Decoder and Log Decoder Configuration Guide - Table of Contents

[#1]

View PDF

  

• Decoder and Log Decoder Quick Setup
•  Configure Common Settings on a Decoder
  •  Configure Capture Settings
    • (Optional) Configure System-Level (BPF) Packet Filtering
    • (Optional) Configure a Decoder to Capture Data Across All Types of Network Interfaces
    • (Optional) Configure Meta-Only Decoders
    • (Optional) Configure Selective Network Data Collection
    • (Optional) Configure a Decoder to Write Standard pcap-formatted Files
    • (Optional) Multiple Adapter Packet Capture
    • (Optional) Data Plane Development Kit Packet Capture
    • Decoder: (Optional) Configure a Decoder to Capture NetFlow Data
    • (Optional) Preserve VLAN Tags When Using the Packet MMAP Capture Interface
    • (Optional) Process Raw Syslog Data without Priority Field
  • Enable and Disable Parsers and Log Parsers
  • Start and Stop Data Capture
•  Configure Decoder Rules
  • Configure Application Rules
  • Configure Correlation Rules
  • Configure Network Rules
  • Fix Rules with Invalid Syntax
  • Decoder Commands for Managing Rules
•  Configure Parsers and Feeds
  •  Configure Parsers
    • Use Custom Parsers
    • Enable and Configure the Entropy Parser
    •  Flex Parser
      • Arithmetic Functions
      • Common Parser Operations
      • General Functions
      • Logging Functions
      • Nodes
      • Payload Functions
      • Regex
      • String Functions
    • GeoIP2 Parsers
    • Lua Parsers
    • HTTP Parsers
    • Snort Parsers
    • Search Parser
    • Wireless LAN Configuration
    • Troubleshooting Parsers
  •  Configure Feeds
    • Custom Feed Definition File Structure
    • Feed Definitions File
    • Create a Custom Feed
    • Create a STIX Custom Feed
    • Create an Identity Feed
    • Upload, Edit, or Remove a Feed
    • Create Custom Meta Keys Using Custom Feed
•  Decoder and Log Decoder Additional Procedures
  • Configure 10G Capability
  • Configure a Log Decoder to Accept Protobuf
  • Configure Session Split Timeouts
  • Configure Syslog Forwarding to Destination
  • Configure Transaction Handling on a Decoder
  • Decrypt Incoming Packets
  • Edit Decoder System Configuration Settings
  • Enable CPU Usage Stats for Installed Content
  • Enable Parser Mappings
  • Enable or Disable Lua and Flex Parsing Systems
  • Map IP Address to Service Type
  • Event Time Support
  • Obtain Log Files from a Pre-11.0 Log Decoder
  • Upload a Log File to a Log Decoder
  • Upload a Packet Capture File
•  Decoder and Log Decoder References
  • Services Config View - Capture Policies Tab
  • Services Config View - Edit Policies Wizard
  • Services Config View - Data Privacy Tab
  • Services Config View - Data Retention Scheduler
  • Services Config View - Feeds Tab
  • Services Config View - Upload Feeds Dialog
  • Services Config View - Files Tab
  • Services Config View - General Tab
  • Services Config View - Parsers Tab
  • Services Config View - Parser Mappings Tab
  • Services Config View - Rules Tab
  • Services Config View - App Rules Tab
  • Services Config View - Correlation Rules Tab
  • Services Config View - Network Rules Tab
  • Services System View - Decoders