Problem with Shellshock-public.parser
I uploaded the Shellshock-public.parser. I see it in in Config -> Parsers tab. I do not see it in Config -> General tab, device parcers configuration. It was pushed to all my decoders. I also restarted the services on the decoders. What am I missing?
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
Check the logs to see if you had a warning/error loading the parser when you pushed it. The first version I uploaded didn't load properly because it did not have a variable declared before using it (script error). I had to add the following line right below the <declaration> section:
<number name="SS" />
Then save the .parser file and re-uploaded it then it worked.