Edit, Upload, or Remove a Feed

You can upload a feed, edit an existing feed, or remove a feed.

To edit an existing feed:

  1. Go to netwitness_configureicon_24x21.png (Configure) > Custom Feeds.

    The Feeds view is displayed.

    netwitness_121_feedsconfigcustom_1122.png

  2. In the toolbar, select a feed and click netwitness_edit.png.

    The Configure Custom Feed or Configure Identity Feed panel opens in the Custom Feed wizard.

    netwitness_feedwizdefine.png

  3. If you want to edit the feed file:

    1. Click download file.

      For an Identity feed, the .zip file is downloaded. For a custom feed, the .csv or .xml file is downloaded to your local file system. For a STIX feed, the .xml file is downloaded to your local file system.

    2. Edit and save the file.
    3. In the Define Feed tab, browse for and open the edited file.
  4. Edit any other parameters in the Define Feed tab, Select Services tab, and Define Columns tab that apply to the type of feed.

  5. Anytime before you click Finish, you can:

    • Click Cancel to close the wizard without saving your changes.
    • Click Reset to clear the data in the wizard.
    • Click Next to display the next form (if not viewing the last form).
    • Click Prev to display the previous form (if not viewing the first form).
  6. In the Review tab, review the feed information, and if correct, click Finish.

The feed is recreated with the updated file and new feed specifications. The feed is added to the Feeds list and progress bar tracks completion. Upon successful creation of the feed definition file, the Create Feed wizard closes, and the feed and corresponding token file is listed in the Feeds list. You can expand or collapse the entry to see how many services are included, and which services are successful.

To upload a feed to a Decoder or Log Decoder:

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.

  2. Select a Decoder or Log Decoder service and click netwitness_actiondd.png > View > Config.

    The Services Config view is displayed with the General tab open.

  3. Select the Feeds tab.

  4. In the Feeds tab toolbar, click netwitness_upload.png.

    The Upload Feeds dialog is displayed.

    netwitness_104uploadfeeds.png

  5. In the File grid, click netwitness_add.png and select a feed file. Supported files are *.feed, *.token, and *.filter.

  6. Select the feed file from the File list and click Upload.

    The Upload Job list is updated to show the progress and status of the uploaded feed.

To remove a feed:

  1. Go to netwitness_configureicon_24x21.png (Configure) > Custom Feeds.

    The Custom Feeds view is displayed.
    netwitness_121_feedsconfigcustom_1122.png

  2. In the toolbar, select a feed and click netwitness_delete_icon.png.

    The Delete Custom Feeds dialog is displayed.

    netwitness_customfeed_delete.png

    You can select one of the following options to delete the feed:

    • If you choose to delete the feed from Local DB and Service, the feed is deleted from both the service and the local NetWitness box. The deleted feed will no longer be seen on the NetWitness user interface.
    • If you choose to delete the feed from Local DB Only, the feed is deleted from the local NetWitness box. The deleted feed will not be seen on the NetWitness user interface; however, the last deployed version of the feeds will be present on the service. The undeployed feeds will be deleted forever.

    • If you choose to delete the feed from Service Only, the feed is deleted from the service. The deleted feed will appear on the NetWitness user interface and can be deployed again.

  3. Select where you want to delete the feed and click Delete.

    A warning dialog is displayed.

  4. Click yes to confirm that you want to delete the feed from the select areas.

    • If you chose to delete the feed from the Local DB Only, the feed is deleted.

    • If you chose to delete the feed from the Local DB and Service or Service Only, the Delete Custom Feeds view is displayed showing the progress of the deletion on the service.

      netwitness_customfeed_delprogress.png