Decoder: Create an Identity Feed

Document created by RSA Information Design and Development on Jul 27, 2016Last modified by RSA Information Design and Development on Sep 28, 2016
Version 4Show Document
  • View in full screen mode

You can easily create an Identity feed and populate it to selected Decoders and Log Decoders using the Custom Feed wizard in RSA Security Analytics. To complete this procedure, you need a binary feed file that the Custom Feed wizard can use to create the Identity feed.

To create a custom identity feed:

  1. In the Security Analytics menu, Live > Feeds.
    The Feeds grid is displayed.
  2. In the toolbar, click Icon-Add.png.
    The Setup Feed dialog is displayed, with Custom Feed selected by default.
  3. Select Identity Feed and click Next.
    The Configure Identity Feed panel is displayed with the Define Feed tab open.
  4. (Conditional) To define an on-demand Identity feed task that executes once: Select Adhoc in the Feed Task Type field, type the feed Name, and browse for and open the feed.
    1. Select Adhoc in the Feed Task Type field, type the feed name in the Name field, then browse for and open the feed.
    2. Click Next.
      The Select Services form is displayed. 
    3. Continue with Step 6.
  5. (Conditional) To define a recurring Identity feed task that executes repeatedly at specified intervals, during a specified date range:
    1. Select Recurring in the Feed Task Type field.
      The Define Feed form includes the fields for a recurring feed.
    2. In the URL field, enter the URL where the feed data file is located, for example, http://<hostname>/<feeddatafile>.feed, and click Verify.  
      Security Analytics verifies the location where the file is stored, so that Security Analytics can check for the latest file automatically before each recurrence.
    3. (Optional) If the URL has restricted access and requires authentication using your username and password, select Authenticated.
      Security Analytics provides your user name and password for authentication to the URL.
    4. To define the interval for recurrence, do one of the following:
    • Specify the number of minutes, hours, or days between recurrences of the feed.
    • Specify recurrence every week, and select the days of the week.
    1. To define the date range for the execution of the feed to recur, specify the Start Date and time and the End Date and time.
    2. Click Next.
      The Select Services form is displayed.
  6. To identify services on which to deploy the feed, do one of the following:
    • Select one or more Decoders and Log Decoders, and click Next.
    • Click the Groups tab and select a group, then click Next.
      The Review form is displayed.

    Note: If a group of devices with decoder and log decoders is used to create recurring or custom feed and this group is deleted, in SA 10.5.1, you can edit the feed and add a new group to the feed.

    1. Anytime before you click Finish, you can:
      • Click Cancel to close the wizard without saving your feed definition
      • Click Reset to clear the data in the wizard
      • Click Next to display the next form (if not viewing the last form)
      • Click Prev to display the previous form (if not viewing the first form)
    2. Review the feed information, and if correct, click Finish.
      Upon successful creation of the feed definition file, the Create Feed wizard closes, and the feed and corresponding token file are listed in the Feed grid and progress bar tracks completion. You can expand or collapse the entry to see how many services are included, and which services were successful.