This document assumes that the reader has some familiarity with adjusting the configuration of a Security Analytics Core service. For information on how to configure the Core services by editing configuration files, see Service Configuration Settings in the Getting Started Guide. To use this document, you should be familiar with one of the mechanisms for modifying the configuration tree of Core services. Examples of such mechanisms include the Explorer view of the Administration pages within the Security Analytics user interface, or the REST interface accessible on each service through a web browser.
Find Help within the Core Service
Each configuration item within a Core service has a built-in help description of what the item does. You can view this help information by hovering your mouse over the configuration item in the Explorer view. Each configuration item also indicates whether it can be changed without restarting or if a restart of the service is needed for the change to take effect.
Developers using the REST API can retrieve the help text for each configuration item by sending the help message to the configuration node path.
Packet, Meta, and Session Storage
Each of the packet, meta, and session databases are configured through the /database/config folder on each Security Analytics Core service. Each database has a configurable parameter to specify where the Core service stores data. Packet, meta, and session databases follow a predictable pattern for all of their configuration entries. Configuration items for the packet database start with the prefix packet, meta database configuration starts with the prefix meta, and the session database configuration items start with the prefix session.
The index configuration is stored in the /index/config folder on each Core service.