Main Concept

A package is a box that contains many preconfigured items for a specific vendor or functionality.

Typically a package may contains:

• pattern
• class
• template
• dashboard
• profiles and vendors association
• playbook

In a multitenant environment, a package must be updated tenant by tenant.

Package Installation

You can check the package list to retreive and install pre-configured objects to integrate in you appliance. To install a package you can reach the page from SCM -> Applications -> Packages

Select the package that you need to install and start the process with “Install” button, a popup will appear. To confirm the installation
you need to select the button “Download and Install”

Once downloaded the package, you must associate it with the hosts, to permit the system to automatically associate these hosts to the correct Class, Template, Vendor, and other related objects to permit to parse the log and convert it into events.

Package content preview and filter objects installation

To view the content of the package before the install to Hosts, you can select the button “Customize” near the “Install Button” to view all
the objects inside it. You can also select only objects that you need.

Installation re-run

If you want to associate other hosts after the first package wizard, you can re-run the wizard with the “play” ▶ button near the related
package.

With this options you can: – Add new Host – Configure a different e-mail for all the Rules and Actions – Review the package content with “Customize”)

Package Update

If a new package version is available, a new icon appear under the “play” icon, with double arrows in circle 🔁.

You can review the package content and then update it.

❗ Update Note: please remind that every items in the package may be overwritten (ID of the object as reference) when confirm the updating. This may include name modification, action reset in the LCE Rule or Event Queries actions and so on.

Package removal

To remove a package you can select the “Trash” 🗑 icon then confirm the deletion in the next popup.

Removal Note: Please remind that the removal do not remove the associated active elements, these must be removed manually.

Custom package

In multitenant or multimanagement environment, you can create a custom package. A custom package must be uploaded manually on every tenant and mantain low IDs on the object.

Creation

To create a package you need to go on SCM -> Actions -> Packages

Next you can select elements to include in the package:

1. An already present package to start from. This is used mainly to produce official package.
2. Multiple elements to include like patterns, class, dashboards, rules, templates, event queries, playbook, profiles and vendors.
3. Actions like
   1. Download package: with this option you can download the newly created package. With this option you must provide a name, short description and optional (but recommended) a logo (square format 1:1, any other aspect ratio will be stretched, no trasparent is recommended to provide theme compatibility). The package will start download in encrypted format
   2. Export to tenants: option present only with impersonificated user in multitenant environment. This allow to share elements directly in other tenants. Once selected in the next popup you can select the tenants where to share objects.

Note: pay attention to the objects dependencies (eg. dashboard with widget come from Template or EQ), these are not shown in the page during creation, due to flexibility in the creations steps.

Upload on tenant

Once downloaded the package in encrypted format, you can upload it in other tenants by enter in the target tenant and upload it via
SCM -> Applications -> Upload App.

Once uploaded a new Section in the application will appear “Custom”

Update custom package

When update a custom package, the package match the object by the name and/or ID of the object already present in the appliance, so pay attention by renaming objects already exported or recreating it.