Distribute TDA SD Scripts

Use the interactive distribute command

The interactive distribute command guides you through the process of distributing the bundle - simple select the content type, the content file, select the target Command Centers, and confirm the distribution. The bash commands below illustrate this:

eyeinspect:> distribute
? Select content type to distribute: SD_SCRIPT
? Select content file to be distributed: <file_name.zip>
? Select Command Centers: <CC_IP_Address>
? Given content will be distributed to all sensors connected to selected Command Centers. Do you confirm? true
File distribution was successful for 0 out of 1 selected Command Centers. 
Details of failed distributions per Command Center: 
	Command Center [<CC_IP_Address>]: Distribution to all sensor(s) has failed.
For any unsuccessful distributions, a template file (<file_name.json>) has been created, allowing you to retry the distribution process using the `distribute from-template <file_name.json>` command.
Refer to the log file for more details: <file_name.csv>

This example illustrates a distribution failure. The log file (located at ${HOME}/content-distributor-cli-base/log) shows more details about the failure, as seen below:

Date;Command Center;Sensor Detail;Action Type;Status;Detail
2025-03-11T08:54:54.86864917;<CC_IP_Address>;Passive(<Passive Sensor IP Address>);SD Script Update - Finished;FAIL;Distribution failed for command center <CC_IP_Address> and sensor <Passive Sensor IP Address>. Detailed message: Error occurred while importing custom event types.

As seen above, if an error occurs and the log file contains the message Error occurred while importing custom event types., it indicates that the delimiter setting differs from the one required in the TDA zip file. To resolve this, use TDA zip file with correct delimiter, and run the interactive distribute command again:

eyeinspect:> distribute
? Select content type to distribute: SD_SCRIPT
? Select content file to be distributed: threat_detection_add-ons_v25.03.20-us.zip
? Select Command Centers: <CC_IP_Address>
? Given content will be distributed to all sensors connected to selected Command Centers. Do you confirm? true
File distribution was successful for all selected Command Centers.
Refer to the log file for more details: sd_script-20250311085545.csv

Use the distribute command with parameters

It is possible to distribute the TDA SD Script using the distribute command with parameters, as seen below:

eyeinspect:> distribute with-params SD_SCRIPT threat_detection_add-ons_v25.03.20-us.zip <CC_IP_Address>
File distribution was successful for all selected Command Centers.
Refer to the log file for more details: <file_name.csv>

Use an existing template to distribute

To create a template for future distributions, use the interactive template create command, and enter the relevant information, as seen below:

eyeinspect:> template create 
? Select content type to distribute: SD_SCRIPT
? Select content file to be distributed: threat_detection_add-ons_v25.03.20-us.zip
? Select Command Centers: <CC_IP_Address>
? Input task template name:  tda
The content distribution task template is saved to the file <file_name.json>.
The sensor list can be modified and the distribution task can be initiated by calling `distribute from-template <file_name.json>`

All sensors of the target Command Center are listed in the template file. The target sensors for the distribution can be changed by editing this file:

sudo chown -R $(whoami):$(whoami) ${HOME}/content-distributor-cli-base/export
sudo chmod -R o+w ${HOME}/content-distributor-cli-base/export
nano ${HOME}/content-distributor-cli-base/export/template/<file_name.json>

To distribute the TDA SD Script using an existing template, enter the name of the template and the TDA SD script file, as seen below:

eyeinspect:> distribute from-template tda-20250311091053.json threat_detection_add-ons_v25.03.20-us.zip
File distribution was successful for all selected Command Centers.
Refer to the log file for more details: <file_name.csv>