This topic describes how you can download content from NetWitness Live to the IPDB Extractor. Use Security Analytics Live to deploy the latest content to the IPDB Extractor service. The download stores the IPDB Extractor service content in /etc/netwitness/ng/envision/etc directory. The content consists of:
- The service xml for all service types that RSA supports.
- The ipaddr.tab file.
- The ecat.ini file.
- The table-map.xml file - envision content to NetWitness meta map.
To download content to the IPDB Extractor service:
In the Security Analytics menu, click Dashboard > Live > Search.
Security Analytics displays the Live Search View.
From the Resource Types drop-down list, select RSA Log Device and click Search.
Security Analytics displays a NWFL (NetWitness for Logs) Content link in the Matching Resources. You can enter the keyword to search for this content.
- Double-click Envision Content File (NWFL Content) link or select the file.
- Click Deploy.
- Select the resource (Envision Content File) and click Next.
- Select the IPDB Extractor service in which you want to deploy the content and click Next.
- Review the information and click Deploy.
- Go to /etc/netwitness/ng/envision/etc directory on the Broker appliance running the IPDB Extractor service to make sure that Live downloaded the content successfully.
- Restart the IPDB Extractor service to deploy the content.