# Parser Actions

PlexTrac learns about scanner findings as files are imported. This learning can be done proactively by an admin through parser actions or when a user imports a scanner file when adding findings to a report. Either way, the learning begins *after* an admin imports a file via *the parser actions page* of the **Admin Dashboard**, and this process must occur for *each tool* that PlexTrac integrates with. Any files for a tool imported as findings to a report that have not been enabled by an admin on the parser actions page will have no impact on parser actions.

When importing a file, parser actions process the contents to extract relevant information and perform specific operations. The exact parser actions depend on the file format and business rules an admin configures.

The findings are matched to the parser action by plugin ID and include actions such as linking to a writeup, changing the finding severity, or ignoring the finding when parsed.&#x20;

{% hint style="info" %}
Currently, no other metadata of the finding, such as tags, can be mapped or manipulated by parser actions.
{% endhint %}

## Overview

When new files are uploaded to parser actions, plugin IDs are only created for IDs not found and set to a "Default" action, meaning no changes will occur on import unless a parser action is created.

Parser action changes are applied to future imports and don't impact existing findings. For example, suppose a parser action for a finding severity value was created for a plugin, but moving forward. In that case, the source of truth for severity is the scanner tool, then change the parser action for that plugin to "Default." The next time that plugin is imported, the severity value from the source will be imported into the report.

Parser actions apply to all users.

### Descriptions

The description of a parser action can be obtained by placing the cursor over the parser action title in the table.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FMV7txda8XTeJ9XMF5GVo%2Fimage.png?alt=media&#x26;token=437edfce-25ae-479e-8b49-8624112c71ae" alt=""><figcaption></figcaption></figure></div>

## Configuring a Parser

<mark style="background-color:yellow;">Step 1:</mark> Click **Parser Actions** in the "Tools & Integrations" section of the **Admin Dashboard.**

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FoIhsBY7r4nM173zIjQKC%2Fimage.png?alt=media&#x26;token=c5ceeab6-5dc3-4c83-88ab-0133f9aaa21f" alt="" width="555"><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 2:</mark> Check the **Enable Parser Plugin Actions** box.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FDTQB2QuX6RfN5n0WJi5V%2Fimage.png?alt=media&#x26;token=1e1bb637-2b65-4126-b8e6-bb403a625aae" alt="" width="503"><figcaption></figcaption></figure></div>

Enabling parser plugin actions will allow the ability to preset default actions, link writeups, and change the severity of scanner findings when imported into a report.

{% hint style="warning" %}
Once parser import rules are set, do not check the "Enable Parser Plugin Actions" box if wanting to import scan results natively without existing rules applied.
{% endhint %}

<mark style="background-color:yellow;">Step 3:</mark> Click **Import**.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FWTHaq49qTmWnOtzZUbK1%2Fimage.png?alt=media&#x26;token=a088b14e-dd9b-4f3d-bbf6-dd446b975b0e" alt="" width="503"><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 4:</mark> Select the source of the file to import from the "Import Source" pulldown menu, then drag the file into the drop area on the modal or click **Browse** to navigate to the file on the computer.&#x20;

{% hint style="info" %}
The box will display the supported files for the tool selected in the pulldown menu as the import source, along with the maximum file size.&#x20;
{% endhint %}

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2F1IbOcQ1ekhiQLl1RL8g5%2Fimage.png?alt=media&#x26;token=0138314b-9dcc-41a5-8cb1-496bc1c27242" alt="" width="563"><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 5:</mark> Click **Upload.**

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FnJvwNsqKcjYUYTEs4r7g%2Fimage.png?alt=media&#x26;token=a8949aa9-ffaf-4018-952b-723eef955b09" alt=""><figcaption></figcaption></figure></div>

A notification will confirm a successful import.

<mark style="background-color:yellow;">Step 6:</mark> The imported plugins are now available for configuration. Search or select the desired plugin and configure it using the pulldown menus and options to configure the preferred course of action.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2F5cP7FEtLieybSnWeE7qI%2Fimage.png?alt=media&#x26;token=fc41f024-2d46-41bd-bac0-9bdbc5516c63" alt=""><figcaption></figcaption></figure></div>

Parser plug-in actions include four options:

1. **DEFAULT:** Passes the scanner result through with no action taken.
2. **LINK:** Replaces a scanner result finding with a custom writeup from WriteupsDB.&#x20;
3. **IGNORE:** Ignores a scanner result when parsed by PlexTrac.&#x20;
4. **SEVERITY:** Overrides a scanner result, finding severity value with a new value selected by the parser action.

## Linking to a Writeup&#x20;

Parser actions can take findings ingested from an external tool and map them to a custom finding in WriteupsDB. When the finding is imported, this action will override the description, title, references, custom fields, common identifiers, risk score, and recommendations. Multiple plugins with the same writeup will be mapped to a single finding with merged affected assets.

