Because custom feeds are case-sensitive, the feed will not tag the meta properly if the meta is in a different case than specified in the CSV file. Also, when a feed file with more than one set of double quotes is deployed, Adhoc feeds fail to deploy and recurring feeds deploy but do not make a match.
To make the custom feed case-insensitive, the ignorecase Boolean value must be set to true within the MetaCallback tag in the XML file, for example:
Also, when a feed file that contains double quotes is deployed and double quotes are incorrectly displayed on the RSA Security Analytics UI, you can view the feed file in a text editor to check which string is actually going to be matched against strings in the log file. For example, if you have string “abc” that you want to match from a log file, then when you view the feed file in a text editor, it should also have “abc”. However, the RSA Security Analytics User Interface will display these quotes as truncated for this given string in the custom feed.