How to add custom meta keys in RSA NetWitness Platform

[#1]

Article Number

000001288

Applies To

RSA Product Set: NetWitness Platform
RSA Product/Service Type: NetWitness Core services
RSA Version/Condition: 10.6.x, 11.x

Issue

How to add custom meta keys in RSA NetWitness?
What is the process of adding custom language keys in RSA NetWitness?
After adding custom meta keys in my concentrators, I can see the custom meta keys show up when Investigating directly using the concentrators, but why is the broker rendering errors in Investigations such as below:

Image description
 

Resolution

How to add custom meta keys in RSA NetWitness Platform

Changes to default meta keys' configuration and the addition of new custom meta keys is made to the custom XML file, index-<service>-custom.xml which will be in the /var/netwitness/ng directory.

For example,
Decoder service has index-decoder-custom.xml
Log Decoder service has index-logdecoder-custom.xml
Concentrator service has index-concentrator-custom.xml

The index-<service>-custom.xml file requires the basic xml definition statements at the top and bottom of the file to work correctly, so ensure that these lines exist when adding new keys.  By default, these xml definition statements and some comments (instructions) are already written for you in the file, do not delete them, just add your custom keys lines as directed on the file.
If these lines are not present in the XML file, the service will not start and errors will be generated in the /var/log/messages file.

This example shows an XML file with no custom meta keys and includes just the default xml file format with some comment lines.
Image description

This example shows an XML file with a single custom meta key for "Destination E-Mail Address", settings are set to "IndexValues" with a format of "Text" and a valueMax of 2500000.
Image description

To save and deploy the new setting on the NetWitness appliance, select the Apply button.

The XML file can also be deployed to other NetWitness appliances by clicking on the Push button and selecting the destination NetWitness appliance.  Only deploy the XML file to a NetWitness appliance that runs that service.

Note: Any entries in the index-<service>-custom.xml file will replace any similar entry in the default index-<service>.xml files.
So, if want to change any default meta key in the standard index-<service>.xml file (for example change a IndexKeys setting to IndexValues) simply copy the line for that meta key entry into the custom XML file and change the settings for that meta key there.

If you have any questions about the information above or experience any issues, contact RSA Support and quote this article ID for further assistance.