NetWitness
NetWitness certifications begin with the Associate exam which is the prerequisite to the role-based Specialist exams. Advancing beyond the Associate level, the Specialist exams are specific to the Analyst or Administrator roles. Customers, partners, and employees can take certifications for one or for both roles.
The NetWitness Certified Associate exam is based on the NetWitness Platform Foundations course, NetWitness Administration I course, and the NetWitness Endpoint Foundations course.
The NetWitness Certified Specialist - Administrator exam is based on the NetWitness Administration I and Administration II courses, NetWitness Content Creation courses, and other on-demand training.
The NetWitness Certified Specialist - Analyst exam is based on the NetWitness Platform Foundations, NetWitness Endpoint Foundations, NetWitness Platform Analysis, and NetWitness Platform Introduction to Hunting courses.
At this time, no Expert or Master level exams are being offered for NetWitness.
For users that obtained certifications between January 1st, 2019 and when the new exams are launched, the following mappings will apply:
- Users who obtained legacy NetWitness Logs and Network Administrator, NetWitness Logs and Network Analysts, NetWitness Endpoint Administrator, or NetWitness Endpoint Analyst certifications will be granted the new NetWitness Certified Associate certification
Note: Due to the feature enhancements that went in to making NetWitness a complete Security Information and Event Management (SIEM) solution, all users will need to take the Specialist level exam for their role of choice.
Users that obtained legacy NetWitness certifications (Logs and Network Administrator or Analysts and Endpoint Administrator or Analyst) before January 1, 2019 or are just beginning their NetWitness certification journey are encouraged to begin with the new NetWitness Certified Associate certification and continue through the Proven Professional program in their role of choice.
Important: Be sure to note the expiration date for each exam. Associate level exams do not expire, but subsequent exams carry a two-year lifespan. In order to advance to a higher-level exam, the previous level exam must still be active.
For the most recent information regarding RSA Product Certifications, please click here to access the RSA Certification page on RSA Link.
