This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Discussions
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
  • NetWitness Community
  • Discussions
  • Topics with Label: RSA NetWitness Platform
  • Options
    • Mark all as New
    • Mark all as Read
    • Float this item to the top
    • Subscribe
    • Bookmark
    • Subscribe to RSS Feed
    • Invite a Friend
Showing topics with label RSA NetWitness Platform. Show all topics

Forum Posts

Create a Document

ESA 'Group by' issue

I have 2 events with alias_host array meta as below. Event1: "alias.host":["google.com","outlook.com","bing.com"] Event2: "alias.host":["msn.com","google.com","microsoft.com"] Anyone have tip how to group by alias_host in ESA EPL rule? How to compare...

a week ago
|
Posted in NetWitness Discussions
lukaszczerwonka by lukaszczerwonka • Occasional Contributor
  • 25 Views
  • 0 replies
  • 0 likes

Collecte Box events

Hello team, I would like to collect the logs of the Box. Has someone already done it here? Thank you !

2022-05-16
|
Posted in NetWitness Discussions
BaptOnfroy by BaptOnfroy • New Contributor
  • 72 Views
  • 1 replies
  • 0 likes

SMTP Action Failed for Reporting Engine

I'm trying to make our reporting engine send the generated reports via email, however it keeps getting stuck at Partial state after execution. When I checked the logs, it shows this error: Failed to execute Report Output Actioncom.rsa.soc.re.exceptio...

2022-04-05
|
Posted in NetWitness Discussions
cy_almonte by cy_almonte • Contributor
  • 291 Views
  • 2 replies
  • 0 likes

Help with ESA Rule - Multiple login users from same IP Alert

Hi, I have this rule configured, the objective is to find out multiple login attempts from the same source IP with different users within the time frame. @RSAAlert(oneInSeconds=0, identifiers={"ip_src"}) SELECT event_time,ip_src,country_src,user_dst,...

2022-03-31
|
Posted in NetWitness Discussions
JaimeMoscosoSOC by JaimeMoscosoSOC • Contributor
  • 119 Views
  • 0 replies
  • 0 likes

Query syntax with advanced examples. Netwitness compared to Splunk just doesn't seem to cut it.

Where can I find documentation on the query syntax used within Investigate? I don't seem to be able to find what query syntax is available and no example on advanced use cases. When looking at the service uncoder.io and I convert a sigma document to ...

2022-03-27
|
Posted in NetWitness Discussions
JeremyKerwin by JeremyKerwin • Trusted Contributor
  • 347 Views
  • 4 replies
  • 1 likes
  • « Previous
    • 1
    • 2
    • 3
    • …
    • 12
  • Next »
Labels
  • Case Portal 3
  • Documentation 3
  • Forums 4
  • Integrations 1
  • Knowledge Base 4
  • Other Topics 2
  • RSA NetWitness Endpoint 207
  • RSA NetWitness Orchestrator 17
  • RSA NetWitness Platform 56
  • RSA NetWitness Platform Integrations 6
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.