Warehouse: Manage a Stream and Lockbox

Document created by RSA Information Design and Development on Sep 14, 2017Last modified by RSA Information Design and Development on Nov 16, 2017
Version 5Show Document
  • View in full screen mode
 

You can manage a stream using the following procedures:

  • Edit a Stream
  • Reload the Stream
  • Specify meta filters for a Stream
  • Define muti-valued metas

Edit a Stream

You can edit a stream to perform the following:

  • Add more data sources to the stream.
  • Delete existing data sources from the stream.

To edit a stream:

  1. In the main menu, select ADMIN > Services.
  2. In the Services view, select the added Warehouse Connector service and select  > View > Config.
    The Services Config view of Warehouse Connector is displayed.

  3. On the Streams tab, click .
  4. In the Edit Stream dialog, you can perform the following:
  • On the Available Sources tab, you can select the available data sources to add to the stream and click Save.
    edit stream
  • On the Current Sources tab, you can delete an existing data source from the stream. Select the data source and click .
    edit stream

Reload the Stream

When you reload the stream, the Warehouse Connector updates the schema file for the stream. You should reload the stream whenever you add a new custom meta to the Log Decoder or Decoder.

To reload the stream:

  1. In the main menu, select ADMIN > Services.
  2. In the Services view, select the added Warehouse Connector service and select  > View > Config.
    The Services Config view of Warehouse Connector is displayed.
  3. On the Streams tab, select the stream that you want to reload.
  4. Click Reload.

Specify Meta Filters for a Stream

You need to specify the filter for each stream in the export.session.meta.fields parameter in the Explore view of the Warehouse Connector.

The following table lists the values that you can provide as a filter:

                     
ValuesDescription
*All the collected metas are written to SAW.
*, meta1, meta2All the metas except the defined metas are written to SAW.
For example,
Filter:*,ip.src
All the metas except ip.src is written to SAW.
meta1, meta2, meta3 Only the defined metas are written to SAW.

Note: By default, the following metas are written to Warehouse even if you specify them in the filter:
- ng_source
- unique_id
- time

To specify meta filters for a Stream:

  1. In the main menu, select ADMIN > Services.
  2. In the Services view, select a Warehouse Connector services and select  > View > Explore.
    The Explore view of the Warehouse Connector service is displayed.

  3. In the options panel, select warehouseconnector > streams > <stream_name> > loader > config.
  4. In the export.session.meta.fields parameter, enter the filter.
    specify meta filter
  5. Restart the stream.

Define Multi-valued Metas

You can also define an existing meta or a custom meta to be treated as multi-valued meta.

To define multi-valued metas:

Caution: Defining an existing meta to be treated as multi-valued may change the data type of the meta and cause the associated reports to fail.

  1. Create a new file with the filename multivalue-users.xml in the /etc/netwitness/ng directory.
  2. Add the following entries:

    Where NEWMETANAME is the existing meta or a custom meta to be treated as multi-valued meta. 

    Caution: Make sure that you do not add metas that are by default treated as non multi-value.

  1. Restart the stream.

Manage a Lockbox

You can manage a lockbox using the following procedures:

  • Change the Lockbox password
  • Refresh the Lockbox

To change the Lockbox password:

  1. Log on to NetWitness.
  2. In themain menu, select ADMIN > Services.
  3. In the Services view, select the added Warehouse Connector service, and select  > View > Config.
    The Services Config view of Warehouse Connector is displayed.
    Warehouse connector services config view
  4. Click the Lockbox Settings tab.
  5. In the Change Lockbox Password section, perform the following:
    1. In the Current Lockbox Password field, enter the current lockbox password.
    2. In the New Lockbox Password field, enter the new lockbox password.

      Note: The lockbox password must be at least eight characters in length and it must contain at least three of the following groups: one uppercase character [A-Z], one lowercase character [a-z], one numeral [0-9], and one special character.

    3. In the Confirm New Lockbox Password field, enter the new lockbox password to confirm.
    4. Click Apply.
      The Lockbox password is successfully changed.

To refresh the Lockbox:

  1. Log on to NetWitness.
  2. In the main menu, select ADMIN > Services.
  3. In the Services view, select the added Warehouse Connector service, and select  > View > Config.
    The Services Config view of Warehouse Connector is displayed.

  4. Click the Lockbox Settings tab.

  5. In the Refresh Lockbox section, enter the current lockbox password in the Lockbox Password field.
  6. Click Apply.
    The Lockbox is reset.
You are here
Table of Contents > Manage a Stream and Lockbox

Attachments

    Outcomes