Editing an Ingest Feed Configuration

Security Requirements and Controls

You can edit an existing ingest feed in order to change the configuration, for example to change details related to the AWS SQS queue.

  1. Go to the repository where you created the feed and select Ingest feeds under the Ingest section of the side menu.

  2. Search for the feed you want to edit using the search box, if required, then click the ellipsis next to the feed you want to edit and select Edit.

    Ingest Feeds - Edit

    Figure 82. Ingest Feeds - Edit

  3. You can now edit the configuration as required, where:

    • Name

      Type a name for your feed

    • Description

      type a meaningful description for the feed.

    • Compression

      select a compression type from the drop down menu, Auto (default) uses decompression based on MIME type and file extension.

    • Preprocessing

      define how the data is processed prior to ingestion, it can be split by AWS records, which is used, for example, by CloudTrail or split by new line, which is used by VPC Data flow logs for example, the way data should be preprocessed depends on the log source.

    • Parser

      select the parser to apply to ingest data, the parser can be any parser that is on repository, predefined, from a package, or custom, see Parsing Data for more information.

  4. Click Next to edit confirm any changes and make changes to the AWS configurations, see AWS Steps Phase 2 for details on the values used in this section.

  5. Click Test AWS feed to verify the configuration and Save to save the changes, or Cancel to discard the changes.