How to parse URLs within an email body in RSA NetWitness Logs & Network

[#1]

Article Number

000002029

Applies To

RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 10.6.x, 11.x
 

Issue

This document describes the steps to parse all URLs within an email content.

Resolution

1. Deploy phishing_lua_options.lua parser attached to this KB to the following location in Packet Decoder

/etc/netwitness/ng/parsers

2. Enable "registerUrl" option in phishing_lua_options.lua

# vi phishing_lua_options.lua

FROM :

function registerUrl()
    --[[
        "Register Entire URL" : default false
~~~~~~
    --]]
    return false
end

TO :

function registerUrl()
    --[[
        "Register Entire URL" : default false
~~~~~~
    --]]
    return true
end

3. Save the file and restart Decoder service

4. Add the following line to /etc/netwitness/ng/index-concentrator-custom.xml in Concentrator and restart Concentrator service
<key description="URL" level="IndexValues" name="url" format="Text" valueMax="10000" defaultAction="Open" />