000026771 - How to list all feeds on an RSA Security Analytics Decoder

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000026771
Applies ToRSA Security Analytics
RSA Security Analytics 10.3.4 and below
IssueHow to list all feeds on an RSA Security Analytics Decoder.
Resolution

Only custom feeds are visible in the feeds management view in the RSA Security Analytics UI. Subscribed feeds from Live are not displayed.  This is because the RSA Security Analytics UI does not perform central management of the feeds installed on individual decoder appliances.

 

It is possible to view the feeds installed on individual decoder appliances by performing the steps below.

  1. First, navigate to the master device list. Select the far upper left button in the UI, then "Administration," then "Devices."
  2. Select the appliance you wish to view the feed details for. The "Type" column of the appliance must be "Decoder" or "Log Decoder". Select the "View" drop-down list, then "Explore."
  3. The Explore view presents a two-pane view with configuration details of the appliance. In the left pane, a tree organizing the configuration details is visible. Begin by expanding the "decoder" node in this tree. Under "decoder", there is another node titled "parsers." Expand this and select "config."
  4. The right-hand pane should now contain several configuration options. One is titled "detailed.stats." By default, this is set to "no". Click this value. Now change it to "yes." Press the Enter key to set the value.
  5. Allow several minutes for the change to take effect. Now refresh the page in your browser. Under the "parsers" node, the "feeds" node should have become expandable. Expand it to list all the feeds installed on the decoder.

 

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

NotesIf the decoder does not have any feeds installed, none will be visible in the Explore view.
Legacy Article IDa68043

Attachments

    Outcomes