Recently RSA NetWitness (NW) added the ability to report on the IMDB component of the platform. Based on some recent questions it seemed useful to create a few template rules and reports that could be used to create a starter pack for reporting on IMDB data.
RSA IMDB reporting syntax
https://community.rsa.com/docs/DOC-64586
Included at the bottom is the rule and report pack that cover a few scenarios that should get you started reporting on data that you might want to see.
Some things that I have found out during this development.
- in the alerts table the alert.host_summary is visible as an option, but the alert.user_summary is not visible. You can add alert.user_summary to report on that data manually and it works for me (10.6.2.2) - Bug reported for that to fix.
- in the incidents table the 'name' of the incident is not visible as a usable meta value. if you add 'name' manually you can add the incident name to the report. Bug reported for that to fix as well.
S you can create rules that provide data like this for alerts:
Like this for incidents
or pretty close to this
The rules in the included pack
IMDB>
