Caution: RSA strongly suggests that you do not subscribe to the options file. Subsequent downloads of this file will overwrite all changes that you have made to the file.
Note the following:
- If you deploy the options file, it can be found in the same directory as parsers:
/etc/netwitness/ng/parsers/. - The parser is not dependent upon the options file. The parser will load and run even in the absence of the options file. The options file is only required if you need to change the default settings.
- If you do not have an options file (or if your options file is invalid), the parser uses the default settings.
Note: The parser will never use both the defaults and customized options. If the options file exists and its contents can be loaded, then the defaults will not be used at all.
The TLD_lua_options file contains the following options for controlling the parser:
-
deduplicate
-
localDomains
To change an option from false to true, edit the line inside the corresponding function, from
return false
to
return true
And similarly to go from true to false.
| Note | Modifying any of these options requires a service restart to take effect; a simple parser reload is insufficient. |
deduplicate
Default value: true
By default tld, cctld, and sld, meta are only registered once per session, regardless of the number of times seen.
Disabling this option (setting to false) causes the parser to register all tld, cctld, and sld meta even if they have already been registered previously for that session.
localDomains
List of domain suffixes or TLDs specific to the internal network. Multiple values must be comma-separated, for example:
"local,here,example"
Default value: local
