Step 3 (optional). Importing a meta group for browsing fields filled by Feed Service

This section describes how you can import the MetaGroups.jsn file. This file contains a meta group that you can use to browse only those fields in RSA NetWitness that are filled by Feed Service.

The Kaspersky CyberTrace distribution kit contains the integration/additional_elements/MetaGroups.jsn file. This file contains fields named kl.%field_name%. If you have not added the CyberTrace fields to RSA NetWitness (namely, to the table-map-custom.xml and index-concentrator-custom.xml files, as described in section "Checking software settings (RSA NetWitness)"), we recommend that you import the MetaGroups_without_kl_fields.jsn file instead of MetaGroups.jsn.

To import the MetaGroups.jsn file:

1. On the RSA NetWitness menu, select Investigation > Navigate.
2. Select Meta > Manage Meta Groups.

   

   Manage Meta Groups command

3. In the Manage Meta Groups window, click the Import button ().

   

   Manage Meta Groups window

4. Select the MetaGroups.jsn file and click the Upload button ().
5. Select the CyberTrace_META_GROUP meta group and click Save and Apply.

   

   Adding a meta group

Page top