This topic provides information on how to add the Context Hub service on a Event Stream Analysis (ESA) host.
In Security Analytics 10.6, Context Hub service is pre-installed on ESA host, but is disabled by default. Use the procedure in this topic to enable Context Hub service.
Note: You can have only one Context Hub service instance enabled in your Security Analytics deployment. If there are multiple ESA service in Security Analytics, you must choose the appropriate ESA host for Context Hub. A minimum of 8GB space is required to configure Context Hub on ESA host.
Ensure that ESA host with 10.6 is available. In case of older versions, administrator must first upgrade ESA host to 10.6.
When you navigate to the Administration > Services panel, if Context Hub service is not enabled, the Enable Context Hub dialog appears. For more information, see Enable Context Hub Dialog.
To add the Context Hub service:
In the Security Analytics menu, select Administration > Services.
The services view is displayed.
The Add Service dialog is displayed.
Select the ESA host from the list of compatible hosts.
The other fields like the Name and Port are entered automatically. The default port is 50022.
The Context Hub service is added in Security Analytics.
Note: You can have only one Context Hub service instance enabled in your Security Analytics deployment. If you run multiple ESAs and you want to use Context Hub functionality on them, you need to configure them to connect to the ESA that runs the Context Hub service. For instructions, see the Configure an ESA to Connect to the Context Hub on Another ESA topic in the Event Stream Analysis (ESA) Configuration Guide.