Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixes for new 7.10 rsa2elk datasets #21240

Merged
merged 2 commits into from
Sep 29, 2020
Merged

Fixes for new 7.10 rsa2elk datasets #21240

merged 2 commits into from
Sep 29, 2020

Commits on Sep 23, 2020

  1. Fix bad unicode character used in juniper/netscreen 

    Some parsers from netwitness wrongly use &#x092 XML entity as a quote
character. This entity translates to UNICODE codepoint U+0092 (PRIVATE
USE 2), which is not printable and can cause problems.

My understanding is that this is the result of either:
- Device logs are encoded in the windows-1252 codepage, or
- Log parsers originally written in windows-1252 codepage.

In this codepage, \x92 represents a quotation mark similar to the
ASCII \x27 single quotation mark (').

I believe someone misunderstood XML's &#xNNN entity as escaping a byte value,
instead of a UNICODE codepoint.

As it is unclear if the original logs contain this special quote, or it's the
result of writting the parsers in a Windows editor, it's better to replace
it's usage with empty captures that skip over this quote.
    @adriansr
    adriansr committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    6a6d089 View commit details
    Browse the repository at this point in the history

  2. Update pipelines for new 7.10 rsa2elk datasets 

    The original pipelines had been generated with some debugging comments
in them, which made them much larger than necessary.
    @adriansr
    adriansr committed Sep 23, 2020
    Configuration menu
    Copy the full SHA
    d0b5026 View commit details
    Browse the repository at this point in the history