Exporting a content pack


Exporting a content pack


In a previous article, we have already seen how to manually share content generated in the Finder. To complete the picture, learn here how to manually export content from the Portal and, optionally, how to create a content pack for combining both Finder and Portal content into a single file.

The operations described in this article should only be performed by a Nexthink Engineer or a Nexthink Certified Partner.

If you need help or assistance, please contact your Nexthink Certified Partner.

Exporting modules from the Portal

There is currently no graphical interface to exporting modules from the Portal; therefore you need to use the command line. The export process takes the specified module and produces an XML file as output. This file can later be imported into another setup from the Finder in the same way as you would import any other content pack. Note that the tool only lists and exports published modules by default.

To export a published module:

  1. Log in to the CLI of the appliance hosting the Portal.
  2. Go to the directory holding the export script:
    cd /var/nexthink/portal/rsquery
  3. Optional: Display the usage of the export script:
    ./exportLibraryV6.py --help
  4. Optional: List all the published modules available for export:
    ./exportLibraryV6.py --list
  5. Export a module to an XML file:
    ./exportLibraryV6.py --export --moduleName="name" \

You can export more than one module at a time by specifying several modules by their name or their UIDs in the export command.

Creating a single content pack file

With the methods for exporting modules from the Portal and other content from the Finder, you have now at your disposal the tools to export any kind of content from one setup to another. However, for your convenience, you may want to put all the content that you want to export from both the Portal and the Finder in a single content pack file.

To that end, edit your own content pack XML file and add all the content to it. If you want to include Portal modules, it is recommended to reuse the XML file generated by the Portal as a starting point to build your own content pack. In any case, the XML of a content pack has the following structure:

<?xml version="1.0" encoding="UTF-8"?>
<Pack Description="brief description" Name="name" SyntaxVersion="1">
    <Content Type="type of content">
      <!-- Copy your content here -->

Inside each Content tag, copy the Finder or Portal content that you have previously exported as XML files, after removing their own XML header. In the case of Finder content, the XML must contain a tree of objects and not a single object. To export a tree of objects from the Finder, group the content in a folder and export the folder. Alternatively, export a tree of objects by exporting a whole section: right-click the header of a section in the accordion and select Export. For instance, to export all your categories at once from the Finder, right-click the header of the Categories section in the left-hand side accordion and select Export.

Indicate the type of content that you have copied inside the Content tag by setting the value of the Type attribute. See below the list of all possible values for the Type attribute:

Indicates that the content are modules exported from the Portal.
Indicates that the content is a set of investigations.
Indicates that the content is a set of services.
Indicates that the content is a set of metrics.
Indicates that the content is a set of categories.
Replace Object by the actual name of an object to indicate that the content is a set of one-clicks relative to that object. Object may be one of User, Device, Package, Application, Executable, Binary, Port, Destination, Domain, Printer, Execution, Connection, or Web_request.
Indicates that the content is a set of scores.
Indicates that the content is a set of campaigns.

Note that the Settings section in the accordion of the Finder is special when exporting content, because it exports only the content that it is displaying at the moment, be it alerts, one-clicks, or Web API investigations. Note also that the import of Web API investigations via a content pack is not supported. Do not include Web API investigations in your content packs.

One-clicks in particular are also special on their own. When exporting all the one-clicks at once and not only the one-clicks associated to one kind of object, the Finder actually generates a content pack (not a simple tree) which itself includes all the trees of one-clicks associated to each kind of object. Keep this in mind when editing your own content pack.