2014-10-01
03:43 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Problem with Shellshock-public.parser
I uploaded the Shellshock-public.parser. I see it in in Config -> Parsers tab. I do not see it in Config -> General tab, device parcers configuration. It was pushed to all my decoders. I also restarted the services on the decoders. What am I missing?
Thanks,
John
- Tags:
- Community Thread
- Discussion
- Forum Thread
- NetWitness
- NW
- NWP
- Parsers
- RSA NetWitness
- RSA NetWitness Platform
2 Replies
2014-10-05
11:17 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Check the logs to see if you had a warning/error loading the parser when you pushed it. The first version I uploaded didn't load properly because it did not have a variable declared before using it (script error). I had to add the following line right below the <declaration> section:
<number name="SS" />
Then save the .parser file and re-uploaded it then it worked.
2014-10-06
09:49 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Thanks. That worked.
