UDS Requirement

[Anonymous]

We need to add the unsupported device to SA, what are the requirements to add the device to start collection of logs.

The device is of Avaya Switch.

What the changes need to do on the device type or what the changes need to do the changes and settings on the Security Analytic side.

[huanzhou1]

any log sample? syslog? or something else? may need to create parser yourself.

[Anonymous]

patriot is correct.  You are going to need to create a parser and added to to /etc/netwitness/ng/envision/etc/devices/* on the log decoder.  You will also need to create a .ini and .xml for the log messages. 

Do you happen to becoming from enVision with that UDS already in there?  Most of the files are very similar in nature for the logs still, though I believe they are planning to move to lua for logs aswell. 

[Anonymous · Accepted solution]

Download Envision EventSource Integrator and create a custom parser.