How to create a parser
The JS parser object is available in user‑customizable scripts within Data Transformation Service (DTS) and Alerts.
DTS is a JavaScript-based parsing service that provides various functions. Its primary role is to perform additional transformations on data extracted from collected events.
Authentication
To access the web interface, open a browser and enter the application's IP address or DNS name. The default address initially assigned to the web interface is https://CyberquestIPAddress (example).
The browser automatically redirects to CYBERQUEST's authentication page:
Navigate to Settings
Navigate to Settings > Rules and select DTS Objects.
DTS Objects
Click IMPORT OBJECT to import a DTS object, or ADD DTS OBJECT to create a new one.
To create a new DTS object, click ADD DTS OBJECT and complete:
Name: A unique identifier for the DTS object.
Description: A brief summary of the object’s purpose or functionality.
Is Active?: Determines if this object is enabled for execution.
Script: The JavaScript code that runs within the DTS context to transform or process event data.
Ignore Errors: Determines whether the DTS should continue processing other objects if this script encounters an error.
Click Save to apply changes.
Actions menu
After creating the DTS object, the following actions are available:
-
Active/Inactive:
Enable or disable the object with a single click. -
Export:
Export the object as a .CQOfile for backup or transfer. -
Edit:
. Open the Edit page to modify the Name, Description, Script, or active/inactive state of the object.
- Delete: Remove the object permanently. Click Delete and confirm to proceed.
Example of parser
This example demonstrates enriching events by adding normalized fields derived from raw input data:
