Important statement from RSA regarding network Flex parsers in the RSA NetWitness Platform

[#1]

Summary:

The network Flex parsers were deprecated in July 2017.  This advisory is to inform that these parsers have now been removed from RSA NetWitness Live and are no longer accessible to download.

Affected Products:

This advisory applies to any customer using RSA NetWitness Live and Flex parsers. A Flex parser is any parser written in flex that has a .flex extension. These parsers would be stored on the decoder within the /etc/netwitness/ng/parsers/ directory.

Impact:

Flex parsers previously downloaded and deployed to Decoders will remain untouched. However, they will no longer be available to deploy to Decoders through RSA NetWitness Live.

Workaround:

If you’re currently using the discontinued Flex parsers and want to use the actively maintained Lua parsers instead, then refer to the documentation Mapping of Flex to Lua Parsers. Download and deploy the corresponding Lua parser and disable the Flex parser.  It’s possible that you may need to update custom rules as a result the change due to differences in meta output by the Lua parser. See the description of the meta output by the Lua parser within the RSA NetWitness Live description of the parser.

For additional documentation, downloads, and more, visit the RSA NetWitness Platform page on RSA Link.

EOPS Policy:

RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.