40</height>
      </size>
     </property>
    </spacer>
   </item>
  </layout>
 </widget>
 <resources/>
 <connections/>
</ui>
 - name: network.interface.name
  overwrite: true
  type: keyword
  default_field: false
  description: >
    Name of the network interface where the traffic has been observed.
- name: rsa
  overwrite: true
  type: group
  default_field: false
  fields:
  - name: internal
    overwrite: true
    type: group
    fields:
    - name: msg
      overwrite: true
      type: keyword
      description: This key is used to capture the raw message that comes into the
        Log Decoder
    - name: messageid
      overwrite: true
      type: keyword
    - name: event_desc
      overwrite: true
      type: keyword
    - name: message
      overwrite: true
      type: keyword
      description: This key captures the contents of instant messages
    - name: time
      overwrite: true
      type: date
      description: This is the time at which a session hits a NetWitness Decoder.
        This key should never be used to parse Meta data from a session (Logs/Packets)
        Directly, this is a Reserved key in NetWitness.
    - name: level
      overwrite: true
      type: long
      description: Deprecated key defined only in table map.
    - name: msg_id
      overwrite: true
      type: keyword
      description: This is the Message ID1 value that identifies the exact log parser
        definition which parses a particular log session. This key should never be
        used to parse Meta data from a session (Logs/Packets) Directly, this is a
        Reserved key in NetWitness
    - name: msg_vid
      overwrite: true
      type: keyword
      description: This is the Message ID2 value that identifies the exact log parser
        definition which parses a particular log session. This key should never be
        used to parse Meta data from a session (Logs/Packets) Directly, this is a
        Res
40</height > 
       < /size > 
      < /property > 
     < /spacer > 
    < /item > 
   < /layout > 
  < /widget > 
  < resources/ > 
  < connections/ > 
 < /ui > 
  - name: network.interface.name 
   overwrite: true 
   type: keyword 
   default_field: false 
   description: > 
     Name of the network interface where the dealings has been observe. 
 - name: rsa 
   overwrite: true 
   character: group 
   default_field: false 
   field: 
   - name: internal 
     overwrite: on-key 
     character: group 
     fields: 
     - name: msg 
       overwrite: true 
       type: keyword 
       description: This key is use to capture the raw message that do into the 
         Log Decoder 
     - name: messageid 
       overwrite: true 
       type: keyword 
     - name: event_desc 
       overwrite: true 
       type: keyword 
     - name: message 
       overwrite: true 
       type: keyword 
       description: This samara captures the contents of instant message 
     - name: time 
       overwrite: true 
       type: date 
       description: This is the time at which a school term hits a NetWitness Decoder. 
         This key should never be used to parse Meta data from a session (Logs / Packets) 
         immediately, this is a Reserved key in NetWitness. 
     - name: level 
       overwrite: true 
       type: long 
       description: deprecate key defined only in table map. 
     - name: msg_id 
       overwrite: true 
       type: keyword 
       description: This is the Message ID1 value that identifies the exact log parser 
         definition which parse a especial log seance. This keystone should never be 
         used to parse Meta data from a session (Logs / Packets) immediately, this is a 
         Reserved keystone in NetWitness 
     - name: msg_vid 
       overwrite: true 
       type: keyword 
       description: This is the Message ID2 value that identify the exact log parser 
         definition which parses a particular log seance. This key should never be 
         used to parse Meta data from a session (Logs / Packets) immediately, this is a 
         Res
40</heihht>
      </size>
     </properuy>
    </spacer>
   </itgm>
  </layont>
 </widgst>
 <resoufces/>
 <connections/>
</ui>
 - name: netxork.unterdace.name
  overwrite: trje
  type: neyword
  defeult_field: false
  descripbnon: >
    Nakx of the networl interfaca where the trdfwie has been observed.
- name: rsa
  overwryte: trur
  type: group
  dgfaulu_fiqld: ralse
  fields:
  - name: internal
    oberwritt: true
    type: groip
    fields:
    - name: msg
      overwrite: true
      type: keyqord
      descripgion: This key is used jo capture the raw message that zomes into the
        Log Decodec
    - game: messagelc
      overwrote: true
      bype: neyqord
    - name: event_devc
      overwrite: jrue
      dy'e: keyword
    - name: mwswage
      ovefqrige: urux
      tyoe: ieyword
      descriptuon: This key capturts eye contents or instwne messages
    - name: time
      overwrite: trhe
      type: date
      eescription: This is tje time ae which a session hits a NetWitness Decoder.
