Deployments Tab

Below is an example of the Content > Policies > select a policy > Event Stream Analysis Rule > Deployments tab:

deploy1.png

The following table describes the Deployments tab.

1

Toolbar

  • Create Deployment - Lets you to Add a new Deployment. For more information, see Create a Deployment.

  • Remove Deployment - Lets you to remove the Deployment.For more information, see Remove a Deployment.

  • Deploy - Lets you to deploy the Deployment.

  • Stop Deployment - Lets you to stop the selected Deployment.
2

Deployment List Pane

  • Name - Name of the content.

  • ESA Service - Displays the ESA service selected.

  • Data Source - Displays the Datasource added for ESA deployment.

  • Deployment Status - Status of the deployment. The values are: Deploying, Deployed, New, Stopping, Stopped, and Failed.

  • Last Updated - Displays the time when the deployment is updated.

Create Deployment dialog:

Below is an example of the Create Deployment dialog:

createesadeployment.png

The table describes the information and options in the Create Deployment dialog.

Field Description
Deployment Name

Name of the deployment. The name must be unique.
ESA Service

Displays the list of ESA services from the drop-down list.

  • esaprimary – ESA Correlation

  • esasecondary – ESA Correlation
netwitness_add_button_26x23.png Adds a Datasource from the available list. At least one Datasource is required to set the position tracking information for ESA.
netwitness_deletebutton_28x24.png Deletes the datasource that you are currently editing.
Set Position Tracking Information

Adds a position tracking information on different datasources for ESA. Position Tracking Information enables you to visualize the progress of the sessions that ESA has processed, and provides information on the session IDs and the time/date when the events were processed. For more information, see Position Tracking Information.

Create Data Source Filter

Enables you to create the datasource filter to get the required results.
Save Saves the settings and closes the Create Deployment dialog.

Cancel

Cancels the operations.

 

Below is an example of Add Data Source Dialog.

Add_datasourcedialog_deployment.png

The table describes the information and options in the Add Data Source dialog.

Field Description
Select Datasource / Select All

Allows you to select one or more datasources.
Done Adds the datasource and closes the Add Data Source dialog.

Cancel

Cancels the operations.

 

Below is an example of Set Position Tracking Information dialog.

Set_position tracking_dialog.png

The table describes the information and options in the Set Position Tracking Information dialog.

Field Description
Go To

This option will enable the use of Session ID and data and time for ESA Correlation Service for the events.
Session ID

The ESA Correlation service starts processing the events from the session ID that you entered.
Date and Time The ESA Correlation service starts processing the events from the date and time that you entered.
Calculate Sessions This will calculate the number of sessions that will be processed with respect to the existing position of the data source.
Save Saves the settings and closes the Set Position Tracking Information dialog.

Cancel

Cancels the operations.

 

Below is an example of Create Data Source Filter Dialog

create_data_source_filter.png

The table describes the information and options in the Create Data Source Filter dialog.

Field Description
Data Source Filter

Enables you to enter the data source filter. For example, you can type Select *where service = 443

to filter based on the query processed, it will filter out only HTTPS logs related sessions and will be forwarded to the ESA.
Add Adds the configurations and closes the Create Data Source Filter dialog.

Cancel

Cancels the operations.