After you have configured the required data sources you can customize the settings for the data sources based on your requirement.

To access and configure settings:

  1. Go to   AdminIcon_25x22.png (Admin) > Services.

    The services view is displayed.

  2. In the Services panel, select the Context Hub service and click > View > Config.

    The Services Config view of Context Hub is displayed.

  3. Select the data source for which you want to configure the settings and click editService.PNG in the Actions column.

    The following screenshot is an example of the NetWitness Endpoint settings dialog:

    EndPoint_Response.png

  4. Configure the following fields:

    FieldDescription
    EnableThis option is enabled by default (checked) and can be used to enable or disable the response from the selected data source.
    Cache Settings

    Any lookup from Context Hub can be stored in the Context Hub cache for a configured time. Response to any subsequent matching request will be fetched from the Context Hub cache.
    Use this section to define the following cache settings for query lookup:

    • Cache Enabled: By default, this checkbox is selected and the query response is cached.
    • Cache Expiration (Minutes): The maximum time the query lookup is retained in cache. The default time is 30 minutes and maximum is 7200 minutes that you can configure.

    List value Expiration

    Enable: Select Enable to define the number of days the list values must be available. By default, this option is disabled and the values are retained.

    Time to Live (Days): Enter the number of days you want to the list values to be retained.

    Meta Mapping

    Any list stored in Context Hub should be made available for a lookup. The lookup in Context Hub is performed based on meta type or entities. Examples IP, HOST, MAC ADDRESS, DOMAIN, FILE_NAME, FILE_HASH, USER.

    Meta Type: Entities available in Context Hub.

    Context Hub Fields: Column headers from CSV file you have added when creating a list.

    Minimum IIOC ScoreThe minimum IIOC score to be considered for fetching contextual information of NetWitness Endpoint modules.

    Query Last (Days)

    The duration (in days) for which the Context Data must be queried.

    LimitThe maximum number of records to be displayed when Context Lookup is performed.

    Recur Every

    Configure recurring schedule to fetch and store contextual data for the required intervals.

  5. Click any one of the following options:

    • Cancel - select this option to cancel the changes.
    • Save - select this option to save the changes.
    • Save and Close - select this option to save and close the dialog.

     

To access and configure settings for STIX data sources

  1. Go to  AdminIcon_25x22.png (Admin) > Services and select Context Hub service.
  2. Click > View > Config > STIX tab.
  3. Select the data source for which you want to configure the settings and click editService.PNG in the Configurations column.

    1. For REST Server, the following fields are displayed.

    advSetREST_1136x645.png
    Configure the following fields for REST Server.

    FieldDescription
    Recur EverySpecify the time frequency in minutes, hours, days or weeks to retrieve the content from the data source.
    1. For TAXII Server, the following fields are displayed.

    AdvSetgs_1136x645.png
    Configure the following fields for TAXII Server.

    FieldDescription
    Retention PeriodSpecify the number of days the content retrieved from the taxi data source must be retained before it is automatically deleted.
    Recur EverySpecify the time frequency in minutes, hours, days or weeks to retrieve the content from the data source .

Based on the data source you select, the Response Groups differ. The following table describes the response groups for every data source.

Data Source (Connection)Response Supported GroupsField Settings
ListIcon.png ListList

Meta Mapping
Meta Type
Context Hub Fields

Settings
Data Prefetch Settings
Schedule Recurrence
List Value Expiration

Cache Settings
Cache Enabled
Cache Expiration (Minutes) [Min is 30 minutes Max is 7200 minutes]

ArcherIcon.png RSA ArcherArcher

Cache Settings
Cache Enabled
Cache Expiration (Minutes)

Settings

Export Attributes Configuration

Export Attributes
Data Prefetch Settings

Schedule Recurrence

ADIcon.pngActive DirectoryUsers

Meta Mapping

Meta Type

Context Hub Fields

Settings

Data Prefetch Settings

Schedule Recurrence

List Value Expiration

Cache Settings

Cache Enabled

Cache Expiration (Minutes)[Min is 30 minutes Max is 7200 minutes]

EPIcon.png RSA Endpoint
IOC
Machines
Modules
Cache Settings
Cache Enabled
Cache Expiration (Minutes)
Settings
Context Panel Settings

Cache Settings
Cache Enabled
Cache Expiration (Minutes)

Settings
Context Panel Settings

Cache Settings
Cache Enabled
Cache Expiration (Minutes)
Settings
Minimum IIOC Score
Context Panel Settings
Respond
AlertsIcon.png Alerts
IncidentsIcon.png Incidents

Context Panel Settings
Data Prefetch Settings
Query Last [Days

Cache Settings
Cache Enabled
Cache Expiration (Minutes)

LCIcon.png Live Connect
Domain
File
IP

Cache Settings
Cache Enabled
Cache Expiration (Minutes)

Settings
Context Panel Settings

File Reputation ServerFile Reputation ServerCache Settings
Cache Enabled
Cache Expiration (Minutes)

STIXIcon_37x35.pngTI

Displays information for STIX data sources.

IP address, email address, domain, filename, URL's, and file hash.

Note: The context lookup for email address and URL will be displayed only if these metas are mapped. To map the metas, navigate to ConfigureIcon_24x21.png (Configure) > System > Investigation > Context Lookup.

Note: After you configure the data source settings, you can configure the Context Hub configuration parameters by navigating to  AdminIcon_25x22.png (Admin) > Services> View > Explore view. Make sure you restart the Context Hub service if you make any configuration changes in the Explore view.

Additional Settings for STIX Data Source

For the STIX data source you can edit the max-taxii-poll-window setting which is by default set to seven days. You can set this value to a maximum of 15 days and a minimum of two days. This setting allows you to maximize the time range to query the TAXII Server in one cycle. For example, if the total range to query the TAXII Server is 30 days, the query data will be divided based on the specified number of days. In this case, the data will be queried every seven days in a 30 days cycle.

To access and edit this settings:

  1. Go to   AdminIcon_25x22.png (Admin) > Services.

    The services view is displayed.

  2. In the Services panel, select the Context Hub service and click > View > Explore.

  3. Navigate to contexthub > enrichment /stix/config.
  4. Click and edit the max-taxii-poll-window field.