<mark style="background-color:yellow;">Step 1:</mark> Click **Parser Actions** in the "Tools & Integrations" section of the **Admin Dashboard.**

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FoIhsBY7r4nM173zIjQKC%2Fimage.png?alt=media&#x26;token=c5ceeab6-5dc3-4c83-88ab-0133f9aaa21f" alt="" width="555"><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 2:</mark> Check the **Enable Parser Plugin Actions** box.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FSRWKBi4biWpiQlRLstrc%2Fimage.png?alt=media&#x26;token=a13a009e-d660-4944-8759-aa7be434eeb5" alt="" width="503"><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 3:</mark> Select the parser to work with from the "Filter Plugins" pulldown menu.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FrZbZAnUY946uYCbiFbsW%2Fimage.png?alt=media&#x26;token=2b0a470f-018f-4c24-8712-bd3db1f28b73" alt=""><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 4:</mark> Select the findings by clicking the checkbox of the finding row or selecting the box in the header column next to "Plugin Id."

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FPYAcKbdTVDlhPgiXcCUD%2Fimage.png?alt=media&#x26;token=12a1cce2-25d4-43e2-ba2b-36f31ccbd75a" alt=""><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 5:</mark> Select the writeup to link the findings by selecting the value from the "Link Writeup" pulldown menu.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2F9nuCr5koUiKONAu0Doq5%2Fimage.png?alt=media&#x26;token=a4c5e54e-699b-4118-b1b4-315f9da201a5" alt=""><figcaption></figcaption></figure></div>

The linked writeup is now displayed for each finding under the "Write Up" column.&#x20;

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FgnfQZMAJfcsgnyoh6VzW%2Fimage.png?alt=media&#x26;token=c1229904-fa1f-4afa-99e2-74b47be8510b" alt=""><figcaption></figcaption></figure></div>

If a new report is created, and the same parser file is imported, only one finding will be imported into the report.

## Adding a Parser Action

{% hint style="warning" %}
Once a parser action is created, it cannot be deleted.
{% endhint %}

<mark style="background-color:yellow;">Step 1:</mark> Click **Parser Actions** in the "Tools & Integrations" section of the **Admin Dashboard.**

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FoIhsBY7r4nM173zIjQKC%2Fimage.png?alt=media&#x26;token=c5ceeab6-5dc3-4c83-88ab-0133f9aaa21f" alt="" width="555"><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 2:</mark> Check the **Enable Parser Plugin Actions** box.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2F24rr8OWjAHg6YDu2QoAp%2Fimage.png?alt=media&#x26;token=7de0b83e-52c3-4987-8daf-e61cd7e0c417" alt="" width="503"><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 3:</mark> Select the parser to work with from the "Filter Plugins" pulldown menu.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FrZbZAnUY946uYCbiFbsW%2Fimage.png?alt=media&#x26;token=2b0a470f-018f-4c24-8712-bd3db1f28b73" alt=""><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 4:</mark> Click **Add Parser Action**.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FXIw5WlEXgU19YRXK2EcJ%2Fimage.png?alt=media&#x26;token=4c753692-8dc2-47b6-9a19-602a3dd2f086" alt=""><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 5:</mark> Enter a Plugin ID, Title, and Plugin Description value.

{% hint style="info" %}
All three fields must contain a value to continue.
{% endhint %}

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2Fqi444EIIxtEvi1pwXARl%2Fimage.png?alt=media&#x26;token=7ed4b6bd-5049-4e58-ac25-9b698a45fb8b" alt=""><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 6:</mark> If the plugin action is "Default," continue to Step 8. Otherwise, select the desired plugin action from the pulldown menu.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2F16JLvZTJAd7mVWSli3HI%2Fimage.png?alt=media&#x26;token=89680f57-3a0e-438d-8fcf-0e9c6b1a9122" alt=""><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 7:</mark> If "Ignore" was chosen, go to Step 8. Otherwise, select the value to associate with the action determined in the previous step.

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2FACUj0pmagW7pmJKuIQ7O%2Fimage.png?alt=media&#x26;token=f9e7291e-ff31-48fe-a02b-8b9650fbd65b" alt=""><figcaption></figcaption></figure></div>

<mark style="background-color:yellow;">Step 8:</mark> Click **Create**.&#x20;

<div align="left"><figure><img src="https://4252973360-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LXA6EayCcg12qfDcfXd%2Fuploads%2F1mD6b2GdmXvzoyhfZ5Gk%2Fimage.png?alt=media&#x26;token=b1219528-737c-4c49-ba48-d1a6f8cde395" alt=""><figcaption></figcaption></figure></div>

A message confirming creation will appear, and the new parser action will be displayed in the list.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.plextrac.com/plextrac-documentation/product-documentation-1/account-management/account-admin/automations/parser-actions.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
