Skip to main content

Cyware Fusion and Threat Response

Bulk Import and Export

You can import and export sizable volumes of your data into CFTR in bulk using the Import and Export feature.

Bulk Import Assets

You can import the following types of assets in bulk to the CFTR platform:

  • Software

  • Users

  • Applications

  • Devices

Note

A unique set of fields for all the assets must be defined under Admin Panel > Configurations > Assets by your CFTR Admin. The unique fields are used to validate the asset entries.

To import assets, do the following:

  1. From Menu, select an asset.

  2. On the top-right corner of the asset listing page, click the Import icon.

  3. To download the import template, click Template. The import template is downloaded to your local drive in XLSX format.

  4. Update the XLSX file with the import data.

  5. On the asset listing page, click the Import icon and select Import XLSX to upload the template file.

The XLSX file is validated using the assets' unique fields configured by your CFTR Admin. After successful validation of the XLSX file, the assets are imported to CFTR.

Note

CFTR notifies you if duplicate entries are found in the XLSX file. Remove the duplicate entries and upload the file again.

Bulk Export

You can export a list of modules and save it on your local drive.

Note

You can obtain the maximum number of records in XLS and XLSX files under one zip file. The export results are limited to a maximum value of 25000 for one XLS or XLSX file. For example, if you want to download 50,000 records in a go, one zip file is created, enclosing two files with 25,000 records each.

To bulk export components, do the following:

  1. Go to Menu and select a module.

  2. On the top-right corner, click Export.

  3. Select one of the following export file formats: XLS, XLSX, HTML, and JSON.

The export is processed in the background. When the export process completes, you can download the export report from Export Logs. If the email server is configured, a copy of the export is also emailed to your mailbox.

Note

Your profile time zone reflects in the timestamps of the export file.

Advanced Export for Incidents and Actions

Using Advanced Export, you can select an export template to export incidents and actions based on the predefined list of fields. The export templates are defined by your administrator. You can also add the recipients of the export in Additional Recipients.

Note

Advanced Export is only available for Incidents and Actions.

To export incidents or actions using advanced export, do the following:

  1. Go to Menu and select Incidents or Actions.

  2. On the top-right corner, click Export and select Advanced.

  3. On Advanced Export, do the following:

    1. From the Format drop-down list, select an export format. The available formats are XLS, XLSX, HTML, and JSON.

    2. From the Incident Export Template section, select an export template. The Details for Analysis of Incident section displays the fields defined in the selected template.

    3. In the Additional Recipients section:

      1. From the CFTR Users drop-down list, select the recipients.

      2. On the Other Contacts field, enter the email IDs of the recipients separated by a space who are not CFTR users.

  4. Click Export. The export is processed and a download link is updated under the Export Logs.

  5. Go to the Export Logs and click the Download icon.

The exported file is downloaded to your local drive and a copy of the export is emailed to all the recipients.

Note

Your profile time zone reflects in the timestamps of the export file.

Schedule Incident Exports

You can schedule the export of incidents and automatically send the report to the recipients, thereby ensuring that your security team is periodically informed about the incidents that are being created. To schedule incident exports, do the following.

  1. Go to Incidents.

  2. Click the Export icon and select Advanced.

  3. Under Additional Recipients, enter the recipients of the export.

  4. Enable Schedule Export and enter a title for the schedule. An email will be sent to the recipients with this title as the report title.

  5. Select one of the following schedules:

    Note

    Your profile time zone automatically applies to the once, daily, weekly, and monthly schedules. For cron schedules, the default time zone is your profile time zone. You can select a different time zone from the drop-down.

    • Once: The export schedule runs once at the specified date and time. Select a date and time at which the export schedule runs.

    • Daily: The export schedule runs every day at the specified date and time. Enter the start date and time, and select one of the following options to specify the expiry of the schedule:

      • Never: The export schedule runs indefinitely.

      • On: Select a date after which the export schedule expires.

      • After: Enter the number of occurrences after which the export schedule expires.

    • Weekly: The export schedule runs every week on the specified days at the specified date and time. Enter the start date, time, and expiry, and select the days of the week on which the export schedule runs.

    • Monthly: The export schedule runs every month on the specified days at the specified date and time. Enter the start date, time, and expiry, and select a day of the month on which the export schedule runs.

    • Cron: The export schedule executes as per the schedule defined in the cron expression. Enter the start date and preferred time, and enter the following details:

  6. Click Export.

CFTR will process the export as per the specified schedule and send the export file to all the recipients as an attachment in an email.

Note

The profile time zone of the creator of an export schedule reflects in the export files.

Manage Incident Export Schedules

You can update, delete, or run the export schedules from the Incident Schedule Manager. To manage the export schedules, on Incidents, click More and then select Schedule Manager. Incident Schedule Manager shows all the exports that are scheduled by various users. To deactivate a schedule, under Status, disable the toggle button. To update, delete, or run a schedule, click More and select an option.