Skip to content
  • There are no suggestions because the search field is empty.

Create Custom Typespec

Create Custom Typespec for ODBC CollectionCreate Custom Typespec for ODBC Collection

NetWitness uses type specification (typespec) files for ODBC and file collection. These files act on raw log files, and are used for two main purposes:

  • Define where in the log file data resides. For instance, some log files contain header information that is not considered data to be parsed.
  • Replace certain types of characters that the log parser cannot parse correctly. For instance, the tab character can sometimes cause problems.

This topic tells you how to create a custom typespec for the Log Collector. The topic includes:

  • Create Custom typespec procedure
  • ODBC Collection typespec syntax
  • Sample ODBC Collection typespec files

Create Custom TypespecCreate Custom Typespec

To create a custom typespec file:

  1. Open an SFTP client (for example, WinSCP) and connect to a Log Collector or remote Log Collector.
  2. Navigate to /etc/netwitness/ng/logcollection/content/collection/odbc, and copy an existing file, for example bit9.xml.
  3. Modify the file according to your requirements. See ODBC Collection Typespec Syntax for details.
  4. Rename and save the file to the same directory.
  5. Restart the Log Collector.

Note: You will not be able to see new Event Source type in NetWitness until you restart the Log Collector.

ODBC Collection Typespec SyntaxODBC Collection Typespec Syntax

The following table describes the typespec parameters.

Sample ODBC Collection Typespec FilesSample ODBC Collection Typespec Files

The following sample is the typespec file for the IBM ISS SiteProtector event source.

<?xml version="1.0" encoding="UTF-8"?>
<typespec>

<name>siteprotector4_x</name>
<type>odbc</type>
<prettyName>SITEPROTECTOR4_X</prettyName>
<version>1.0</version>
<author>Administrator</author>
<description>Collects events from SiteProtector</description>

<device>
<name>Internet Security Systems, Inc. RealSecure SiteProtector v 2.0</name>
<maxVersion>2.0</maxVersion>
<description></description>
<parser>iss</parser>
</device>

<configuration>
</configuration>

<collection>
<odbc>
<query>
<tag></tag>
<outputDelimiter></outputDelimiter>
<interval></interval>
<dataQuery></dataQuery>
<maxTrackingQuery></maxTrackingQuery>
<trackingColumn></trackingColumn>
<levelColumn></levelColumn>
<eventIdColumn></eventIdColumn>
<addressColumn></addressColumn>
</query>
</odbc>
</collection>
</typespec>

The following sample is the typespec file for the Bit9 Security Platform event source.

<?xml version="1.0" encoding="UTF-8"?>
<typespec>

<name>bit9</name>
<type>odbc</type>
<prettyName>BIT9</prettyName>
<version>1.0</version>
<author>Administrator</author>
<description>Bit9 Events</description>

<device>
<name>Bit9</name>
<parser>bit9</parser>
</device>

<configuration>
</configuration>

<collection>
<odbc>
<query>
<tag>BIT9</tag>
<outputDelimiter>||</outputDelimiter>
<interval>10</interval>
<dataQuery>
SELECT
Timestamp,
Event_Id,
Computer_Id,
File_Catalog_Id,
Root_File_Catalog_Id,
Priority,
Type,
Subtype,
IP_Address,
User_Name,
Process,
Description
FROM
ExEvents
WHERE
Event_Id > '%TRACKING%'
</dataQuery>
<trackingColumn>Event_Id</trackingColumn>
<maxTrackingQuery>SELECT MAX(Event_Id) from ExEvents</maxTrackingQuery>
<eventIdColumn></eventIdColumn>
</query>
</odbc>
</collection>
</typespec>