Article Content
Article Number | 000029989 |
Applies To | RSA Product Set: Security Analytics, NetWitness Logs & Packets RSA Product/Service Type: Event Stream Analysis (ESA) RSA Version/Condition: 10.6.x and 11.x Platform: CentOS |
Issue | This article provides supplementary information on how to bulk export alerts from the Event Stream Analysis (ESA) appliances and virtual machines’ MongoDB on Security Analytics 10.6.x and 11.x. In NW 11 you need to use the "respond-server" mongo database with "mongoexport" command. |
Resolution | Note: To perform any of below, you must first SSH into the ESA host For 10.6.x , Please perform the Steps below; To export all alerts from the ESA host
Parameter Syntax (can be seen using `mongoexport --help`:
In the above example all the alerts will be exported to alerts.json file under the /root folder. To export alerts by module (rule) name
All the alerts that were triggered by <rule_name> will be exported to the alerts_by_rule_name.json file under the /root folder. To export alerts by module_name and time
All the alerts that triggered by <rule_name> between <time1> and <time2> will be exported to the alerts_by_rule_time.json file under the /root folder. Example:
Note: The mongo date type is similar a Unix Time/Epoch time, except it is number of milliseconds rather than number of seconds since midnight 1st/January/1970 Reference: https://docs.mongodb.com/manual/core/shell-types/#mongo-shell-date-type Current date in milliseconds from Epoch (we are adding 3 zeros to output of seconds from Unix Time)
If currently time is 1511494354000 and there are 86,400,000 milliseconds per day, then 24 hours ago would be: 1511494354000 - 86,400,000 = 1511407954000
Other UNIX Epoch timestamp conversations: Converting from millisecond offset from Epoch date in UTC
Converting a particular UTC date as millisecond offset from Epoch date
So date, in this case, would be 1511427600000 (add 3 0's to convert from seconds to milliseconds) For 11.x , Please perform the Steps below; Export all alerts in the database:
This will create a file in /root/ named "allalerts.json". However, depending on the size of the alerts collection it would take a considerable amount of time to run. Export all alerts with specific Alert name received in a given time range. Example all alerts with name XXXXXXXXXXX from <time1> to <time2>:
Export all Alerts for a specific time period
Example :
Replace the {deploy_admin_password} with the deploy_admin account password. The times [ <time1>, <time2> ] are shown in Epoch format ; You could get the epoch time for a given date/time through mongo via a one-liner such as -
|
Notes | For 10.6.x ; The syntax to re-import entries into mongo using mongoimport is very similar. To re-import alerts 1) Stop ESA service from altering DB
2a) Import alert collection (without first dropping current contents)
Otherwise: 2b) Drop alert collection and import
3) Restart ESA service
|