As the title suggests, I'd like to know if it's possible to add new event sources via the API or if that's not available perhaps via MongoDB Manually adding/updating hundreds of event sources is quite tedious so a better way to use automation or bulk...
Hi, I have observed that meta keys "pardm.src" or "param.dst" which contains directory path. when we click on parameter then some time it return the directory path with "/" and some time it return with "//". e.g. param.src='xxx.exe "c:\\users\\xyz\\a...
Need some best recommendation about fine tuning of APP rules. if I want to fine tune multiple hashes which are generation many False Positives so what is the best way to fine-tune 1- Whitelist the file and update the app rule with below contect != 'f...
Has there been a comparison of NetWitness Endpoint to other E/XDR solutions out there? I'm looking for information that will help me decide if NWE is up to the task that we require of it.
Dears, As per my understanding any parameter in " " is not parsed, and cannot be fine-tuned. I am working on multiple App rules to reduce the false positive but majority of the app rules are based on either "param.dst" or "param.dst" but we I tried t...
