App rule 'remote directory Traversal' generating high number of alerts on EPLH, and I tried to fine tune this app rule but whenever i tried to filter based on "param.src" all Mata keys disapper. This app rule is very generic and it need a lot of fine...
How can I uninstall snare agent in all the servers with sccm. As we are using nweagent now we are receiving duplicate logs from the same server.
Would there be any appeitite in creating a NetWitness Slack Channel to allow for RSA Staff and Customers to connect with? Many vendors are doing this lately and could be a low friction way for customers of NetWitness to connect with one another to di...
When reviewing the files in NWE there are 1000s of files that report as being on zero 0 hosts? Can someone help me understand why that is and what can I do to remove them? If they are on no hosts then shouldn't they not be reporting upon? This is an ...
Hello All, We have 500+ servers in Endpoint security. Daily we are getting multiple alerts from below two use cases. We could see the file names with MEMORY_DLL…………… and most of are the file less and communication and file hashes are clean. Is there ...
