NetWitness Community

VikramsinghRaja · 2019-05-14

Under ADMIN > Services > (Select an ESA service) > Actions icon > View > Config. we have Event Stream Engine -> Max Patterns Sub expressions ...How to use this parameter. How do we know what number shall we use in this parameter?

VikramsinghRaja · 2019-05-13

I want to deploy rule for Mirai Botnet. Event Device Type is Customdns, Event.threat_Category is Malware and Event.threat_subtype is Mirai Aggregation is 2500 Events in 1 minute. but still I am getting many alerts. What to do to reduce the number of ...

VikramsinghRaja · 2019-08-16

Thank you !!

VikramsinghRaja · 2019-07-16

Thanks very much James

NetWitness Community

User Statistics

User Activity

Event Stream Engine

I want to deploy rule for Mirai Botnet. Event Device Type is Customdns, Event.threat_Category is Malware and Event.threat_subtype is Mirai Aggregation is 2500 Events in 1 minute. but still I am getting many alerts. What to do to reduce the numberof matche

Re: I want to deploy rule for Mirai Botnet. Event Device Type is Customdns, Event.threat_Category is Malware and Event.threat_subtype is Mirai Aggregation is 2500 Events in 1 minute. but still I am getting many alerts. What to do to reduce the numberof matche

Re: Event Stream Engine