You can configure Archer as a data source for Context Hub and use the Context Hub service to fetch contextual information from Archer. Use the procedures in this topic to add Archer as a data source for Context Hub service and configure the settings (if required) for Archer.
Before you configure Archer data source, ensure that:
- Context Hub service is available in ADMIN>Services view of NetWitness Platform.
- Archer is installed with Licensed Devices application.
To add Archer as a data source for Context Hub:
- Go to ADMIN > Services.
The Services view is displayed.
- Select the Context Hub service, and click > View > Config
The Services Config view is displayed.
- In the Data Sources tab, click > Archer.
The Add Data Source dialog is displayed.
Provide the following information:
- By default, the Enable checkbox is selected. If this option is unchecked, the save button is disabled, you cannot add the data source, and cannot view the contextual information.
- Enter the following fields:
- Name: Enter a name for Archer data source.
- Host: Enter the hostname or IP address where Archer server is installed.
- SSL: By default this option is selected and enables SSL communication to Archer .
- Trust All Certificates: Select this checkbox to add the data source without validating the certificate. If you uncheck this option, you need to upload a valid Endpoint server certificate for the connection to be successful.
- Port: The default port is 443.
- Username: Enter the Archer Server username.
- Password: Enter the Archer Server password.
- Instance: Enter the Instance name from which you want to extract data. An RSA Archer instance is a single set up that includes unique content in a database, the connection to the database, the interface, and log-in. You might have individual instances for each office location or region or for development, test, and production environments. The Instance Database stores the RSA Archer content for a specific instance.
- Context Base: Enter the virtual directory name where the files are stored. For example, rsaarcher located at the RSA Archer web address https://archer.company.com/rsaarcher/default.aspx. If the files are stored in the IIS default web address https://archer.company.com/default.aspx, then this field must be empty.
- Max. Concurrent Queries: You can configure the maximum number of concurrent queries defined by the Context Hub service to be run against the configured data sources. The default value is 10.
- Click Test Connection to test the connection between Context Hub and the Archer data source.
- Click Save.
Archer is added as a data source for Context Hub and is displayed in the Data Sources tab.
After adding the data source, you can configure data source settings. For instructions, see Configure Context Hub Data Source Settings . And View the contextual data in the Context Summary Panel of the Respond view or Investigate view. For instructions, see the Netwitness Respond User Guide and Investigation and Malware Analysis User Guide
Configure Archer Data Source
After you have configured the required data sources you can customize the settings for the data sources based on your requirement.
To access and configure settings:
- Go to ADMIN> Services.
The services view is displayed.
- In the Services panel, select the Context Hub service and click > View > Config.
The Services Config view of Context Hub is displayed.
- Select the data source for which you want to configure the settings and click in the Actions column.
The following screenshot is an example of the Configure RSA Archer dialog:
- In the Settings tab. Configure the following fields:
- Click Cache Settings. Configure the following fields
Click any one of the following options:
- Cancel - select this option to cancel the changes.
- Save - select this option to save the changes.
Save and Close - select this option to save and close the dialog.