Question: DOC 43427
DOC 43427 says
- Browse Live for the Event Source Log Parsers that you add or update using RSA Log Device as the Resource Type.
In the Live Matching Resources toolbar, click Package > Create
However, I am logged into RSA Live and I do not see a Package button in my window as shown in DOC 43427. I cannot selected multiple files and create a package.
- air gap
- Community Thread
- doc 43427
- Forum Thread
- log device
- netwitness secops
- network security
- RSA NetWitness
- RSA NetWitness Platform
You might have an issue with your Live setup. As far as I know, you should be able to select multiple items, and you should see the Package button (I've attached an image from a 10.6.3 system).
Can you tell me which version of Security Analytics you are using? And maybe you can check your Live setup?
- Setup an SA system in a network that can access RSA Live. Create the package and sneaker net it into the air-gapped environment.
- Navigate directly to https://cms.netwitness.com/ through a browser and download the content individually (packaging not supported) and sneaker net it into the air-gapped environment.