I'm looking for a way to export all events that match a particular
filter. There is a requirement to export a list of URL's (non indexed)
and all of the reports I'm running fail due to either long execution
times, or too much memory. Is there a way t...
Our infrastructure team have asked if we are we able to install the AWS
Cloudhealth agent on our AWS based Netwitness Components. Does anyone
know if doing this affects support at all?
I've included a new meta key under index-concentrator-custom.xml to be
indexed (and be searchable). Is it possible to have this meta
information available for historical / old log data and not just new
data? There is a doc here Rebuilding the Index w...
Hello, I've built a custom parser for an event source which sends logs
in CEF format. To make it a bit more portable, I'd prefer not to require
modifying cef-custom.xml (as per the guide - Custom CEF Parser). Is it
possible to copy the logic from the...
Hello, I'm looking at setting up Automated Threat Detection as per ATD:
Configuring Automated Threat Detection for Suspicious Domains. The guide
talks about making sure the 'FQDN' META is being parsed but it doesn't
talk to why this is required. I'm ...
Cool, so in theory I can just copy the relevant sections from cef.xml
into a new folder, and manually map the source to the new parser?
Additionally, if I'm copying content from the CEF parser there is a risk
all the existing CEF event sources will s...
Thanks Josh, so it doesn't look like the alertMeta is able to be
included in the email. In this case I will need to see if our support
desk software supports making a subsequent API call once it receives the
email with the IncidentID. I must have muc...
Hi Josh, Thanks for the guide - I'd been pointed at this page for
customizing some incident notifications. I want to include the pertinent
alert meta in the email as well so we can get our service desk software
to automatically create tickets. Hoping...
