Decoder: Search Parser

Document created by RSA Information Design and Development on Sep 13, 2017Last modified by RSA Information Design and Development on Oct 11, 2017
Version 6Show Document
  • View in full screen mode
 

This topic explains how to configure a custom parser used on a Decoder to generate metadata by scanning for pre‐defined keywords and regular expressions in the Services Config view > Files tab.

One of the files available for editing in the Services Config view > Files tab is search.ini, the search parser.

search.ini

The Search Parser is a custom parser used to generate metadata by scanning for pre‐defined keywords and regular expressions. The parser searches the payload of a reconstructed session for string matches and can execute a regular expression search. You can configure the parser by editing the search.ini file. 

Caution: The search parser can have a significant impact on system performance. It is important that both the search mechanism and the data to which it is applied to be well understood before creating new search definitions and enabling the search parser.

The search definition is used across all protocols. There are three basic search methods:

  • Keyword: Search a stream for a specific set of words
  • Pattern: Search a stream for a regular expression match
  • Keyword + Pattern: Search a stream for a regular expression if it contains any of a given set of keywords.

For a detailed explanation, see Search Parser in the search.ini Search String Syntax.

Previous Topic:Lua Parsers
You are here
Table of Contents > Feed and Parser References > Search Parser

Attachments

    Outcomes