000026320 - How to customize RSA Connector Framework (RCF) 'Incident_Escalate.xml' file to accommodate custom RSA Archer fields to RSA enVision variable mapping

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000026320
Applies To5.x
IssueHow to customize RSA Connector Framework (RCF) 'Incident_Escalate.xml' file to accommodate custom RSA Archer fields to RSA enVision variable mapping

When using RSA Security Incident Management (SIM) solution, to customize the mappings between RSA Archer fields and RSA enVision variables, Incident_Escalate.xml mapping file requires editing.

 

For example, if a new mapping is required for an 'Incidents' or 'Incident Events' application in RSA Archer. Locate the 'Incident_Escalate.xml' file under 'Application Mapping' directory on the enVision machine with 'RSA Connector Framwork' (RCF) install. Browse to the end of the last field mapping under the desired application section in the XML file and add required mappings as shown below:

 

For Archer Text Field Type

 

<field>

                <UUID>Archer_Field_GUID</UUID>

                <fieldType>TEXT</fieldType> <!--Defines Archer field Type -->

                <keyName>enVision_Variable_Name</keyName> <!?CSV column name of enVision data -->

</field>

 

For Archer Date Field Type

 

<field>

                <UUID>Archer_Field_GUID</UUID>

                <fieldType>DATE</fieldType>

                <keyName>/Task/@modifiedTime</keyName> <!?xpath uri from envision xml file-->

                <dateFormat>EEE MMM dd HH:mm:ss z yyyy</dateFormat> <!?defines the date format of enVision date value-->

</field>

 

For Archer ValuesList Field Type

 

<field>

                <UUID>Archer_Field_GUID</UUID>

                <fieldType>VALUES_LIST</fieldType>

                <keyName>enVision_Variable_Name</keyName>

                <valueFieldUUID>GUID_Global/Custom_Value_List_field</valueFieldUUID>   

                <defaultValue>Default_Value</defaultValue> <!?This value will be used if enVision data is empty -->

</field>

 

For Archer Cross Reference Field Type

 

<field name="Archer_CROSS_REFERENCE_Field_Name">

                <UUID>Archer_Field_GUID</UUID>

                <fieldType>CROSS_REFERENCE</fieldType>

                <relation>

                                <appName>CROSS_REFERENCE_Application</appName>

                </relation>

                <keyName>enVision_Variable_Name</keyName>

</field>

 

Sample Incident_Escalate.xml - Before and After Editing 

===================================================

 

Before

 

<?xml version="1.0" encoding="UTF-8"?>

<configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

                xsi:noNamespaceSchemaLocation="rsa_connector_archer_mapping_schema.xsd">

 

                <version>1.0</version>

                <publisher name="RSA Security" />

                <action>IMPORT_TO_ARCHER</action>

                .

                .

                .

                .                              

                <application CRUDOptions="INSERT_ONCE_PER_REQUEST">

                                <applicationUUID>982FC3BE-7C43-4D79-89A1-858ED262B930</applicationUUID>

                                <!-- Application fields -->

                                .

                                .

                                .

                                .

                                <field name="System Events">

                                                <UUID>94402167-C7D6-437F-86D9-3C06A202573D</UUID>

                                                <fieldType>VALUES_LIST</fieldType>

                                                <defaultValue>Yes</defaultValue>

                                                <valueFieldUUID>B1349173-00ED-455C-A99E-A68B6B79CC18</valueFieldUUID>

                                </field>                               

                </application>

                .

                .

                .

                .

</configuration>

 

 

After

 

<?xml version="1.0" encoding="UTF-8"?>

<configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

                xsi:noNamespaceSchemaLocation="rsa_connector_archer_mapping_schema.xsd">

 

                <version>1.0</version>

                <publisher name="RSA Security" />

                <action>IMPORT_TO_ARCHER</action>

                .

                .

                .

                .                              

                <application CRUDOptions="INSERT_ONCE_PER_REQUEST">

                                <applicationUUID>982FC3BE-7C43-4D79-89A1-858ED262B930</applicationUUID>

 

                                <!-- Application fields -->

                                .

                                .

                                .

                                .

                                <field name="System Events">

                                                <UUID>94402167-C7D6-437F-86D9-3C06A202573D</UUID>

                                                <fieldType>VALUES_LIST</fieldType>

                                                <defaultValue>Yes</defaultValue>

                                                <valueFieldUUID>B1349173-00ED-455C-A99E-A68B6B79CC18</valueFieldUUID>

                                </field>

                                <field name="<Archer_NEW_TEXT_Field_Name>">

                                                <UUID>Archer_Field_GUID</UUID>

                                                <fieldType>TEXT</fieldType>

                                                <keyName>enVision_Variable_Name</keyName>

                                </field>

                </application>

                .

                .

                .

                .

</configuration>

========================================================

 

Save the changes made to 'Incident-Escalate.xml' file. Now to activate these changes, login to RCF shell with administrator credentials and execute the command: "refresh-app im-escalate". This will allow RSA enVision to escalate the report with the changes.

Legacy Article IDa60452

Attachments

    Outcomes