Reporting Engine: Sources Tab

Document created by RSA Information Design and Development on Sep 15, 2017Last modified by RSA Information Design and Development on Apr 11, 2019
Version 11Show Document
  • View in full screen mode

Sources Tab

The services configuration parameters are available in the Sources tab of the Services Config view for the Reporting Engine. The Sources tab for the Reporting Engine service in the Services Config view controls that data sources associated with a Reporting Engine. The Source tab consists of a single panel with a toolbar and a grid that lists the data sources associated with the Reporting Engine.


Workflow to explain the additional Reporting Engine settings

RoleI want to...Refer to...
AdministratorConfigure Data Source to Reporting EngineConfigure the Data Sources
AdministratorConfigure Data Source Permissions for Reporting EngineConfigure Data Source Permissions
AdministratorConfigure Data Privacy for Reporting EngineConfigure Data Privacy for the Reporting Engine
AdministratorDefine Reports, Charts, and AlertsDefine Reports, Charts, and Alerts
AdministratorConfigure Reporting Engine SettingsConfigure Reporting Engine Settings

Add, delete or edit a new or available service*

Configure the Data Sources

Set a data source as default*

Configure the Data Sources


Configure data source permissions*

Configure Data Source Permissions

*You can complete these tasks here.

Related Topics

Quick Look

Here is example of the Sources tab where the available services are displayed.

Quick look of the Source tab

1Displays all the available configurable tabs.
2Displays the available configuration parameters for the selected service .
3Displays the field parameters for the selected service.

The data sources available to the Reporting Engine for which you are defining reports, charts and defining alerts are:

  • NWDB Data Sources - The NetWitness Database (NWDB) data sources are Decoders, Log Decoders, Brokers, Concentrators, Archiver, and Collection.

    Note: When a data privacy plan has been implemented to limit access to sensitive data on a data source, you must configure different service accounts in Reporting Engine for privileged and non-privileged users. To configure different service accounts for data privacy, you can add more than one NWDB data source. This procedure is available under Configure Reporting Engine Settings.

  • Warehouse Data Sources - The Warehouse data sources are Horton Works and MapR.
  • Respond  Data Sources - Respond  is used to generate reports on alerts and incidents. The Respond data sources are Reporting Engine, ESA, Malware, EndPoint, and Web Threat Detection. Respond is used to store the alerts and incidents reports.

If you set a source as the default data source, NetWitness Platform uses that source when you create reports and alerts unless you choose to override it with one of the other sources listed in this tab.

Note: You can manage access control to NWDB and Warehouse Data Sources. For more information, see Configure Reporting Engine Settings.


You can perform the following actions on the Sources tab:


This option adds new services as data sources for Reporting Engine. Add existing services (Archiver, Workbench, and Collection) as data sources for Reporting Engine.

For details, see the corresponding topic:

This option removes data sources from a Reporting Engine.

This option configures the Data Source Permissions. This is enabled only for NWDB and Warehouse Data Sources. For more information, see Configure Data Source Permissions.

This option sets the default data sources for a Reporting Engine. This is the source to which NetWitness Platform defaults in the Data source field of the following views:

  • Rule Definition view.
  • Create or Modify Alert view.

The NetWitness Platform data sources are listed under the different categories as follows:

  • NWDB Data Sources category displays the NetWitness data sources.
  • Warehouse Data Sources category displays the Warehouse data sources. 
Clicking the check box selects the data source. After you select it, you can use toolbar to remove the source or set the source as the default.
NameDisplays the name of the data source.
AddressDisplays the IP Address of the data source.
PortDisplays the port of the data source.
TypeDisplays the service type of the data source.
Thread CountDisplays the thread pool size used for executing rules on the data source.

You are here
Table of Contents > Reporting Engine Reference > Reporting Engine Sources Tab