Adding external engines to "External lookup" option

[AdiShraga]

Hi There,

Right-Clicking on an IP address allowing me to choose the option of "External lookup".

I would like to add/remove some of the engines listed in there. do I have the option to do so?

some of them lead to non-relevant links.

Shani Amytai‌

[EricPartington]

you can change them using this path:

Admin > System > Context Menu Actions

https://community.rsa.com/docs/DOC-80337

https://community.rsa.com/community/products/netwitness/blog/2018/10/10/right-click-context-focus-your-attention

https://community.rsa.com/community/products/netwitness/blog/2017/08/21/context-menus-ootb-options

Also which of the items that you have looked at are not relevant?  please add them here so we can get them removed from future releases.

[AdiShraga]

Hi Eric

thank you

I will take a look at the links you have attached.

follow to what you have asked:

1. BFK Passive DNS Collection - leads to 404 error (The requested URL /bfk_dnslogger.html was not found on this server)

2. Malware Domain List - Leads to the right page, but not loading the tested IP automatically

3. ThreatExpert Search - Leads to Symantec page (Symantec - Global Leader In Next-Generation Cyber Security | Symantec )... does it supposed to? where can i see the IP check results?

[EricPartington]

Have created internal ticket to get those either fixed or removed from the next build.

You can disable or remove those context items in the mean time so they do not confuse any analysts that are attempting to use them.

[JordanWigley]

Also, as of v11.2.0.1 (I believe that's correct), you can now create custom Lookup Group Names as well.  The RSA NW dev team changed the Group Name dropdown to allow you to type Free-form text.  The first time you do this, it will create the new group name.  From there on, it will be available as a drop-down item.  This is super helpful, as you can start grouping lookups based on tools/types (Splunk lookups, IP enrichment, Domain enrichment, OSINT, etc).