Does anyone have a good example for creating domain based netwitness feeds? We have Live Manager and many of the domains feeds enabled, but would like to deploy custom domain feeds from other internal threats or intel. Any assistance would be greatly appreciated, thanks!
Sorry to bump this thread but it describes exactly what I am trying to do. I understand the XML. What I don't understand is where hits on this feed will appear within Investigator, e.g. in which report. What report type will this Meta appear under (e.g. 'risk: informational' or 'risk: warning' etc etc)? Where is this set?
More generally, does anyone have a document they are willing to share on creation of custom feeds? The userguide is a bit vague in this area!
