Step 3 (optional). Importing a meta group for browsing fields filled by Kaspersky CyberTrace Service
August 22, 2024
ID 167805
This section describes how you can import the MetaGroups.jsn file. This file contains a meta group that you can use to browse only those fields in RSA NetWitness that are filled by Kaspersky CyberTrace Service.
The Kaspersky CyberTrace distribution kit contains the integration/rsa/additional_elements/MetaGroups.jsn
file. This file contains fields named kl.%field_name%
. If you have not added the Kaspersky CyberTrace fields to RSA NetWitness (namely, to the table-map-custom.xml and index-concentrator-custom.xml files), we recommend that you import the MetaGroups_without_kl_fields.jsn file instead of MetaGroups.jsn.
To import the MetaGroups.jsn file:
- Make sure that the Navigate view is enabled in RSA NetWitness.
By default, the Navigate view is disabled in RSA NetWitness version 11.6 and later. To enable the Navigate view:
- Go to
(Admin) > System > Investigation > Navigate.
In version 11.6.0, go to (Admin) > System > Investigation > Investigate.
- Select the Enable Navigate check box.
- Click the Apply button.
- Go to
- On the RSA NetWitness menu, select Investigation > Navigate.
In version 11.6.0, select Investigate > Navigate.
The Investigate window opens.
- Select Meta > Manage Meta Groups.
Manage Meta Groups command
- In the Manage Meta Groups window, click the Import button (
).
Manage Meta Groups window
- Select the MetaGroups.jsn file and click the Upload button (
).
- Select the
CyberTrace_META_GROUP
meta group and click Save and Apply.Adding a meta group