NetWitness 11.7.x and 12.x doesn't display HTTP2 metadata after add HTTP2 parsers options

[#1]

Article Number

000003115

Applies To

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: NetWitness Respond
RSA Version/Condition: 11.7, 12.x
Platform: CentOS
O/S Version: 7

Issue

NetWitness provides metadata items derived from headers in the HTTP/2 stream after append HTTP2="headers=true" (or HTTP2="headers=true extract=all" in 12.x version) to /decoder/parsers/config/parsers.options.

*HTTP Parsers document: https://community.netwitness.com/t5/netwitness-platform-online/http-parsers/ta-p/669159

But some users can't see the metadata (for example: action, alert, alias.host, directory, referer) from HTTP2 sessions after configure the parser options.
 

Below image is the example which doesn't have HTTP2 metadata.
Image description

Below  image is the example which have HTTP2 metadata.
Image description

Cause

A possible case is there is a typo with the double quotes (") in Explore view for where the HTTP/2 Metadata options were entered.
The double quote (") character in some non-English keyboard layouts is similar, but slightly different.

Resolution

1. Go to ADMIN > Services and select a Decoder, and in the actions menu, select View > Explore.

2. Expland decoder > parsers and select config.

3. In parsers.options, check and correct the double quote (") character of HTTP2="headers=true".

   Before :

   HTTP2=”headers=true extract=all”
   

   After :

   HTTP2="headers=true extract=all"
   

4. In the left panel, right-click parsers and click Properties. In the drop-down menu, select reload and then click Send.