Updating Custom Feeds

[Anonymous]

OK I have successfully created several custom feeds for things like bad IP or Bad Domain.  Now I have to keep these feeds up-to-date on a regular basis.  Can I just recomplied the .feed file and upload it and the CSV file to the decoders, then restart the decoder service?  Are there better ways of doing this.  I ultimately want to automate this process as much as possible any suggestions in this area would be appriciated.  Attached are examples of the XML and the CSV.

Phil    

[Anonymous]

Are you using security analytics?  If so, they already have a built in method to doing this.  You just need to add the feed as a recurring task and host the csv somewhere that you can give access to SA.  This way you can just update the csv and it will update on its own. 

[Anonymous]

Thank you for the response.  I am using NetWitness 9.8.1.5.  So I am not sure if that technology still applies.  My documentation tells me I need to create xml files like the one attached and than provide the csv of the content I want to tag.  I than use the nwconsole to create a .feed file out of the two.  After that I just upload the feed to the decoder and restart the decoder service.  If you know another way to do this with my version of NW I would love to hear it.