NetWitness 11.7.x and 12.x doesn't display HTTP2 metadata after add HTTP2 parsers options

Issue

NetWitness provides metadata items derived from headers in the HTTP/2 stream after append HTTP2="headers=true" (or HTTP2="headers=true extract=all" in 12.x version) to /decoder/parsers/config/parsers.options.

But some users can't see the metadata (for example: action, alert, alias.host, directory, referer) from HTTP2 sessions after configure the parser options.
 

Below image is the example which doesn't have HTTP2 metadata.


Below  image is the example which have HTTP2 metadata.

Cause

A possible case is there is a typo with the double quotes (") in Explore view for where the HTTP/2 Metadata options were entered.
The double quote (") character in some non-English keyboard layouts is similar, but slightly different.

Resolution

1. Go to ADMIN > Services and select a Decoder, and in the actions menu, select View > Explore.

2. Expland decoder > parsers and select config.

3. In parsers.options, check and correct the double quote (") character of HTTP2="headers=true".

   Before :
   HTTP2= ”headers=true extract=all ”
   
   After :
   HTTP2= "headers=true extract=all "
   

4. In the left panel, right-click parsers and click Properties. In the drop-down menu, select reload and then click Send.

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: NetWitness Respond
RSA Version/Condition: 11.7, 12.x
Platform: CentOS
O/S Version: 7

Summary

NetWitness doesn't display HTTP2 metas after add HTTP2 parsers option

Approval Reviewer Queue

Technical approval queue