Alerting: Configure Context Hub List as an Enrichment Source

Document created by RSA Information Design and Development on Mar 27, 2018Last modified by RSA Information Design and Development on Sep 12, 2018
Version 2Show Document
  • View in full screen mode
 

Note: The information in this topic applies to RSA NetWitness® Platform Version 11.1 and later.

This topic provides instructions on how to configure a Context Hub list as an enrichment source for ESA. Once a Context Hub list is added as an enrichment source, analysts can use the configured list as a statement condition when creating an ESA rule. Any changes made to the list from within Context Hub are automatically reflected in the enrichment source in real-time. For example, you could create a list of IP addresses in Context Hub and then use that list as either a blacklist or whitelist as part of a correlation rule condition. Any subsequent changes made to the IP list in Context Hub will be reflected in the enrichment source in real-time, to ensure the correlation rule operates with a constantly updating set of information.

Prerequisites

Before configuring a Context Hub list as an enrichment source, the list must first be created as a data source in Context Hub. Any list created in Context Hub is supported and the lists may contain string or numeric values, including IP addresses. For information on creating a list as a data source in Context Hub, see the RSA NetWitness Context Hub Configuration Guide.

Caution: When creating a Context Hub list for use as an enrichment source, the list name and its field names cannot include any spaces or special characters, or start with a number. If you do not follow this naming convention, when you attempt to add the list as an enrichment source in ESA, an error message will be displayed and you will not be allowed to add the list.

Configure a Context Hub List as an Enrichment Source

  1. Go to CONFIGURE > ESA Rules > Settings tab.
  2. In the options panel, select Enrichment Sources.

    The Enrichment Sources panel is displayed.

    Enrichment Sources panel

  3. From the Add drop-down drop-down menu, select Context Hub.
    Context Hub List dialog for adding new enrichment source
  4. Select Enable to enrich alerts with a Context Hub list. This is selected by default. If disabled, the alerts will not be enriched with the configured Context Hub list.
  5. Select the desired Context Hub list from the Select List drop-down menu of pre-configured lists.
  6. (Optional) In the Description field, type a brief description about the selected Context Hub list. The text entered here is displayed on the Enrichment Sources panel.
  7. In the Columns field, all columns included in the selected Context Hub list are listed. Click to enable or disable the columns in the list that you wish to include when using this list as an enrichment source in an alert.
  8. (Optional) Click to enable the Page To Local Store option. This option is useful if you have a very large list and performance is affected. If this is the case, enabling this option will write a copy of the Context Hub list to the local disk to improve performance.
  9. Click Save.
    The Context Hub list is configured. You can now add it to an ESA rule as part of a condition statement as either a blacklist or a whitelist condition.

The following figure illustrates adding a Context Hub list as part of a condition statement. In this example, a context Hub list named "multicolumnlist" was added as a blacklist condition. The list contains two columns, SourceCity and DestinationCity. The next step would be to select one of the column names as the subcondition and then specify the operator and enter the meta value for the corresponding value field.

Build a Statement dialog showing Context Hub list added as a blacklist condition

For complete details for adding a whitelist or blacklist to a condition statement, see Step 2. Build a Rule Statement.

To add a Context Hub list as a condition to an existing rule, select to edit the desired rule in the Rule Library, then add a condition in the Conditions section and select to add a whitelist or blacklist condition to the new condition statement.

You are here
Table of Contents > Add a Data Enrichment Source > Enrichment Sources > Configure Context Hub List as an Enrichment Source

Attachments

    Outcomes