[huanzhou1]

Is there any update to table? we're trying to apply the LUA parser but don't know which one to apply.

1. Can LUA parser and Flex parser be applied at same time?

2. Some Flex parsers don't have replacement LUA parser, like OS and browser parser, when will it be available?

Thank you.

[RSAAdmin]

Sorry for the late reply.

1.  Yes, they can be enabled at the same time.  But if a flex and a lua parser that parses the same thing are both enabled, then the decoder will be doing more work and registering duplicate meta.

2.  Those two parsers really just tried to match bits of user-agent headers and make inferences based on that.  Instead HTTP_lua simply registers the entire user-agent header.

[huanzhou1]

if like this, can the system auto detect if both flex and lua pasers enabled for the same thing, it will disable one of them?