Step 3 (optional). Importing a meta group for browsing fields filled by Kaspersky CyberTrace Service

This section describes how you can import the MetaGroups.jsn file. This file contains a meta group that you can use to browse only those fields in RSA NetWitness that are filled by Kaspersky CyberTrace Service.

The Kaspersky CyberTrace distribution kit contains the integration/rsa/additional_elements/MetaGroups.jsn file. This file contains fields named kl.%field_name%. If you have not added the Kaspersky CyberTrace fields to RSA NetWitness (namely, to the table-map-custom.xml and index-concentrator-custom.xml files), we recommend that you import the MetaGroups_without_kl_fields.jsn file instead of MetaGroups.jsn.

To import the MetaGroups.jsn file:

  1. Make sure that the Navigate view is enabled in RSA NetWitness.

    By default, the Navigate view is disabled in RSA NetWitness version 11.6 and later. To enable the Navigate view:

    1. Go to RSA NetWitness admin icon. (Admin) > System > Investigation > Navigate.

      In version 11.6.0, go to (Admin) > System > Investigation > Investigate.

    2. Select the Enable Navigate check box.
    3. Click the Apply button.
  2. On the RSA NetWitness menu, select Investigation > Navigate.

    In version 11.6.0, select Investigate > Navigate.

    The Investigate window opens.

  3. Select Meta > Manage Meta Groups.

    Investigate → Navigate → Meta → Manage Meta Groups menu item in RSA NetWitness.

    Manage Meta Groups command

  4. In the Manage Meta Groups window, click the Import button (Import button in RSA Netwitness.).

    Manage Meta Groups window in RSA NetWitness. Import button.

    Manage Meta Groups window

  5. Select the MetaGroups.jsn file and click the Upload button (Upload button in RSA NetWitness.).
  6. Select the CyberTrace_META_GROUP meta group and click Save and Apply.

    Manage Meta Groups window in RSA NetWitness. Adding a Meta group.

    Adding a meta group

Page top