Add an ESA Datasource

You can add one or more ESA data sources, such as Concentrators, to use for your selected ESA Service. This enables you to specify different data sources for each deployment.

To add an ESA Datasource

  1. Go to netwitness_configure.png (CONFIGURE) > Policies.
  2. In the policies panel, click Content.

  3. Under Settings, click Event Stream Analysis > Data Sources.

  4. Click + Add Datasource.

    The Add New Datasource dialog is displayed.

    Add_datasource.png

    Note: You can add a Log Decoder as a data source for ESA. But, it is better to add a Concentrator to take advantage of undivided aggregation as the Decoder may have other processes aggregating from it.

  5. Select a service and click Continue.

    Note: You can add only one service at a time.

    Add_datasource1.png

  6. Do one of the following:

    • Select the Trusted Authentication checkbox.

    • Enter your credentials (username and password) for the datasource.

      Note:
      - If you select Trusted Authentication instead of username and password. This option will enable the use of SSL by default. However, you can still configure the compression settings.
      - If you choose to enter your username and password. You can configure both SSL and compression settings.

  7. To enable the SSL settings, select the SSL checkbox. You can set your desired port number.

    IMPORTANT: Ensure that you turn on SSL only if necessary, in order to avoid performance impact on the SSL protocol.

  8. (Optional) You have the option to adjust the Compression Level for Concentrators on ESA. To enable compression, select the Compression checkbox. You can set the Compression Level for a Concentrator from 0-9:
    • Compression Level = 0 (If compression is enabled, it allows Core Services to control the amount of compression.)
    • Compression Level = 1 (It uses the lowest amount of compression and has the highest performance.)
    • Compression Level = 9 (It uses the highest amount of compression and has the worst performance.)

    Somewhere in the middle between 1 and 9 is usually the best setting, which is what you get when you select a compression level of 0. For more detailed information, see the Core Database Tuning Guide.

    Note: When you set the compression level for a Concentrator on ESA, it sets the same compression level for that Concentrator for ESA Correlation Rules.

  9. Click Test Configuration to make sure that it can communicate with the ESA service.

  10. Click Save.

    After you configure your data sources and they appear in the Available Configured Data Sources dialog, you can use them for your deployment.