What log standards does RSA Netwitness understand for a WEB application? And Can the admin configure it to understand proprietary WEB system logs?

[malikzak]

I am new to SIEM products, sorry if the question is redundant.

We have case where RSA Netwitness should read the log files of various web applications. Each one may have its own log pattern and some may support a standard log pattern.

What log standards does RSA Netwitness understand for a WEB application? And Can the admin configure it to understand proprietary WEB system logs?

Thanks in Advance

[DaveGlover]

Netwitness understands Apache and ISS log formats

If your custom app writes in a different format a customer parser will be needed to normalize the data.

The caveat to this is.. if your application can write the logs using key value pairs (user=bob , source address=1.2.3.4) then the log decoder will be able to parse this data without any additional work.

Feel free to reach out to me and I can help you with a custom parser if needed.

Dave

[malikzak]

Thats great.

Thanks Dave