Add VARTYPE Support to CEF Parser

VARTYPE added in 11.0 and later versions provide type and pattern validation for variables. While the variables are parsed, NetWitness has added the ability to condition them to match a certain format.

CEF Parser format logs with CEF:0 and will use CEF parsers without any further identification. Some CEF sources have structured data embedded in variables. This data requires further processing. To direct parse rules scanning of the data, support for scanned variables is required for the CEF parser. Scanned variables are supported during the VARTYPE implementation.

To add VARTYPE support to CEF parser:

  1. Load VARTYPE from CEF parser (cef.xml and cef-custom.xml) successfully.

  2. Load all existing CEF parsers and parse the data successfully.

  3. Enable VARTYPE to validate the header information.

  4. Enable VARTYPE to fine parse CEF variable (MetaName).

  5. Ensure that VARTYPE is working fine with custom CEF parser.