000026771 - How to list all feeds on an RSA Security Analytics Decoder

Only custom feeds are visible in the feeds management view in the RSA Security Analytics UI. Subscribed feeds from Live are not displayed.  This is because the RSA Security Analytics UI does not perform central management of the feeds installed on individual decoder appliances.

It is possible to view the feeds installed on individual decoder appliances by performing the steps below.

1. First, navigate to the master device list. Select the far upper left button in the UI, then "Administration," then "Devices."
2. Select the appliance you wish to view the feed details for. The "Type" column of the appliance must be "Decoder" or "Log Decoder". Select the "View" drop-down list, then "Explore."
3. The Explore view presents a two-pane view with configuration details of the appliance. In the left pane, a tree organizing the configuration details is visible. Begin by expanding the "decoder" node in this tree. Under "decoder", there is another node titled "parsers." Expand this and select "config."
4. The right-hand pane should now contain several configuration options. One is titled "detailed.stats." By default, this is set to "no". Click this value. Now change it to "yes." Press the Enter key to set the value.
5. Allow several minutes for the change to take effect. Now refresh the page in your browser. Under the "parsers" node, the "feeds" node should have become expandable. Expand it to list all the feeds installed on the decoder.

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.