Warehouse: Specify Meta Filters

Document created by RSA Information Design and Development on Jul 25, 2016
Version 1Show Document
  • View in full screen mode
 

 

This topic provides instructions on how to specify meta filters in Warehouse Connector. You need to specify the filter for each stream in the export.session.meta.fields parameter in the Explore view of the Warehouse Connector.

The following table lists the values that you can provide as a filter:

                     
ValuesDescription
*All the collected metas are written to SAW.
*, meta1, meta2All the metas except the defined metas are written to SAW.
For example,
Filter:*,ip.src
All the metas except ip.src is written to SAW.
meta1, meta2, meta3 Only the defined metas are written to SAW.

Note: By default, the following metas are wriiten to Warehouse even if you specify them in the filter:
- ng_source
- unique_id
- time

Procedure

To specify meta filters:

  1. In the Security Analytics menu, select Administration > Services.
  2. In the Services view, select a Warehouse Connector services and Actions menu cropped > View > Explore.
    The Explore view of the Warehouse Connector service is displayed.
    WCexpVw.png
  3. In the options panel, select warehouseconnector > streams > <stream_name> > loader > config.
  4. In the export.session.meta.fields parameter, enter the filter.
    WCExpVwEx2.png
  5. Restart the stream.
You are here: Additional Procedures > Specify Meta Filters

Attachments

    Outcomes