TLD Lua Parser Options File

Caution: RSA strongly suggests that you do not subscribe to the options file. Subsequent downloads of this file will overwrite all changes that you have made to the file.

Note the following:

  • If you deploy the options file, it can be found in the same directory as parsers: /etc/netwitness/ng/parsers/.
  • The parser is not dependent upon the options file. The parser will load and run even in the absence of the options file. The options file is only required if you need to change the default settings.
  • If you do not have an options file (or if your options file is invalid), the parser uses the default settings.

Note: The parser will never use both the defaults and customized options. If the options file exists and its contents can be loaded, then the defaults will not be used at all.

The TLD_lua_options file contains the following options for controlling the parser:

  • deduplicate

  • localDomains

To change an option from false to true, edit the line inside the corresponding function, from

return false

to

return true

And similarly to go from true to false.

Note

Modifying any of these options requires a service restart to take effect; a simple parser reload is insufficient.

deduplicate

Default value: true

By default tld, cctld, and sld, meta are only registered once per session, regardless of the number of times seen.

Disabling this option (setting to false) causes the parser to register all tld, cctld, and sld meta even if they have already been registered previously for that session.

localDomains

List of domain suffixes or TLDs specific to the internal network. Multiple values must be comma-separated, for example:

"local,here,example"

Default value: local