Is there a way to stream the logs in near real time within Security Analytics? I've been asked a few times over the past months if there's a view within SA to see the logs coming in that way. I've been on this product for a long time and I've never seen anything like that....I think the closes way would entail constantly refreshing the Events view. Does anyone have insight to this or have an operable workaround?
Thanks,
James
While you can't do this in the GUI, you can do this using NwConsole on the command line. Connect to your concentrator:
NwConsole
sdk open nw://user:password@conc_ip:50005
sdk tailLogs
[root@RSAANZSCSA ~]# NwConsole
RSA Security Analytics Console 10.6.2.1
Copyright 2001-2017, RSA Security Inc. All Rights Reserved.
Type "help" for a list of commands or "man" for a list of manual pages.
> sdk open nw://user:password@con_ip:50005
> sdk tailLogs
Sessions 268304417 to 268304417 have meta range 6530821554 to 6530821554
Running in continuous mode...
Mar 13 14:46:02 rsaanzscnet postfix/bounce[10204]: 700E3815B72E: sender non-delivery notification: 72295815B732
Mar 13 2017 03:44:02 RSAANZSCSA CEF:0|RSA|Security Analytics Audit|10.6.2.1|DATA_ACCESS|sdk.session|6|rt=Mar 13 2017 03:44:02 src=10.63.234.24 spt=57060 suser=admin sourceServiceName=CONCENTRATOR deviceExternalId=66bd07b7-f046-4329-8c68-d4c2b6bd7eda deviceProcessName=NwConcentrator outcome=pending msg=has requested SDK session info
Mar 13 2017 03:44:02 RSAANZSCSA CEF:0|RSA|Security Analytics Audit|10.6.2.1|DATA_ACCESS|sdk.info|6|rt=Mar 13 2017 03:44:02 src=10.63.234.24 spt=57060 suser=admin sourceServiceName=CONCENTRATOR deviceExternalId=66bd07b7-f046-4329-8c68-d4c2b6bd7eda deviceProcessName=NwConcentrator outcome=pending msg=has requested the SDK summary info
you can do some filtering also, for example
sdk tailLogs where "device.type='cacheflowelff'"
James,
That is not part of the product today. I am not sure if there are plans to include it at some point down the road.