A place to upload parsed events?

[SeanKoniarz]

This is targeted more towards anyone working at RSA/EMC. 

For some reason in my free time I like to parse log events that are not currently being parsed by RSA parsers, I am weird but at work I do this. Some events are just one or two here and there but I just realized today that I have 21 events from junipersslvpn that were not being parsed but I parsed.  Some I would say are more important for anyone to have such as, user x logged in using policy x from x ip. 

So the short of it, is there anywhere I can submit these for additions to the parsing files, figured it would help out everyone if this was possible. 

Thanks!

[JohnDoe1]

A place like github to maintain parser would be great!

[jeffshurtliff]

Hi Sean Koniarz​ and John Doe​,

I will bring up this suggestion to our Product Management team, but I would recommend in the meantime posting your parsers to the Security Analytics" data-type="space​ space within RSA Link.  This will allow others to comment on them and quickly find them, and will allow you (the creator of the parsers) to easily maintain them when any updated versions are created.

Some examples of other parsers posted to the community are listed below.

• : My First LUA Parser - converts LDAP://ou=blah,cn=blah,ou=blah blah/username into username - Useful...
• My Second LUA Parser - Writes Attachment Meta into Filename Meta
• A Lua Parser to Merge Meta​
• Lua Parser for NTLM over HTTP
• Security Analytics Log Parser 2.1.63.zip 

To upload a parser, you can either click on Actions > Files (as shown below) or you can create a document and attach the parser to it by clicking Actions > Document from the Security Analytics" data-type="space​ overview page.

Thanks.

Jeff Shurtliff,CISSP

Sr Social Engagement Manager

RSA, The Security Division of EMC

[AlexeyFedorov]

Hello Jeff,

I guess repository is will more suitable for this task. In RSA you use CMS and CMS for custom parsers is more better than community. And please improve Kaspersky parser. I have a lot of unknown events from Kaspersky version 10. For russian customers is important event source.

[GuyWilliams]

Hi Sean,

Thanks a lot!

The official way would be to open a case with Support and ask them to create a content ticket.  We'll need sample logs to go along with the parser.

Thanks,

Guy

Guy Williams | Principal Product Manager, RSA Security Analytics

RSA, The Security Division of EMC

[GuyWilliams]

Hi Alex,

If you export the logs in question you can open a Support ticket and ask to have support for them added to the parser.

Thanks,

Guy

Guy Williams | Principal Product Manager, RSA Security Analytics

RSA, The Security Division of EMC

[AlexeyFedorov]

I done it many times. I can provide you case numbers and SMC if you want. Those cases was opened after date of release last version of Kaspersky on RSA Live (2015-04-15). At this time I can't have access to Kaspersky logs on English, only on Russian. But I can say that the parser don't parse events of uninstall programs (events of installed programs parsing well).

[GuyWilliams]

Hi Alexey,

I'll send a direct message and see if we can get some movement for you.

Thanks,

Guy

Guy Williams | Principal Product Manager, RSA Security Analytics

RSA, The Security Division of EMC