The topic provides instructions to import ESA rules from a NetWitness Suite instance and to export ESA rules to your hard drive so you can keep a local copy.
If you exported a rule in an earlier version of NetWitness Suite, the following conditions apply when you import the rule in version 10.5 or later:
- Exported in version 10.3 – You cannot import rules to version 10.5 or later.
- Exported in version 10.4 – You can import rules to version 10.5 or later.
Import ESA Rules
- Go to CONFIGURE >ESA Rules > Rules tab.
The Rules tab is displayed.
- In the Rules Library toolbar, select > Import.
The Import ESA Rules dialog is displayed.
- Click Browse to browse and select the file containing the ESA rules.
- Click Import.
- Select an ESA rule or multiple rules and select > Export in the Rule Library toolbar.
A warning dialog is displayed.
- Click Yes.
The Export Rules dialog is displayed.
- In the Enter File Name field, type a filename for the file with the ESA rules and click Export.
The file is exported as a binary file to your machine.