This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Discussions
Announcement Banner

Users are unable to open Netwitness Support Cases via email. Please open support cases via portal or by phone

View Details
  • NetWitness Community
  • Discussions
  • Re: Working with integers in LUA-NWDB
  • Options
    • Subscribe to RSS Feed
    • Mark Topic as New
    • Mark Topic as Read
    • Float this Topic for Current User
    • Bookmark
    • Subscribe
    • Mute
    • Printer Friendly Page

Working with integers in LUA-NWDB

Go to solution
NickMikhal
NickMikhal Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content

‎2019-04-16 05:52 AM

Good afternoon,

 

I am working on LUA script on top of proxy parsers to extract ports from url's among other things.
I have an issue working with integers, while strings are extracted properly.
Not to post full script here are the main parts, which work fine in LUA IDE, but have issues with integers in SA:

-Sample target, need to extract 8080:

example.com:8080/path/file


-I define target metakey:
nwlanguagekey.create("ip.dstport")

 

-Then I extract it as string (just a sample from code to get the idea):
ip_dstport= string.sub(fullpath, firstColon + 1, firstSlash - 1)

 

-Then I assign to nwdb metakey and do some checks:
if ip_dstport and not (ip_dstport == nil or ip_dstport == "") then
    nw.createMeta(self.keys["ip.dstport"], tonumber(ip_dstport))
end

 

- Type check returns number:
print(type(tonumber(ip_dstport)))
number

 

- When I deploy this in SA I get the following:
Invalid registered lua key 'ip.dstport' type specified for parser XXX. Got 'Text' expected 'Uint16'

 

- table-map.xml:
    <mapping envisionName="dport" nwName="ip.dstport" flags="None" format="UInt16" envisionDisplayName="ForeignPort|DestinationPort" nullTokens="-|(null)|null"/>

 

While other string based extractions are working in SA fine in same parser. So how do you work with integers in LUA-NWDB setup? Why is it treating number as integer and how to convert from LUA number/string to NWDB UInt16?

I can of course use string based metakeys instead for port extraction, but it would be nice to unify LUA extraction with existing meta model and to put ip.dstport to ip.dstport not to ip.dstport.string or something.

Maybe I can convert string to ip.dstport via some table map or index magic?

  • Community Thread
  • Discussion
  • Forum Thread
  • Lua
  • NetWitness
  • NW
  • NWP
  • RSA NetWitness
  • RSA NetWitness Platform
0 Likes
Share
Reply
  • All forum topics
  • Previous Topic
  • Next Topic
1 ACCEPTED SOLUTION

Accepted Solutions

Go to solution
WilliamMotley1
Frequent Contributor WilliamMotley1 Frequent Contributor
Frequent Contributor
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content

‎2019-04-16 09:00 AM

In your key declaration in setKeys specify the format of the key if it isn't Text.

 

For a UInt16 format key, e.g.

 

nwlanguagekey.create("ip.dstport", nwtypes.UInt16)

 

The full list of nwtypes is in nw-api.lua (included with the parsers book).

View solution in original post

0 Likes
Share
Reply
2 REPLIES 2

Go to solution
WilliamMotley1
Frequent Contributor WilliamMotley1 Frequent Contributor
Frequent Contributor
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content

‎2019-04-16 09:00 AM

In your key declaration in setKeys specify the format of the key if it isn't Text.

 

For a UInt16 format key, e.g.

 

nwlanguagekey.create("ip.dstport", nwtypes.UInt16)

 

The full list of nwtypes is in nw-api.lua (included with the parsers book).

0 Likes
Share
Reply

Go to solution
NickMikhal
NickMikhal Beginner
Beginner
In response to WilliamMotley1
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content

‎2019-05-13 05:06 AM

Hello William,

Thanks for the tip, did some modifications now the destination ports are extracted from url's properly. Handy for ftp over http extractions for example.

Definition:

nwlanguagekey.create("ip.dstport", nwtypes.UInt16)

And additional check + assignment:
if ip_dstport and tonumber(ip_dstport) ~= nil then
nw.createMeta(self.keys["ip.dstport"], ip_dstport)

And thanks a lot for the book, very helpful for LUA development!
0 Likes
Share
Reply
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.