RSA Security Analytics Warehouse Challenges

[Anonymous]

Hello All,

Hope you are doing well. Well on the demand on one of my customer for experiencing the Warehouse feature of RSA SA. I have a POC of RSA SA. So due to this I am creating an lab which includes the SAW component integrated with RSA SA. I am facing challenges while deploying the SAW. Below I am writing few points to better understand my situation.

Details Of A RSA SAW Setup

1) First I have an OVF of RSA SAW on 10.3.2 and I have a lab based on 10.4.02. So just want to confirm is it will create any problem to setup the SAW with RSA SA?

2) Do I need to deploy three separate OVF on my ESXi to get these into a cluster, so that they can become a collectivity make a SAW. Seriously is their any requirement to add the three nodes?

3) After a word with RSA CS, I get an one more confusion that I need to add an extra disk drives into separate SAW node?

Is it really required?

4) For deployment of RSA SAW in my environment, I get an temp licenses from the sales dept of RSA. So have a doubt is it will run? or do I need an permanent license to get it registered and perfectly working with SA.

5) As I refer to documents for SAW, I also require any upgrade package, an RPM file, so that I can upgrade my SAW nodes to the latest version.

If the above point is not feasible, so I can upgrade my SAW nodes to the latest version through the yum-update command? Is it will be a right method to get  it upgraded?

6) According to a video available on BrainShark in RSATube, that we need to deploy the license through the commands.

This is the command to get the SAW licensed "maprcli license add –is_file true –license {license file name}".

Or can we add a temp license on SAW through UI with the latest option available on SA to upload a temp license on any of the appliance.

What method I need to follow?

And also during the licensing process on SAW node 1 through command shell, I am facing some challenges in it.

If someone have any idea, that how to achieve the deployment of SAW, kindly suggest their suggestions and views here. That will be a great help for me, as I am not getting the proper answer on my queries from the support.

Thanks to all in advance.

Regards,

Deepanshu Sood.

[Anonymous]

1) First I have an OVF of RSA SAW on 10.3.2 and I have a lab based on 10.4.02. So just want to confirm is it will create any problem to setup the SAW with RSA SA?

10.3.2 is the latest version of the SAW OVF. Follow the instructions to upgrade it to 10.4

2) Do I need to deploy three separate OVF on my ESXi to get these into a cluster, so that they can become a collectivity make a SAW. Seriously is their any requirement to add the three nodes?

Yes - seriously - there is a requirement for at least 3 nodes for the SAW to function properly. I have tried single node SAW configurations for Demos - they will work for a short period of time. For a POC you should definitely use at least 3 nodes.

3) After a word with RSA CS, I get an one more confusion that I need to add an extra disk drives into separate SAW node?

Is it really required?

Earlier SAW OVF's did not create the 3 extra "Data" drives to use for SAW. With the 10.3.2 OVF it includes the extra 3 HDD definitions, but you may want to increase the size. All 3 disks must be the same size.

4) For deployment of RSA SAW in my environment, I get an temp licenses from the sales dept of RSA. So have a doubt is it will run? or do I need an permanent license to get it registered and perfectly working with SA.

The temp license will run fine. It is typically licensed until the end of the month, so make sure you update it when needed.

5) As I refer to documents for SAW, I also require any upgrade package, an RPM file, so that I can upgrade my SAW nodes to the latest version.

If the above point is not feasible, so I can upgrade my SAW nodes to the latest version through the yum-update command? Is it will be a right method to get  it upgraded?

Follow the upgrade instructions for how to get the SAW software up to the latest version of Hive etc.

6) According to a video available on BrainShark in RSATube, that we need to deploy the license through the commands.

This is the command to get the SAW licensed "maprcli license add –is_file true –license {license file name}".

Or can we add a temp license on SAW through UI with the latest option available on SA to upload a temp license on any of the appliance.

What method I need to follow?

The maprcli command you list above is what you use to license the SAW. you cannot license it through the SA temp license from the SA GUI.

[Anonymous]

Hello Samohtc,

Thanks for your response, you have cleared so many of my doubts regarding the same.

But still their is one issue which I am facing, after reffereing to all the docs related on SAW, I am still unable to add the service successfully on RSA SA, whenever I tries to add the service in RSA SA, it got fails every time.

Have any idea? Kindly suggest.

Thanks in advance.

[Anonymous]

With 10.4 you do not add the SAW as a service. It is added directly to the reporting engine as a data source. See here for details: https://sadocs.emc.com/0_en-us/090_10.4_User_Guide/90_WarehouseAnlytc/10_ConfWA