AnsweredAssumed Answered

Exporting parsers to edit with ESI?

Question asked by Craig Cameron-Weir on Oct 17, 2016
Latest reply on Oct 19, 2016 by Andreas Funk

Can this be done? I'd like to modify the Live parser for a specific device type (varonisprobe) to include additional meta (specifically a rule name). I've downloaded the varonisprobe.netwitness file from Live, but when I try and import it into ESI, there are no defined headers or messages visible in the tool.

 

I could create a whole new parser from scratch, but that seems pretty stupid if all I need is a small modification.

Outcomes