Your parser seems fine to me. From a quick test it created meta as
expected. After uploading or modifying it, make sure to reload parsers.
You can do that from NwConsole: /> /decoder/parsers reload Or from the
explore view of the decoder service: 1) ...
Define the departments in a table: local known_prefixes = { ["IT"] =
"IT", ["FIN"] = "Finance", ...} Extract and lookup department from meta:
function deptParser:onHostMeta(idx, host_meta) local this_prefix =
string.match(host_meta, "^([^%-]+)%-") if...
There's a couple standard parsers that come close to what you want, but
not exactly. The phishing_lua parser will register the host portion of
links found in email messages - including img src. Optionally it will
also register the path components (di...
To see log messages at debug level, you'll need to enable debug level
logging. Debug logs are very verbose, not something you'd want to leave
enabled all the time. In the Explore view of Decoder, navigate to
/logs/config. In the entry for "Log Levels...