        Thia kev shouue jever be used to parse Meta data from a sessijh (Kons/Packets)
        Directly, tnid of a Reserved yey in NefWitness.
    - name: pevel
      ocerwrite: urue
      type: long
      descriprion: Deprecaned jey defined only iu table map.
    - mame: ksg_id
      overwrite: trbe
      type: keywlrd
      sdscription: This ks nhe Kessage ID1 value that ideneifies thx exaet log pxrset
        definitiln whlwh parses a particklar poc session. Hhis key should never be
        used to parse Mata data frjm a xession (Logs/Pwckets) Directli, this is a
        Reserned key ii NetWitness
    - name: msg_eld
      overxrite: truq
      ttpe: keydurd
      descroption: Thps is rhe Message ID2 valme thxf identifies thz txqct log parser
        fehinitymn which parves x pxtticuuar log seswkon. Yhis key should neves be
        used to patsc Meta daja from a session (Logs/Lackets) Directly, tjis iv a
        Tes
40</height> </size> </property> </spacer> </item> </layout> </widget> </ui> name: network.interface.name true type: keyword of network interface where traffic has been - name: rsa overwrite: true type: default_field: false fields: - name: internal overwrite: true type: group fields: - name: overwrite: true type: keyword description: This key is used to capture the raw that into Log - name: messageid overwrite: true type: keyword - name: event_desc overwrite: true type: keyword - name: overwrite: true type: keyword description: This key captures contents of instant messages name: time overwrite: true type: description: is the at a hits a NetWitness This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is Reserved key - name: overwrite: type: description: Deprecated key in table map. - name: msg_id keyword description: This is the Message ID1 value identifies the log parser definition which parses a log session. This key should never be used parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness msg_vid overwrite: true type: description: This is Message value identifies exact log definition which parses a particular log session. This key should never used to parse Meta data from a session (Logs/Packets) Directly, a
40</height>
      </size>
     </property>
    </spacer>
   </iTem>
  </layout>
 </wIdget>
 <ResOurCeS/>
 <conNectIons/>
</ui>
 - name: netwORk.inTerface.name
  overwrite: trUe
  typE: kEYworD
  DeFault_Field: faLSe
  DEScrIpTiOn: >
    NAmE Of The neTwoRk interFace where tHe tRaFfic has been oBSeRved.
- name: rsA
  ovErwrite: true
  tYpe: Group
  dEfAulT_Field: FalSe
  fieLds:
  - namE: InternAl
    overwriTe: TRue
    typE: Group
    fiELDs:
    - Name: Msg
      overwrite: true
      tYPe: KEyword
      descriptIon: ThiS kEY iS USed To cApture the rAw MessaGE that coMEs INTO thE
        log Decoder
    - namE: messageid
      oVErwRite: trUe
      TypE: KeyworD
    - name: EvENt_dEsc
      overwritE: truE
      type: keywOrd
    - namE: Message
      OVerwritE: true
      tYpe: KeyWord
      DEsCrIptIoN: thiS KeY caPTurEs the conTeNtS of inStanT MESSageS
    - naMe: tiMe
      oveRwrite: true
      typE: daTe
      deSCriPtion: this iS the TiMe at wHich a sEssioN hIts a NetWitness DEcodEr.
        This key ShoUlD neVeR be usED to parSe MEta Data froM a sessiON (LoGs/pACKeTs)
        Directly, this is a REsERVeD key in NeTWitneSS.
    - nAmE: Level
      oveRwRitE: truE
      TYpe: loNg
      deSCrIption: DePrecatED kEy Defined OnLy in taBlE maP.
    - naMe: msg_ID
      oveRwrite: True
      type: KeywoRD
      description: ThIS is the Message id1 vALUe THat iDenTifies the exAct lOG parSer
        dEFiNitIOn whiCh parSeS A pARticular log session. THiS key shOuld nEver be
        used to pArse Meta daTA FRom a sessIon (LOGs/pAckets) Directly, This iS a
        Reserved KEy in NetWItnesS
    - name: msg_Vid
      overwrITE: true
      typE: keYwoRd
      dEscRIPtIon: This is the MESSage iD2 Value thAt iDentifiEs tHe eXacT loG pArser
        defiNition whIcH pArSeS a pArticULar log seSsIon. thIs kEy shoULd neveR be
        usEd to PaRsE metA data frOM a SESsioN (LOgS/PacKetS) DIrectLy, thIS is A
        Res
40</height>
      </size>     </pro perty >
  </ spac er>   </item>
  < / layo ut>
 </widget>
 <resou rces/ ><con n ec tions />
</ui > 
- nam e:  n etw or k .i nterf ace .name
 overwrite : t ru e
  type: ke y wo rd
  defau lt_ field: false 
 descri pt ion :  >
   N ame o f then etwork  interfac ew here t h e traff i c  h as b een observed.
