Is there any place or article that I can find the RSA content roadmap?
I am looking for the roadmap for parser updates and new device support. This used to be released quarterly (can't recall if this was actually been sent to customers).
Why are these not already on LINK?
On another note, old enVision configuration documents were updated when there was a change in the parser (see example in attach). Currently when there is a parser update, there is no way to track the changes.
While I understand that the effort require to update individual documents with 1 line, I would suggest that you at least release 1 document with all the changes per Event Source Update round.
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
Sorry for the delay in my response.
The content team has been busy improving the design of existing parsers to improve the overall quality and reduce unknown messages and defects. The focus has been to reduce the overall Time to Resolution and we have brought it down to under 2 Week for Unknown Messages and Defects. We are focusing on updating the top 50 Event sources in Q3/Q4 this year. We have added support for Git Enterprise last month and currently working on multiple Cloud integrations (Office 365, Azure). Please continue to put in a request for new sources and updates in Jira as that will help us evaluate the demand to prioritize them. I'd encourage you to use the ESI Tool Beta3 to develop new log parsers on your own.
Change Tracking: We have moved away from a monthly content update to a daily content update. Our Parsers are updated on a daily basis and adding a release note in the configuration document is not feasible anymore. We are working on a "Log Parser Diff Tool" that can be used to differentiate any 2 parser XML. It will provide details of all Headers/Message Addition/Updates/Removal.
Thanks for the information. I have seen that the content are now been updated on Live on a daily basis and sometimes more than once a day which is great.
My request was more about the unsupported devices currently on the roadmap. You mentioned Office 365, Azure which is great, but why should customers not know about this and waste their time raising more tickets, just so they are told that this is in the roadmap?
I would understand If log samples are needed from customers but if its purely to assess the demand, then some kind of voting mechanism for new devices on LINK would be faster and customers can see what's planned.
I agree and like your idea about a voting mechanism to help us prioritize. The Jira requests serve multiple purposes: Sample Logs, Product Version details, Use-Cases. Every Customer is different and may want different things from an integration. So we definitely need a formal ticket for unsupported event sources. Now, we can share a tentative Roadmap of whats coming in the near future. Last few quarters we have been focused on improving the overall quality of our supported event sources and the parser design and havent had any bandwidth to add new sources. We have a an extremely large backlog for unsupported sources and its not realistic to support all of them. We recommend using the ESI Tool and sharing parsers in the community. I'll work with the team to share a near-term integration road-map and will work on the Voting idea.Thanks for the Feedback, please send me an email, if you have any other feedback.