Build Your Own Integration

This document will serve to aggregate useful how-to information for "Do-It-Yourself" creation of parsers and integrations for RSA NetWitness Platform. Please follow the page for updates using the Actions menu above as we will be adding more content frequently. Also, please feel free to add comments below or click the Send Feedback button to provide feedback, request new content or to let us know about any new posts which would be useful to reference here.

Parsers, Plugins and Custom Log Collection

Resource: Using Parse Rules (Overview)
Description: A primer on the new parse rules capabilities added in v11.2

Resource: Log Parser (Parse Rules) Customization for 11.2+
Description: In-depth documentation for using parse rules in 11.2+

Resource: Customizing OOTB XML Parsers (10.6.5+)
Description: How to customize RSA-supported XML parsers while still preserving future updates from RSA Live (as of 10.6.5+)

Resource: Customizing the CEF Parser
Description: How to customize the RSA-supported parser for CEF-formatted logs

Resource: JSON Development Guide
Description: Collecting JSON logs via file collection method (available as of 11.3)

Resource: Custom (File Collection) Typespec
Description: Detailed instructions and specifications for creating a typespec to transform file-based log sources for proper parsing.

Resource: Custom File and ODBC Typespec Demo Video
Description: Walkthrough video on creating your own typespec for collecting file and ODBC log sources. NOTE: This video is a bit old, but still gives a good demonstration of how the process works.

Resource: Log Parser Tool Downloads
Description: Download the free tool for creating full XML parsers for your custom event sources

Resource: Log Parser Tool v1.1 User Guide
Description: Instructional guide on XML log parser structure, syntax and how to use the Log Parser Tool

Resource: Event Time Function Usage
Description: Using the Event Time function within an XML parser to parse different date formats into TimeT type.

Resource: A Treatise on Writing Packet Parsers for the RSA NetWitness Platform
Description: The definitive guide for writing Lua parsers for the RSA NetWitness Platform.

Resource: RSA Training: Lua Parsers for Logs
Description: Lua parsers aren't just for packets. Take in-depth training from RSA on how to leverage Lua to solve challenging log parsing problems.

Resource: Plugins Development Guide
Description: Detailed instructions and specifications for creating a Plugin to collect and transform cloud-based, API-accessible log sources for proper parsing.

Managing Meta

Resource: Custom Table-Map Maintenance
Description: Instructions on properly configuring the custom table map to manage keys populated by log parsers. NOTE: The index-concentrator-custom.xml files will sometimes also need to be modified to achieve indexing and full searchability of meta keys.

Resource: Core Database Tuning Guide: Index Customization
Description: Official documentation on maintaining index configuration for meta keys.

Resource: Maintaining Table Map and Service Index files
Description: An excellent post that further explains the relationship between table map and index.

Resource: Validate your custom index files with xmllint
Description: Some good tips on validating your XML configuration files before deployment.

RSA NetWitness Platform Open API

Resource: Official List of API Guides including the CLI tool (NwConsole)
Description: Official Table of Contents with reference to several versions of the API, including the REST API and the CLI tool (NwConsole).

Resource: REST API: Access in NetWitness
Description: Enabling the REST API in NetWitness

Resource: RSA NWUC 2012 - No Rest for the Weary
Description: An older, but still relevant intro presentation into the REST API

Resource: CLI: RSA Security Analytics Console
Description: Official 10.6 guides for using the CLI tool (NwConsole)

Resource: GitHub - netwitness/ng-rest-client
Description: This is a sample python app that demonstrates how to use the RESTful API on NetWitness Core Services. For a background on how this tool came to be (and some useful explanations of the API functions), see this post: NetWitness NextGen RESTful Python Test App

You can also leave feedback in the comments below. Help us enable you to find creative solutions to your integration goals!