Step 3 (optional). Importing a meta group for browsing fields filled by Kaspersky CyberTrace Service

This section describes how you can import the MetaGroups.jsn file. This file contains a meta group that you can use to browse only those fields in RSA NetWitness that are filled by Kaspersky CyberTrace Service.

The Kaspersky CyberTrace distribution kit contains the integration/rsa/additional_elements/MetaGroups.jsn file. This file contains fields named kl.%field_name%. If you have not added the CyberTrace fields to RSA NetWitness (namely, to the table-map-custom.xml and index-concentrator-custom.xml files), we recommend that you import the MetaGroups_without_kl_fields.jsn file instead of MetaGroups.jsn.

To import the MetaGroups.jsn file:

1. Make sure that the Navigate view is enabled in RSA NetWitness.

   By default, the Navigate view is disabled in RSA NetWitness version 11.6 and later. To enable the Navigate view:

   1. Go to (Admin) > System > Investigation > Navigate.
   2. Select the Enable Navigate check box.
   3. Click the Apply button.
2. On the RSA NetWitness menu, select Investigation > Navigate.

   The Investigate window opens.

3. Select Meta > Manage Meta Groups.

   

   Manage Meta Groups command

4. In the Manage Meta Groups window, click the Import button ().

   

   Manage Meta Groups window

5. Select the MetaGroups.jsn file and click the Upload button ().
6. Select the CyberTrace_META_GROUP meta group and click Save and Apply.

   

   Adding a meta group