Hi All, We are looking for a Parser for PureStorage in netwitness 11.2
currently all the logs sent from pure storage is been parsed under
ciscorouter or let me know is there any document/guide on how to use the
log parser which is a feature in 11.2 ?
Hi All, Please let us know the process to create a direct INC with the
logs from Event View (New Tab) in Netwitness 11.1, In the Old View its
straight forward but in this view i tried multiple options but no luck.
It seems to be a bug for me, If yes ...
Hi All, Kindly let us know if there is any solution for Virtual Log
Collector (VLC) will be in a red status in Netwitness Ver:-11.1.0.1, I
tried to fix this issue using the following KB but no luck :- 000029444
- Unable to configure a Virtual Log Col...
Hi All, We are currently exploring the new option in Event source --->
Log Parser in Netwitness 11.1.0.1, Can any one provide us more details
on the usage, there is no related doc available. We are trying to
streamline all the events source and get t...
Hi All,We are trying to enabled the default rule 'Suspicious Activity
Detected: Reconnaissance" which is under the "Incident Rule" in
Netwitness version 11.0, But since we are getting the below error in the
linked ESA rules ("Port Scan Horizontal Pac...
Hi Eric, Below is the raw logs from Netwitness for PureStorage version
:- 5.1.6 Dec 20 07:35:02 00W222-rty-ct1 purity.audit: (login message ID:
11190288) Array name: '00W222-rty' Controller: 1 Interface: 'GUI'
Module: '' Session: 'a96718a0-e5bc-4d3b-...
Thanks for the response, Hope this is fixed as soon as possible. Also
please let me know if this is the right place for this Discussion hence
am observing few other missing options which need to reported/fixed in
NEW 11.1 ?
Hi Anurag, This is the process to create an INC from the old view of
events viewer which we are already using, but my query is for the new
view of the event viewer.
As per the comments from Kevin we have deployed the default parser and
the "Rule" tab under Log Parser rule got populated, now let us know the
next process how to extract the logs which is currently parsing under
"unknown " and then do the parsing to...
