Decoder: Fix Rules with Invalid Syntax

Document created by RSA Information Design and Development on Sep 13, 2017Last modified by RSA Information Design and Development on Oct 11, 2017
Version 6Show Document
  • View in full screen mode
 

After an update to NetWitness Suite 11.0, the user interface highlights any rules with invalid syntax. The Rule Editor provides additional tooltips. After you fix the rules, the highlights disappear. Configure Decoder Rules provides guidelines that all queries and rule conditions in NetWitness Suite must follow.

To correct rules with invalid syntax:

  1. Go to ADMIN > Services.
  2. In the Services view, select a Decoder and Actions menu cropped > View > Config.
  3. In the Services Config view, select one of the Rules tabs: Network Rules, App Rules, or Correlation Rules.
    The Rules tab for the selected rule type shows the number of rules using invalid syntax and the invalid rules are highlighted.


  4. Select an invalid rule and click The edit icon.
    The Rules Editor shows additional information for the invalid rule and it includes an additional Save option.
    This is an example of the Rule Editor dialog for an invalid rule.
  5. In the Condition field, correct the rule syntax.
    All string literals and time stamps must be quoted. Do not quote number values and IP addresses. Configure Decoder Rules provides additional details.
    For example, if the invalid rule condition is ip.src="10.30.30.30", correct the syntax by removing the quotes: ip.src=10.30.30.30
  6. Do one of the following:
    • To correct the rule individually, click Save.
      The corrected rule is applied independently to the Decoder. The corrected rule appears on the Rules tab without highlights. 
    • To correct the rule and apply the rule to the Decoder later with other rules, click OK.
      The corrected rule appears on the Rules tab without highlights. The rule is not applied to the Decoder.
You are here
Table of Contents > Configure Decoder Rules > Fix Rules with Invalid Syntax

Attachments

    Outcomes