Exporting a content pack (classic)

Nexthink Finder is a Windows-only desktop application whose functionality is now available within the Nexthink web interface. Nexthink can now be used directly from a browser and most functions no longer require an additional desktop application.

A previous article explained how to manually share content generated in Finder. To complete the picture, this article explores how to manually export content from the Nexthink web interface and explains how to optionally create a content pack which combines both Finder and the Nexthink web interface content into a single file.

The operations described in this article should only be performed by a Nexthink Engineer or a Nexthink Certified Partner.

If you need help or assistance, please contact your Nexthink Certified Partner.

Exporting modules from the Nexthink web interface

There are two ways to export modules:

Using the graphical user interface (GUI)
Using the command line interface (CLI)

Graphical user interface

the Nexthink web interface GUI provides a quick way to export a specific module with all its associated metrics.

Please note that the categories and scores used in the metrics are not exported. When importing the content pack using Finder, the required categories and scores must be present.

To export a personal or published module:

Log in to the Nexthink web interface.
Display the desired module.
Click on the menu icon in the upper-right corner.
Select "Export module..." and the web browser will download it as an XML file.

This file can be imported via Finder using the same method you would employ to import any other content pack.

Command line interface

The export process using the CLI takes the specified module and produces an XML file as output. This file can later be imported into another setup from Finder by following the same steps you would use to import any other content pack. By default, the tool only lists and exports those modules that are published.

To export a published module:

Log in to the CLI of the appliance hosting the Nexthink web interface.
Go to the directory holding the export script: cd /var/nexthink/portal/rsquery
Optional: Display the usage of the export script: ./exportLibraryV6.py --help
Optional: List all the published modules available for export: ./exportLibraryV6.py --list
Export a module to an XML file: ./exportLibraryV6.py --export --moduleName="name" \ --exportfilename="/tmp/module.xml"

You can export more than one module at a time by specifying several modules by their name or their UIDs in the export command.

Creating a single content pack file

With the knowledge of how to export modules from the Nexthink web interface and other content from Finder, you now have the tools to export any kind of content from one setup to another. If you want to put all the exported content from both the Nexthink web interface and Finder into a single content pack file, you can edit your own content pack XML file and add all the content to it.

If you want to include the Nexthink web interface modules, it is recommended to reuse the XML file generated by the Nexthink web interface as a starting point to build your own content pack. In any case, the XML of a content pack has the following structure:

<?xml version="1.0" encoding="UTF-8"?>
<Pack Description="brief description" Name="name" SyntaxVersion="1">
  <Contents>
    <Content Type="type of content">
      <!-- Copy your content here -->
    </Content>
    ...
  </Contents>
</Pack>

Inside each Content tag, you can copy Finder or the Nexthink web interface content that you have previously exported as XML files after removing their own XML header. In the case of Finder content, the XML must contain a tree of objects and not a single object. To export a tree of objects from Finder, group the content in a folder and export the folder. Alternatively, export a tree of objects by exporting a whole section: right-click the header of a section in the accordion and select Export. For instance, to export all your categories at once from Finder, right-click the header of the Categories section in the left-hand side accordion and select Export.

Indicate the type of content that you have copied inside the Content tag by setting the value of the Type attribute. Below is a list of all possible values for the Type attribute:

PortalinterfaceModuleCollection

Indicates that the content comprises modules exported from the Nexthink web interface.

investigations-tree

Indicates that the content is a set of investigations.

services-tree

Indicates that the content is a set of services.

metrics-tree

Indicates that the content is a set of metrics.

fields-tree

Indicates that the content is a set of categories.

ObjectOneClicksTree

Replace Object by the actual name of an object to indicate that the content is a set of one-clicks relative to that object. Object may be one of the following: User, Device, Package, Application, Executable, Binary, Port, Destination, Domain, Execution, Connection or Web_request.

scores-tree

Indicates that the content is a set of scores.

publications-tree

Indicates that the content is a set of campaigns.

actions-tree

Indicates that the content is a set of remote actions.

Note that the Settings section in the accordion of Finder is different when exporting content because it exports only the content that it is displaying at the moment, be it alerts or one-clicks.

One-clicks in particular act differently on their own. When exporting all one-clicks at once and not only one-clicks associated to one kind of object, Finder actually generates a content pack (not a simple tree) which itself includes all the trees of one-clicks associated to each kind of object. Keep this in mind when editing your own content pack.

RELATED TASKS

Last updated 5 months ago