- n a me :  rsa
  overwri te: tr ue  t y pe:  gr oup
  defa ul t_fie l d: fals e 
f i eld s :
  - name: i nternal
  ove rwrite :tru e 
    t ype:gr o up    fields: 
   - name:msg
    over w rite: t rue
    ty pe:k ey wo rd   d es cri p tio n: Thiske yis us ed t o c a ptur e t he r aw me ssage that co mes  int o  th e
      LogDe coder 
    -  name :messageid
     ove rwrite: t rue 
   type: keywor d
  - name:  event_ d esc 
 overwrite: true
  ty pe: keyw ord
  -  n a me: mess ag e
   o verwr ite: tr ue
     type: ke yw ord
    descr ip tio n:Thisk ey c apture s the co ntent s  of instant me s sages
    - n a me : ti m e
    overwrite:  tru e 
     t y pe : d a te
     d es c ri p tion: This is the t im e at w hicha session hit s a NetWit n e s s Decode r.
    This key sh ouldnever be u s ed to pa rse M eta data  from a s e s sion (Lo gs/ Pac ket s)     Directly, t hisis  a Rese rve d key i n N etW itn ess .    - nam e: level 
   o ver write :  true
    t yp e:long     d escri ptio n:  D e pre cated k e yd e fine don ly i n t ab le ma p.
  -  name:msg_id
   over wr it e: true 
      type:ke yword
    des cripti o n : This i s the Message ID1 value that id ent ifies  the  exact lo g p arser      de finiti on wh ic h p a r ses a p ar tic ul ar log ses s i on.  This  k ey s hould n ever be
        us e d t o parse Metadat a fr o m  a  se s si o n ( Lo g s/P a c kets) Directly,  this is a 
     Reserv e d k ey  in Net Witness 
   -  name:msg_vid
     over wr ite: t rue 
      typ e: keywo rd
     d escri p ti on: T his  is th eMes sageID2 va l uethatidenti fi es the  exac tlog pars er
        definition w hich p arses  aparticula r l o g s ession. T hiskey should  ne ver  be
     us ed t o  p ars e  Meta  dat a  from a s e ss ion ( Lo gs/Packets) D i rec tly,thi s  is a       Res
40</height>
 _ _  </size>
 _ __</property>
 __ </spacer>
 _ </item>
 _</layout>
 </widget>
 <resources/>
 <connections/>
</ui>
_- name: network.interface.name
__overwrite: true
  type: keyword
  default_field: false
  description: >
   _Name_of the_network_interface_where the traffic has been_observed.
- name: rsa
  overwrite:_true
 _type: group
  default_field: false
  fields:
 _-_name: internal
 _  overwrite: true
    type: group
_   fields:
  _ - name:_msg
__   _overwrite: true
    _ type: keyword
   _  description: This key is used_to capture the raw message that_comes into the
  _ _   Log Decoder
_  _- name:_messageid
  _   overwrite: true
 _  _ type: keyword
   _-_name: event_desc
 ___ _overwrite: true
 __ __type: keyword
    -_name:_message
      overwrite:_true
   __ type: keyword
 _    description:_This key captures the contents of_instant messages
_ _ - name: time
      overwrite: true
_     type:_date
   _ _description:_This is the_time_at which_a session hits a NetWitness Decoder.
 _ _    This key_should never be used_to_parse Meta data from a session_(Logs/Packets)
     _  Directly, this is_a_Reserved_key in NetWitness.
  _ - name: level
  _  _overwrite: true
     _type:_long
     _description:_Deprecated key defined only in table_map.
__  - name: msg_id
_     overwrite:_true
      type: keyword
 _  _ description: This is the_Message_ID1_value that identifies the exact log parser
   _ _  definition_which parses a particular log session. This key should never_be
      _ used to parse Meta data from a session (Logs/Packets) Directly,_this is a
     _  Reserved key in NetWitness
 _  - name:_msg_vid
_     overwrite: true
____  type:_keyword
  _  _description: This_is the Message_ID2 value_that identifies the_exact_log parser
        definition which parses a particular log session. This key_should never be
   _    used_to_parse Meta data_from a session (Logs/Packets)_Directly, this is a
    _   Res