Broker: Step 3. Configure Aggregate Services

Document created by RSA Information Design and Development on Sep 14, 2017Last modified by RSA Information Design and Development on Sep 18, 2017
Version 4Show Document
  • View in full screen mode
  

This topic introduces basic tasks related to data aggregation on Brokers and Concentrators. For information on the optional setup of group aggregation, see Step 4. (Optional) Configuring Group Aggregation .

Configuring the aggregate services (whose data is consumed and aggregated) includes:

  • Adding, editing, and deleting Concentrators and Decoders as aggregate services
  • Toggling an aggregate service online and offline

Add Aggregate Services to a Broker or Concentrator

  1. In the main menu menu, select ADMIN > Services.
  2. In the ADMIN Services view, select a Broker or Concentrator, and select Settings button  > View > Config.
    The Services Config view for the selected service is displayed.
    Services Config view for Aggregate services
  3. Click Add button in the Aggregate Services toolbar.
    The Available Services dialog is displayed.
    Available services are displayed
  4. Select one or more services to be added and click OK.
  5. Enter the Administrator username and password to authenticate adding a service.
    Enter username and password
    The added services are listed in the Aggregate Services list. 
  6. To save the changes, click Apply.

Remove Aggregate Services from a Broker or Concentrator

Note: This option applies only to offline services. If the aggregate service is online, you must first toggle the service offline.

  1. In the Aggregate Services list, select one or more services.
  2. Click Delete button in the toolbar.
  3. Remove Aggregate Services
    The service is removed from Aggregate Services list. 
  4. To save the change, click Apply.

Edit Aggregate Services on a Concentrator

Note: This option applies only to offline services. If the aggregate service is online, you must first toggle the service offline. You can edit only one service at a time.

You can limit the data being consumed from an aggregate service using meta fields and filters. To configure this:

  1. Click Change Service to change the service to Concentrator.
  2. In the Aggregate Services list, select one or more services.
  3. Click Edit button in the toolbar. Enter the authentication information in the pop up dialog box.
    • If the service was added on a different instance of NetWitness Suite, you must add it to this instance of NetWitness Suite in order to edit. A warning dialog allows you to add the service. If you click Yes, the Add Service dialog is displayed.
    • If the service is online, a dialog notifies that the service must be offline and requests confirmation that you want to continue. If you click Yes, NetWitness Suite takes the service offline and the Edit Aggregate Service dialog is displayed.
    • If the service is offline, the Edit Aggregate Service dialog is displayed with the editable properties for an aggregate service on a Concentrator.

  4. Click a type of metadata in the Meta Include tab to select the type of metadata for the Concentrator to consume from this service. Click Save.
    1. Meta Include tab
  5. To specify a rule to filter data that the Concentrator consumes from this service, compose a rule in the Meta Filter tab. Click Save.
  6. Click Close.
    The Edit Aggregate Service dialog closes and the changes are shown in the Aggregate Services list. In this example, two meta were selected on the Meta Include tab. When you click the information icon in the Meta Include field, it shows the selections. 
  7. To save the changes, click Apply.

Toggle a Service

When data aggregation starts, Brokers and Concentrators consume data from aggregate services that are online. When first added to a Broker or Concentrator, aggregate services are offline. To toggle a service between online and offline:

  1. Select a service in the Aggregate Services list.
  2. Click Toggle Service icon.
    The status is changed.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

You are here
Table of Contents > Basic Setup Procedures > Step 3. Configure Aggregate Services

Attachments

    Outcomes