Administrators must receive notifications when event sources are no longer being collected by NetWitness Platform. They need to be able to configure how long the event sources can be quiet (that is, not collect any log messages) before sending a notification based on different factors.
RSA NetWitness Platform provides event source groups so that you can group similarly important devices together. You can create groups based on attributes that you imported from your CMDB (configuration management database), or by manually choosing event sources to add to the group.
For example, these are some of the types of event source groups that you can create:
- PCI sources
- Windows Domain Controllers
- Quiet sources
- Finance Servers
- High Priority devices
- All Windows sources
Procedure
To create an Event Source group:
- Go to ADMIN > Event Sources.
-
The Create an Event Group dialog is displayed.
- Enter a Group Name.
- Enter a Description.
- Click
to add a condition. Continue adding conditions as necessary. For details on constructing conditions, see Create/Edit Group Form.
-
Click Save.
The new group is listed in the Manage panel.
Examples
This section describes a simple example, and then discusses how to set up a more complex set of rules.
Simple Example
If you want to create an event source group that contains all of your high priority event sources, this example describes the necessary steps.
- Go to ADMIN > Event Sources.
- In the Manage > Groups panel, click
.
- Enter High Priority Devices for the Group Name.
- Enter a description, such as, "These devices are our highest priority ones, and must be monitored closely."
- Leave All of these selected and click
to add a condition.
-
Select Add condition from the drop-down menu.
- Click Save.
Complex Example
In this example, you want to create a fairly complex rule: match event sources that are in the United States, and in either the Sales, Finance, or Marketing departments. Also, match worldwide internal, high priority Sales event sources. High Priority is assumed to be where the priority is 1 or 0. Logically, the definition is as follows:
(Country=United States AND (Dept.=Sales OR Dept.=Finance OR Dept.=Marketing))
OR
(Priority < 2 AND Division != External AND Dept.=Sales)
The following figure is an example of the criteria for creating such an Event Source Group.