000033906 - How to remove Discontinued Content in CMS from RSA NetWitness 10.6.1

Document created by RSA Customer Support Employee on Sep 5, 2016Last modified by RSA Customer Support on May 3, 2019
Version 5Show Document
  • View in full screen mode

Article Content

Article Number000033906
Applies ToRSA Product Set: NetWitness Logs & Packets
RSA Product/Service Type: Live Content
RSA Version/Condition: 10.6.1
Platform: CentOS
O/S Version: EL6
IssueHow to remove content that is no longer be updated in the Live Content Management System (CMS) which is accessed through the Live component in the NetWitness UI.
ResolutionWhen content (also known as resources) are marked as discontinued, there will be no further updates in CMS. When searching for content in Live, by default users won’t see this content unless they select the 'Include Discontinued Resources' checkbox.

NetWitness 10.6.1 brings a feature to locate deprecated contents that have been deployed via RSA Live.

The Discontinued Resources will be scanned across Concentrator, Log Decoder, Decoder and these will be displayed in the Live > Configure > Discontinued Resources tab.

User-added image

Discontinued Resources Tab for 10.6.1 :

Discontinued Content :