Hi,Scenerio:A log is parsed into below meta keys aba = 'xxxx' dda =
'yyyy' ..... I have blacklist of aba,dda pair
blacklisted_account,aba1,dda1 blacklisted_account,aba2,dda2 I need to
alert if any log has aba=aba1 and dda=dda1 OR aba=aba2 and dda=dda...
So a cron job has to run on SA Broker That does 1. Execute below
commands in sequence CURL http://application/feeds/multiblacklist.csv
NwConsole –c feed create multiblacklist.xml cp *.feed
/etc/netwitness/ng/feeds NwConsole –c parsers feed op=notify ...
oh wow.the UI doesn't let me have multi index feed so i assumed it is
not possible.just realized editing xml will work to have multi index
feed.I will try and let you know. Thanks Have a good weekend
Hi Christopher,I have 10k+ blacklisted (aba,dda) pairs and growing.So
they have to go to a feed that has to be matched against meta key pair
aba,dda in the log for the alert to fire.hence manual addition in app
rule doesn't work.
