Most people don't remember the well known port number for a particular network protocol. Sometimes we need to refer to an RFC to remember what port certain protocols normally run over.
In the RSA NetWitness UI, the well known name for the protocol is presented in the UI but when you drill on it you get the well known port number.
This can be a little confusing at times if you aren't completely caffeinated.:hot_beverage:
Well here's some good news, you an use the name of the service in your drills and reports with the following syntax:
Original method:
Service=123
New method:
Service="NTP"
You may get an error about needing quotes around the word however the system still interprets the query correctly.
This also works in profiles:
An in the Reporting Engine as well:
Good luck using this new trick!
(P.S you can also use AND instead of && and OR instead of || )
