Modify a Link Configuration

To modify a Universal Link configuration:

1. Click the Settings icon in the left navigation panel and select Security Analytics.

2. Click Links.

3. Click Universal Links in the left navigation menu and then click the name of the Link you want to modify.

4. Click the Settings icon in the Link tools panel.

   

   The Link configuration editor is displayed.

5. Modify the configuration as described in the following table.

   Setting	Description
   Name	Type a name that facilitates Link management. Only ASCII characters are allowed. Maximum 100 characters.
   Type	Universal Link.
   Universal Link Version	Version of Universal Link. This field is auto-populated once registration with Universal Link succeeds.
   Link Connection Timeout	The period after which Universal Link is not connected to Anomali Security Analytics. The default timeout period is 5 seconds. Edit this field to set a different timeout period.
   Internal Network	One or more IP addresses or IP address ranges in your network that can send data through this Universal Link. Click inside the field and select one or more address ranges in your internal network, or add more IP address ranges in your network.
   Advanced Settings	Select Enable debug logging events only when instructed by Anomali support.

6. Click Save.

Splunk Link

Anomali Link for Splunk autoregisters with Security Analytics with a proper configuration. You typically do not have to modify link configuration settings, but it is possible to modify.

To modify an Anomali Link for Splunk configuration:

1. Click Links in the left navigation menu.

2. Locate the Splunk Link configuration you want to edit and click the hyperlink in the Name column.

   The Link configuration editor is displayed.

3. Complete the configuration as described in the following table.

   Setting	Description
   Name	Type a name that facilitates Link management. Only ASCII characters are allowed. Maximum 100 characters.
   Type	Splunk.
   Splunk User Name	User name that has been configured to authenticate to the Splunk instance.
   Password	The corresponding password.
   Splunk Management URL	The URL for the management port of this Splunk instance. For example: https://<splunk_server_IP>:8089 When the Link is set up on the Splunk deployer, the URL is either https://<splunk_cluster_search_head_IP>:8089 or <https://splunk_cluster_ load_balancer_IP:8089>.
   Drilldown Limit	This is the maximum number of rows returned by the drilldown. Default is 100 rows.
   Index Filter	Default is: index=main

4. Click Save.

Regenerate a Universal Link Configuration

In the Link tools panel, click the Regenerate Now.

Delete a Link Configuration

Select a Link configuration in the leftmost column of the table, click Actions, and select Delete.