Subscribing to Live Resources 

This describes subscriptions in Live.

Threats and the corporate landscape change over time. NetWitness periodically reviews existing content to determine whether it needs to be updated based upon current campaigns or has become irrelevant due to changes in technology or attack techniques and tools.

You can discover new content by using the What’s New dashlet within the Default Dashboard, or by searching through NetWitness Live by data range since last deployed. Be sure to subscribe to any content for which you want to receive update notifications.

Subscription Updates

When you view resources in the Matching Resources panel of the Live Content view, there is a column named Updated:

netwitness_liveupdated.png

This value is also displayed when you select the detailed view for a resource. Every time a resource changes, its Updated value changes to match the specific update. If you are subscribed to a resource, and it gets updated, your system is automatically updated with the latest version, and you receive a notification. You can view your notifications by clicking the Notification icon, netwitness_ic-notifbell_22x22.png, from anywhere in the NetWitness UI.

12.2_Notifications_1122.png

You can also get email notifications when subscribed resources are updated. System Administrators can add email addresses in the netwitness_adminicon_25x22.png (Admin) > SYSTEM > Live Services view. For more information, see the "Live Services Configuration Panel" topic in the System Configuration Guide.

Adding Subscribed Resources for Deployment to Services

  1. Go to netwitness_configureicon_24x21.png (Configure) > Subscriptions > Deployments.
  2. In the Groups panel, select a group.
    Subscribed resources, if any, are listed in the Deployments tab Subscriptions panel.

  3. In the Subscriptions panel, click netwitness_add.png.

    The Add Subscription dialog, which lists subscriptions available for deployment, is displayed.

  4. Select the subscribed resources that you want to deploy to the services group.

  5. Click Save.

    The dialog closes and the subscriptions are added to the listing in the Deployments tab, Subscriptions panel. This stages the resources for deployment at the next synchronization.

  6. You can click the Synchronize icon, netwitness_synchronizeicon.png, to immediately synchronize your changes.

Deleting a Subscription

When you delete a subscription to a resource, deployed instances of the resource are not deleted. The deployed resource remains on services until explicitly removed, but the resource is no longer synchronized with the resource in NetWitness Live.

To delete a subscription:

  1. Go to netwitness_configureicon_24x21.png (Configure) > Subscriptions.
  2. In the Subscriptions tab, select the subscriptions you want to delete.

  3. Click netwitness_icon_deletepulldown_23x19.png, then choose Delete to delete your selected resources or Delete All delete all subscriptions.

    A dialog asks for confirmation that you want to delete the subscription.

  4. To confirm removal, click Yes.

    Your selected subscriptions are deleted from the subscriptions list, but any deployed instances of the subscribed resource remain on the services.

Removing Subscribed Resources from the Deployments Subscriptions Grid

Subscriptions that are selected for deployment to a service group are deployed during synchronization. You can remove subscriptions from the Live netwitness_configureicon_24x21.png (Configure) > Subscriptions > Deployments panel, but any that have actually been deployed to services remain deployed until someone removes them.

To remove resources from the Deployments tab Subscriptions panel:

  1. Go to netwitness_configureicon_24x21.png (Configure) > Subscriptions > Deployments

  2. In the Groups panel, select a group.

    Subscribed resources, if any, are listed in the Subscriptions panel.

  3. In the Subscriptions panel, click netwitness_delete.png.

    A dialog requests confirmation that you want to delete the resource from the service group. The resource is removed from the Deployments tab Subscriptions panel, but is not removed from services on which it is deployed.

Subscribe and Unsubscribe to a Resource

When you subscribe to resources, you will receive notification when new versions of the resources are available.

To subscribe to a resource:

  1. Go to netwitness_configureicon_24x21.png (Configure) > Live Content.
  2. In the Search Criteria panel, specify search criteria and click Search.

  3. Select one or more resources and click netwitness_subscribebtn.png.

    A confirmation dialog is displayed: By subscribing to these resources, you are indicating that you wish to receive notification when new versions are available.

  4. To confirm that you want to subscribe to the resource, click OK.

    The resource is added to the subscriptions managed in the Subscriptions tab and is available for deployment in the Deployments tab.

When unsubscribing from a resource, you have the option to leave the resource on services on which it is deployed or to remove it from services.

To unsubscribe from a resource:

  1. Open a detailed view of a resource in one of the following ways:

    • Perform a search, netwitness_configureicon_24x21.png (Configure) > Live Content > enter search criteria, then select the resource in the Matching Resources panel, then click netwitness_detailsbtn.png.

    • View subscriptions, netwitness_configureicon_24x21.png (Configure) > Subscriptions, select the resource from the Subscriptions list, then click netwitness_detailsbtn.png.

          122_Unsubscribe_1122.png  

  2. With the detailed view of a resource displayed. click netwitness_icon-liveunsubscribetext.png.

    A confirmation dialog is displayed.

    netwitness_unsubresourcemsg.png

  3. Do one of the following:

    • To confirm that you want to unsubscribe from the resource and leave it on the services where it is deployed, click Unsubscribe.
    • To confirm that you want to unsubscribe from the resource and remove it from the services where it is deployed, click Unsubscribe and Remove from Services.
    • To close the dialog without unsubscribing, click Cancel.

    The selected action is applied.

Viewing Subscribed Resources Selected to Deploy on Services

In the netwitness_configureicon_24x21.png (Configure) > Subscriptions > Deployments tab you can view subscribed resources that have been selected for deployment on services.

To view subscribed resources that have been selected for deployment on services:

  • In the Groups panel, select a group, and expand it to view services in the group. The resource subscriptions selected for deployment are listed in the Deployments tab Subscriptions panel.