Change the Default Service for Investigation

By default, if you have a Broker installed on an Admin Server, then the service ID of a Broker will be automatically updated in Cloud Link Service as default service for investigation on the NetWitness Platform user interface for UEBA (Cloud). However, if there are no Brokers installed on an Admin server, then any one of the service ID of a Broker installed on another node will be automatically updated in Cloud Link Service. If you want to set a specific service ID for a Broker, you can configure in the Explore view of the Cloud Link Service on the NetWitness Platform user interface.

To locate the service ID for a Broker

1. Log in to the NetWitness Platform.

2. Go to Admin > Services.

3. In the Services list, search Broker in the Filter field.

4. Select a Broker, and click > View > Explore.

   The Explore view for the Broker is displayed.

   

5. On the left panel, click sys > stats.

   The service ID is displayed on the right panel.

   

To set the service ID for a Broker

1. Log in to the NetWitness Platform.

2. Go to Admin > Services.

3. In the Services list, search Cloud Link Server in the Filter field.

4. Select the Cloud Link Server and click > View > Explore.

   The Explore view for the service is displayed.

   

5. On the left panel, click cloudlink/sync.

6. Edit and enter the required service ID of a broker in the default-service-for-investigation parameter field.

   

See also

• Install Cloud Link Service
• Update the Cloud Link Service Automatically