000035810 - How to designate a custom language key for source and destination IP information within a single custom feed in RSA Security Analytics

Document created by RSA Customer Support Employee on Jan 25, 2018•Last modified by RSA Customer Support Employee on Sep 26, 2018
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000035810
Applies ToRSA Product Set: Security Analytics, NetWitness Logs & Packets
RSA Product/Service Type: Decoder
RSA Version/Condition: 10.6.x
Platform: CentOS
O/S Version: 6.x

This will not work on a Log Decoder 
IssueThere is no way in the RSA Security Analytics UI to create a feed that places values into a source and destination language key.
ResolutionSteps for creating a feed with a source and destination representation 
The full steps for creating a Custom Feed can be found in the RSA Security Analytics documentation.
Below are the steps to editing the XML file.

In the UI when you are creating a custom feed, the first screen that displays is the define feed screen. Once the Feed is given a name and the .csv file is uploaded there is a drop-down menu that you can select that is labeled Advanced Options, select this. The .csv file has IP addresses and the locations. An option to insert an XML Feed file will display and you will need to upload the file. Below is an example of an XML file that is used to denote what the source and destination IP addresses are. 

<?xml version="1.0" encoding="utf-8"?> 
<FDF xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="feed-definitions.xsd"> 
<FlatFileFeed name="CustomFeed" 
path="Locations.csv" 
separator="," 
comment="#"> 

<LanguageKeys> 
<LanguageKey name="Location" valuetype="Text" srcname="Location.src" destname="Location.dst" /> 
</LanguageKeys> 
<Fields> 
<Field index="1" type="index"/> 
<Field index="2" type="value" key="Location"/> 
</Fields> 
</FlatFileFeed> 
</FDF>


The name that I have given the Feed in the UI is the same name that the name is in this XML file and this name is CustomFeed. The path in the XML file is the name of the .csv file that was used in the UI. In this example, the meta keys Location.dst and Location.src will have to be created. 
NotesWhen using cider notation it must be defined in the XML file under the Field tag for example (below)

<Field range="cidr" type="index" index="1"/>

Attachments

Outcomes