NetWitness Community

Are you asking if there is a way to truncate logs that are stored on Log Decoder at time of ingestion?

If you are asking if a meta key can hold more than 256 bytes, the answer is no, that is the hard limit.

I will add it to Decoder's Use Case backlog. Thanks for bringing this up! Scott

This capability now exists in version 11.2.To enable it, you need to tell the HTTPS parser which smtp ports to use when searching for the STARTTLS command.To do this, navigate to /decoder/parsers/config/parsers.options and add something like thisHTTP...

It's no possible to delete existing meta keys. But you can configure the Network browser so it doesn't create the ethernet source and dest meta keys going forward. This is true of any meta key you don't find useful for any parser.