NetWitness 12.x Enabling or Disabling Policy-based Centralized Content Management for Individual Services

[#1]

Article Number

000002108

Applies To

RSA Product Set: NetWitness Platform
RSA Product/Service Type: RSA NetWitness Platform
RSA Version/Condition: 12.1
Platform: CentOS

Issue

Prior to 12.1 version, content of the core services could be managed simultaneously either via policy-based Central Content Management (CCM) or Service Config page/Live content UI. Managing content in this way could cause policies to go out of sync with the actual content of the services.
 

Resolution

From 12.1 version onwards, content of core services can be managed only either via CCM or via Service Config page/Live content UI.
There is a toggle introduced in 12.1 version which allows the user to switch between CCM and Service Config page/Live UI. This toggle is available via backend of source-server. Through the backend server, the user can disable or enable CCM for an individual service.
In 12.1 version, by default, CCM is enabled to manage all services.

• The service config page is read-only. Only ‘Export’ button is enabled in service config page to export content from service config page.
• Content cannot be deployed to CCM enabled services via Live Content UI.
• Content for all CCM enabled services can be managed via Content Policies and the Content Library.
• Content subscription from CCM overrides content subscription from Image description (CONFIGURE) > Subscriptions page.

When CCM is Disabled:

• Content can be deployed from Live Content UI.
• The content of the service can be managed from service config page. Any changes made via service config page does not reflect in content policy.
• The service is disabled in the Policy/Group page of CCM and the policy status changes to “Partial”. The policy can be published with a disabled service. However, the policy state always remains "Partial". Publishing a policy will affect only the services that are enabled for CCM.

Note: When a service, which is part of a group, is added back to CCM, the policy status changes to “Unpublished”.

Following are the steps to enable or disable CCM for individual services:

1. Connect through SSH to NW server node
2. Run the following commands:

a)	nw-shell
b)	connect --service source-server
c)	cd /rsa/central/service/
d)	cd toggle-managed-by-legacy
e)	invoke '<service_name>'
example: invoke 'NWAPPLIANCE18845 - Log Decoder'