Context Hub: Data Sources Tab

Document created by RSA Information Design and Development on Sep 15, 2017Last modified by RSA Information Design and Development on Oct 4, 2017
Version 5Show Document
  • View in full screen mode
  

In the Data Sources tab, you can configure one or more data sources for Context Hub service. Navigate to ADMIN > SERVICES > Select Context Hub service > View > Config > Data Sources tab.

Workflow

This workflow shows the procedure to configure data sources for Context Hub service to view contextual information in the Respond / Investigate views.

Workflow to explain the actions of the Context Hub Data Sources tab

  • The first task is to add a data source
  • The second task is to configure data sources settings to enhance your deployment. This task is optional as the settings for each data source is already configured with default values for optimal performance.
  • And the third task is to view and analyze the contextual information in the Context Summary panel of the Respond or Investigate views.

What do you want to do?

                                      
Role I want to ...Show me how
AdministratorConfigure Data Sources for Context Hub*Configure Data Sources for Context Hub
AdministratorConfigure Hub Data Settings*Configure Context Hub Data Source Settings
AnalystView Contextual Information in Respond View

See the NetWitness Respond User Guide.

AnalystAdd, create and delete list from the Respond or Investigate View

See the NetWitness Respond User Guide.

See the Investigation and Malware Analysis User Guide.

Analyst

Add or delete an entry from an existing list

See the NetWitness Respond User Guide.

*You can complete this task here (that is in the Context Hub Data Sources Tab.)

Related Topics

Quick Look

The following example illustrates how to add a data source for Context Hub service.

                                 
1Click to display the Add Data Source dialog.
2Displays the type of Data Source.
3Name that identifies the Data Source.
4The IP address or hostname of the data source.
5The connection port for the data source. 
6Opens the Configure Settings dialog. You can view and edit the settings to be displayed on the Context Summary panel in the Respond or Investigate views.
7Click Test Connection to verify that the host is connected to the Context Hub service.

Toolbar

The following table describes the toolbar actions.

                           
FeatureDescription
Opens the Add Data Source dialog so that you can add a data source. You can add only one data source of each type. Except in case of Lists and Active Directory data sources which can be added in multiples. For detailed instructions to add a data source, see Configure Data Sources for Context Hub.
Delete a data source. 
If you delete a data source, Context Hub does not consider the deleted service as a data source. All contextual information fetched previously will not be available.
Opens the Edit Data Source dialog. For description of each field in Edit Data Source panel, see Configure Data Sources for Context Hub.
Opens the Configure Settings dialog. You can view and edit the settings for the data sources.
For description of each field in Configure Responses dialog, see Configure Responses for RESPOND Data Sources.

Data Source Configurations

The following table describes the listed configurations.

                               
FeatureDescription
EnabledIndicates whether the data source is enabled or disabled. A solid colored green circle indicates that data source is enabled (). An blank white circle indicates that data source is disabled.
TypeThe type of data source. For example, Lists, Archer, Active Directory, Endpoint, Respond, or Live Connect.
NameThe unique name to identify the data source. For example, Respond \.
AddressThe IP address or hostname of the data source. 
PortThe connection port for the data source and vary based on the data source being added. For example, for Endpoint the port is 9443, for Lists the port is 80 and so on.
Previous Topic:Context Hub References
You are here
Table of Contents > Context Hub References > Context Hub Data Sources Tab

Attachments

    Outcomes