Decoder: Edit, Upload, or Remove a Feed

Document created by RSA Information Design and Development on Sep 13, 2017Last modified by RSA Information Design and Development on Jul 11, 2019
Version 12Show Document
  • View in full screen mode

You can upload a feed, edit an existing feed, or remove a feed.

To edit an existing feed:

  1. Go to CONFIGURE > Custom Feeds.

    The Feeds view is displayed.

    An example of the CUSTOM FEEDS view

  2. In the toolbar, select a feed and click  The edit icon.

    The Configure Custom Feed or Configure Identity Feed panel opens in the Custom Feed wizard.

    An example of the Define Feeds view

  3. If you want to edit the feed file:

    1. Click download file.

      For an Identity feed, the .zip file is downloaded. For a custom feed, the .csv or .xml file is downloaded to your local file system. For a STIX feed, the .xml file is downloaded to your local file system.

    2. Edit and save the file.
    3. In the Define Feed tab, browse for and open the edited file.
  4. Edit any other parameters in the Define Feed tab, Select Services tab, and Define Columns tab that apply to the type of feed.
  5. Anytime before you click Finish, you can:

    • Click Cancel to close the wizard without saving your changes.
    • Click Reset to clear the data in the wizard.
    • Click Next to display the next form (if not viewing the last form).
    • Click Prev to display the previous form (if not viewing the first form).
  6. In the Review tab, review the feed information, and if correct, click Finish.

The feed is recreated with the updated file and new feed specifications. The feed is added to the Feeds list and progress bar tracks completion. Upon successful creation of the feed definition file, the Create Feed wizard closes, and the feed and corresponding token file is listed in the Feeds list. You can expand or collapse the entry to see how many services are included, and which services are successful.

To upload a feed to a Decoder or Log Decoder:

  1. Go to ADMIN > Services.
  2. Select a service and click The actions icon > View > Config.

    The Services Config view is displayed with the General tab open.

  3. Select the Feeds tab.
  4. In the Feeds tab toolbar, click The Upload button.

    The Upload Feeds dialog is displayed.

    This is the Upload Feeds dialog.

  5. In the File grid, click The add icon and select a feed file. Supported files are *.feed, *.token, and *.filter.
  6. Select the feed file from the File list and click Upload.

    The Upload Job list is updated to show the progress and status of the uploaded feed.

To remove a feed:

  1. Go to CONFIGURE > Custom Feeds.

    The Custom Feeds view is displayed.

  2. In the toolbar, select a feed and click Delete icon.

    The Delete Custom Feeds dialog is displayed.

    Delete Custom Feeds dialog

    You can select one of the following options to delete the feed:

    • If you choose to delete the feed from Local DB and Service, the feed is deleted from both the service and the local NetWitness Platform box. The deleted feed will no longer seen on the NetWitness Platform user interface.
    • If you choose to delete the feed from Local DB Only, the feed is deleted from the local NetWitness Platform box. The deleted feed will not be seen on the NetWitness Platform user interface; however, the last deployed version of the feeds will be present on the service. The undeployed feeds will be deleted forever. 
    • If you choose to delete the feed from Service Only, the feed is deleted from the service. The deleted feed will appear on the NetWitness Platform user interface and can be deployed again

  3. Select where you want to delete the feed and click Delete.

    A warning dialog is displayed.

  4. Click yes to confirm that you want to delete the feed from the select areas.

    • If you chose to delete the feed from the Local DB Only, the feed is deleted.
    • If you chose to delete the feed from the Local DB and Service or Service Only, the Delete Custom Feeds view is displayed showing the progress of the deletion on the service.

      An example of Define Custom Feeds progress dialog

You are here
Table of Contents > Configure Feeds and Parsers > Upload, Edit, or Remove a Feed