Decoder: Map IP Address to Service Type

Document created by RSA Information Design and Development on Sep 13, 2017Last modified by RSA Information Design and Development on Oct 11, 2017
Version 6Show Document
  • View in full screen mode
 

This topic describes the procedure to map an IP address to a service type for log parsing.

The Log Collector discovers event source type on a per-message basis. If the correct parser is not used for the specific event source, the messages that are common between event source types are misclassified. The misidentified messages will not populate service rules and alerts, and the reports will not have proper information. Also, if there are multiple services associated with an IP address, it can be difficult for the parsers to identify the exact service from which the log is generated. 

If you map an IP address to its services, the log decoder can identify the service from which the log is generated. When messages come into the log decoder from a mapped service, the assigned parsers are loaded to find event matches. 

You can assign service types to IPV4, IPV6 or hostname value of the event source. You can also assign multiple service types to a single IP address. You can also use the CollectorID when different service types with the same IP address are sent to different collectors.

Map an IP Address to a Service Type

To map an IP address to a service type, do the following:

  1. Go to ADMIN > Services.
  2. In the Services view, select a Log Decoder, and in the Actions column, select Actions menu  > View > Explore.
  3. Go to /decoder/parsers node, right-click parsers, and select Properties.
  4. In the Properties view, specify the ipdevice command with the following parameters:
    op=add/remove entries="ipaddress=service” (for example, op=add entries="10.100.201.300=ciscoasa")
  5. Click Send.
    This is an example of what you should see now.

IPdevice Command

In the ipdevice command, three operations are available:

  • add: This operation adds or updates entries in the ipdevice map. Multiple space delimited address/type pairs may be specified.
    op=add entries="<address>=<service type>"
  •  remove: This operation removes entries from the ipdevice map. Multiple space delimited address/type pairs may be specified.
    op=remove entries="<address>"
  • describe: This operation returns the values currently in the ipdevice map.

Map an IP Address to a Time Zone

Often times logs do not fully specify timestamps and may be missing time zone information. To properly normalize such timestamps to UTC, the Log Decoder provides the ability to associate devices from a specific address (IPv4 or IPv6) or hostname to a time zone or a fixed offset.

Three time zone formats are currently accepted and are shown in the following examples:

  • Olson format: America/Anguilla
  • POSIX format: AST2:45ADT0:45,M4.1.6/1:45,M10.5.6/2:45
  • Offset by Hours format: = -500

NetWitness Suite maps the device address (IPv4 or IPv6) or hostname to a specific time zone or offset. Event time meta that is parsed from a log that is from a mapped address and does not include an offset or time zone as part of the timestamp is adjusted to UTC according to the mapping.

To map an IP address to a time zone, do the following:

  1. Go to ADMIN > Services.
  2. In the Services view, select a Log Decoder, and in the Actions column, select Actions menu > View > Explore.
  3. Go to /decoder/parsers node, right click Parsers, and select Properties.
  4. In the Properties view, specify the iptmzone command with the following parameters:
    op=add entries="ipaddress=timezone" (for example, op=add entries="10.10.10.10=Africa/Addis Ababa")
  5. Click Send.

iptmzone Command

In the iptmzone command, three operations are available:

  • add: This operation adds or updates entries in the iptmzone map. Multiple space delimited address/type pairs may be specified.
    op=add entries="<address>=<time zone>"
  • remove: This operation removes entries in the iptmzone map. Multiple space delimited address/type pairs may be specified.
    op=remove entries="<address>"
  • describe: This operation returns the values currently in the iptmzone map.

Examples

The following examples provide instances fro mapping IP addresses to time zones:

  • If you want to map two different entries with different IPV4 values and time zone, enter the following parameter in the iptmzone command and click Send
    "op=add entries=”10.10.10.10=America/Anguilla 10.10.10.11=Pacific/Rarotonga”
  • If you want to remove an entry for a single IPV4 value and time zone, enter the following parameter in the iptmzone command and click Send.

"op=remove entries=10.5.245.9"

  • If you want to create a single entry for an IPV6 value and time zone, enter the following parameter in the iptmzone command and click Send.

op=add entries=”2001:DB8:85A3::8A2E:370:7334=America/Anguilla”

  • If you want to create a single entry to map an IPV4, IPV6, or hostname with the Minute Offset, Olson, or POSIX format,enter the following parameter in the iptmzone command and click Send.

op=add entries="10.168.0.2=America/Anguilla 2001:DB8:85A3::8A2E:370:7334=0500nwappliance21=EST5EDT,M3.2.0/2,M11.1.0"

You are here
Table of Contents > Decoder and Log Decoder Additional Procedures > Map IP Address to Service Type

Attachments

    Outcomes