RSA Admin

ESI tool modifying existing XML file

Discussion created by RSA Admin Employee on Apr 15, 2010
Latest reply on Oct 4, 2010 by RSA Admin

I am trying to use the new ESI tool modify an existing enVision XML supported devices for ciscopix and ciscoasa devices.  More specifically message IDs ???-6-604101, ???-6-604102, ???-6-604103, ???-6-604104.  Since these messages are already parsed correctly in each XML file, albeit, very generic.  I am looking to clone and convert the existing parsing statements to be secondary :01 message.  With that my plan is to more granularly parse the DHCP event messages into better variables that contain at least the MAC and IP address information and possibly the action.


It seems using the ESI I could not copy or clone an existing message nor could I select a sample record since all messages were parsed correctly in my sample file extracted via the lsdata command.  This seemed to limit what I could do.  Am I missing something.  Right now I am editing the XML outside of ESI to clone the eventIDs and do it the old way like UDS where you pick the fields.