000026615 - How to consolidate rules for mass import into RSA NetWitness Investigator or a decoder appliance

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000026615
Applies ToRSA NetWitness NextGen
RSA NetWitness Decoder
RSA NetWitness Log Decoder
RSA NetWitness Hybrid
RSA NetWitness Investigator
IssueHow to consolidate rules for mass import into RSA NetWitness Investigator or a decoder appliance.
If you have a number of individual rules that you want to mass import into a decoder or into RSA NetWitness Investigator,
ResolutionIf you have a number of individual rules that you want to mass import into a decoder or into RSA NetWitness Investigator, copy all the rule files (.nwr) to one of your NetWitness appliances in the /root directory then from the /root directory issue the following command:  cat *.nwr AllRules.nwr

This will create the file AllRules.nwr which you can copy to desired location and use for rule import on the decoder or into Investigator.
Legacy Article IDa58735

Attachments

    Outcomes