ESA rule deployments map rules from your rule library to the appropriate ESA Services and data sources. The Deployment panel (Configure > ESA Rules > Rules tab) enables you to create and configure ESA rule deployments that specify:
- ESA Services
- Data Sources (This is available in NetWitness Platform version 11.3 and later.)
- ESA Rules
When you are ready to start aggregating data and generating alerts from an ESA rule deployment, you deploy the ESA rule deployment to activate it.
What do you want to do?
|Role||I want to ...||Show me how|
|Content Expert|| |
Add an ESA rule deployment.
|Content Expert|| |
|Additional ESA Rule Deployment Procedures|
In the ESA Services section, you can manage each ESA service in the deployment.
The following table describes the actions you can perform in the ESA Services section.
|Adds an ESA service to the deployment.|
|Removes the selected ESA service from the deployment.|
The following table describes the columns in the ESA Services section.
|Status||Indicates if the deployment status is Added, Deployed, Updated, or Failed.|
|Name||Name of the ESA service.|
|Address||IP address of the host where the ESA service is installed.|
|Version||Version of the ESA service.|
|Last Deployment Date||The date and time when the ESA service was last deployed.|
In the Data Sources section, you can select one or more data sources, such as Concentrators, to use for your selected ESA Service.
The following table describes the actions you can perform in the Data Sources section.
The following table describes the columns in the Data Sources section.
|(Status)||Shows the status of the data source. A solid colored green circle indicates a running service and a white circle indicates a stopped service.|
|Name||Shows the name of the data sources used by the selected ESA service. You can specify the data sources separately for each ESA rule deployment.|
|Type||Shows the type of the data sources. Data sources can be Concentrators or Decoders. It is important that you choose data sources that have the appropriate data for the rules in the deployment. For example, if you have NetWitness Endpoint and you want to deploy the Endpoint Risk Scoring Rules Bundle, you must choose endpoint data sources.|
There are two deployment options below the Data Sources section. These options apply to the entire ESA rule deployment.
The following table describes these deployment options.
|Show Updates||Enables you to view a history of updates to the deployment.|
|Deploy Now||Activates the ESA rule deployment. The selected ESA service starts aggregating data and generating alerts using the specified ESA rules in the deployment. You need to add ESA Rules to the deployment before deploying the ESA rule deployment.|
In the ESA Rules section, you manage rules in the deployment. This section lists all rules that are currently in the deployment.
The following table describes the actions you can perform in the ESA Rules section.
|Opens the Deploy ESA Rules dialog, where you can select a rule.|
|Removes the selected ESA rules from the deployment.|
|Filters the list of rules.|
|Enables you to search for a rule.|
The following table describes the columns in the ESA Rules section.
|Status||Indicates the rule status: |
|Rule Name||Describes the purpose of the ESA rule.|
|Trial Rule||Indicates whether the rule is Deployment mode to see if the rule runs efficiently.|
|Severity||Shows the threat level of alert triggered by the rule.|
|Type||Shows the type of the ESA rule. For more information, see ESA Rule Types.|
|Email, SNMP, Syslog, Script||Indicates which notification types are used for alerts generated by the rules. (ESA SNMP notifications are not supported in NetWitness Platform version 11.3 and later.)|
|Last Modified||Shows the date and time when the ESA rule was last modified.|