Certain custom fields are empty or truncated although parsing rules are working

[luciangb]

Hello,

On a SIEM 11.3.2 installation, with the atest hotfix applied, for various Advanced Syslog Parser data sources - McAfee Web Gateway, McAfee NSM - certain fields - such as URL, Filename, User_Agent, Category - are either empty (not populated) or contain only the first two characters from the string which should have populated them as resulted from the parsing of the raw packet content which was received from the data source.
When checking the operation of the respective parsing rules in the Policy Editor, by entering the content of one random raw packet as sample, I may see that the parsing rules are working correctly and the assigned database fields should get populated accordingly.

I have tried applying the solutions mentioned in KB89475, KB82114, KB94565 but the behaviour has not changed.

Does anyone have any ideea what else could be tried here ?

Thank you,

Lucian

[lratcliffe · Accepted solution]

Please raise a case with Support.  These are Random String fields which means the data is stored in the StaticStrings blob of the event and/or alert table.  Either the event table on your receiver or the alert table on your ESM has become corrupted.

[luciangb]

Thank you, your reply has put me on the right track !

Best regards,

Lucian

[zeromahesh]

Hi All,

I have recorded a comprehensive demo of creating a custom parser in step by step manner. Please check below.

https://www.youtube.com/watch?v=ue545ML9U34&t=1450s

[luciangb]

Hi Zeromahesh,

Thank you for sharing this video, very instructive !

As far as the original issue in this post is concerned - the root cause was a deep corruption of the tables which needed an unconditional full rebuild - data and indexes - to be performed.

Best regards !

[zeromahesh]

HI luciangb

Thank you for your valuable feedback.