Migrate Content from Core Services to Content Library

The customers who want to use Centralized Content Management, and if their content is already deployed, a migration process is required.

Note: Existing Live content does not need to be exported or imported. All Live content will be available in the Content Library and will only need to be added to one or more policies and published as needed.

This process includes the following steps:

  • Make sure that the necessary Live content has been selected and applied to one or more Policies.

  • Enable subscriptions for Live content as desired.

  • Export any custom content, including Application Rules, Network Rules, Lua Parsers and Log Parsers.

  • Import custom content into the Content Library.

  • Apply custom content to one or more Policies.

  • Create Groups to which Policies will be assigned.

  • Publish Policies to their assigned Groups.

Warning: Initially, when a Policy is published to a Group , all the content which are not included in the policy will be removed from the services in that Group.

To migrate Application Rules or Network Rules

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.
  2. Go to Config view of the service where application rule or network rule is deployed.
  3. Click either the Application Rule or the Network Rule tab.

    Note: The Network Rule tab is only available for Network Decoder services.

  4. Select the content to migrate.
  5. Click Export to export the selected content or click All to export all the content.
  6. Type a file name which contains exported content and import the content to Content Library.

    7. For details on importing content to content library, view Import Content to Content Library topic.

The following table lists the supported file types and file extensions for Application Rules and Network Rules:

Content Supported File Types Supported File Extensions
Application Rules .NWR NA

Network Rules

.NWR

NA

To migrate Feeds, LUA Parsers, or Log Devices

The content file locations are as given below:

  • Feeds content file location: /etc/netwitness/ng/feeds
  • Lua Parsers content file location: /etc/netwitness/ng/parsers
  • Log Devices content file location: /etc/netwitness/ng/envision/etc/devices

You can upload the files which are copied locally from these locations and import these files to Content Library.

For details on importing content to content library, view Import Content to Content Library topic.

The following table lists the supported file types and file extensions for Log Devices, LUA Parsers and Feeds:

Content Supported File Types Supported File Extensions
Feeds .zip

.feed and .token
Log Devices .envision, .zip

Note: The zip file should have a root folder. The root folder should contain the ‘N’ folders for ‘N’ number of content. The 'N' folder names should be the content names. The ‘N’ folders, will contain the respective xml files.

 NA
LUA Parsers .zip

.luax, .lua and .flextoken

Note: Any imported content will be treated as custom content. If imported content has the same name as existing Live content, then it must be renamed upon import. Custom content with the same name can be overwritten.

To create .envision files

  1. Keep all the Log Devices in a root folder in your local drive. For example, "logDevices".

  2. From the command prompt, run the python script specified in the NetWitness Community portal with input argument as the path of the above folder.

    Note: The command to run the python script is "python3 pythonscriptname.py inputArg".

  3. Once you run the script, a new zip named "nw_content_logDevices.zip" is created. This zip file will contain all the envision files.

IMPORTANT: All actions except ‘Export’ are disabled for Application Rules, Network Rules, Feeds, LUA Parsers and Log Devices from Service Config page for all core services if the service is managed by Policy-based Centralized Content Management.