How to change the default service for investigation

By default, if you have a Broker installed on an Admin server, then the service ID of a Broker will be automatically updated in Cloud Link Service as default service for investigation on the NetWitness Platform user interface for Detect AI. However, if there are no Brokers installed on an Admin server, then any one of the service ID of a Broker installed on another node will be automatically updated in Cloud Link Service. If you want to set a specific service ID for a Broker, you can configure in the Explore view of the Cloud Link Service on the NetWitness Platform user interface.

To locate the service ID for a Broker:

  1. Log in to the NetWitness Platform.

  2. Go to admin icon Admin > Services.

  3. In the Services list, search Broker in the Filter field.

  4. Select a Broker, and click action button > View > Explore.

    The Explore view for the Broker is displayed. services view

  5. On the left panel, click sys > stats.

    The service ID is displayed on the right panel. services view

To set the service ID for a Broker:

  1. Log in to the NetWitness Platform.

  2. Go to admin icon Admin > Services.

  3. In the Services list, search Cloud Link Server in the Filter field.

  4. Select the Cloud Link Server and click action button > View > Explore.

    The Explore view for the service is displayed. services view

  5. On the left panel, click cloudlink/sync.

  6. Edit and enter the required service ID of a broker in the default-service-for-investigation parameter field. broker view


Submit Feedback
© 2020 RSA Security LLC or its affiliates. All Rights Reserved.