How create a custom feed with "device.ip" (MetaCallback)
Sorry if this question has been asked but i do not find the solution....
I try to create a feed with CIDR type index column and the "device ip" on meta callback. But she does not work.
My custom meta work with another feed. But Only meta "ip.src" or "ip.dst" is considerate for the indexation with a feed on CIDR. I read in forum or RSA documentation that custom xml with "metacallback" attribut allows to select another meta for indexing, but I can't ...
May be is my xml file or a bad practice ? I try 2 xml with <MetaCallback> but nothing. What do you think, Can you help me please ?
- My meta is in "index-concentrator-cutom"
- My XML and my CSV File :
or i try like that :
- My CSV :
- I have restart the nwconcentrator service but nothing :
- Community Thread
- Custom Feed
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
thanks for your help. I don't have this attribut in "parsers\config" but it is in "parsers\feeds\feedsname".
Effectively, I can't change this value but I see "device.ip" in "feed.callbacks" attribut. So I imagine my xml is correctly writte ?
But curiously, I see the "feed.entries" and "feed.values" equal 0 ?? my CSV is not read ???
When i try to create the same feeds with the same csv and xml file but without metacallback parameter , she's working with "ip.src" or" ip.dst" and i see the number of "feed.entries" ??
I can't change the "feed.callbacks" attribut for cheat ???
I don't have more idea
My understanding is that cidr notation would only work against ip.src and ip.dst. Therefore, it would not work against the device.ip meta key.
Device.ip is generally specific to the event source for logs, but if you were trying to categorize them based on the logging source (device.ip) you would need to expand out the cidr block into individual ip's. Not ideal, but it can be worked around with some python.
Using your csv as a starting point, we convert the cidr blocks into individual IP's along with the meta for that enrichment column.
python litecidr.py [input_file] [output_file]
The script is as follows:
from netaddr import IPNetwork
# Read in file
for line in file:
for ip in IPNetwork(tmpline):
#print('%s' % ip + "," + tmpline)
tmpout='%s' % ip + "," + tmpline
I hope you find this useful.
I had a same question before, I achieved it successfully through custom feed with Non-IP data where you can choose call back keys.
I think it will work in V10.5.
Thank you very much for your help and your script I thought of create my feeds on simply ip. It's a good solution for a little feeds but I have much more IPs (internal IPs) I'm afraid it takes a lot of ressources, no ?!? May be create filters for each rules but the request will be great for informations My CIDRs :
Thank for your help me too, I'm in V10.5. Ok I will test this solution. On Non-IP Data your CSV still contains CIDR column like my file ?
I’m using a individual IP addresses & not an subnet. I’m sure that works well.
Thanks & Regards,
ASOC – Supervalu | Verizon Enterprise Solutions
Tel: +1 703-886-3853 | Mob: +1 703-554-4493
I think the issue has been resolved in RSA SA 10.6 as the screenshot shared by Mr. Abhishek Agarwal is of SA 10.6
You can change the desired meta callback accoding to feed in that.