Question: DOC 43427

[BobKlannukarn]

Add or Update Supported Event Source Log Parsers 

DOC 43427 says

1. Browse Live for the Event Source Log Parsers that you add or update using RSA Log Device as the Resource Type.

2. In the Live Matching Resources toolbar, click Package > Create

However, I am logged into RSA Live and I do not see a Package button in my window as shown in DOC 43427. I cannot selected multiple files and create a package.

[Anonymous]

Hi Bob,

You might have an issue with your Live setup. As far as I know, you should be able to select multiple items, and you should see the Package button (I've attached an image from a 10.6.3 system).

Can you tell me which version of Security Analytics you are using? And maybe you can check your Live setup?

[BobKlannukarn]

Scott,

We are on 10.6.2.1, but our production NW is air gapped from the Internet.

Bob

[Anonymous]

So, since your system is air-gapped, you won't be able to package up items and deploy them from Live.

Here are your current options:

1. Setup an SA system in a network that can access RSA Live. Create the package and sneaker net it into the air-gapped environment. 
2. Navigate directly to https://cms.netwitness.com/ through a browser and download the content individually (packaging not supported) and sneaker net it into the air-gapped environment.