alespinosadlm,
To start with it would be better to understand the use case you are trying to accomplish here as the route to your end goal may not be the direction you are thinking of taking. If your use case is to do reports on how long people are using RDP sessions, NetWitness may not be the right tool for the job. However if you are looking more for something like long running RDP connects could be an indication of vulnerability that is different.
I'll attempt to provide some guidance based off the second possible use case. If I don't understand your use case, please clarify and we can try again 🙂
What you may need to do is an ESA correlation rule where you are looking for a RDP session with the same ip source and ip destination that lasts for longer than a set amount of minutes. If you are going to do this you have to be careful not to set the number of minutes too high nor capture more meta data than you need for the comparison when setting up the ESA correlation window. Otherwise you could cause the ESA to run out of memory before the session closes and thus not provide what you want and all other ESA rules can potentially stop due to lack of resources.
I'm not an ESA rule creator so this is as low down into the creation process that I am able to go. Here are some documentation links that may be able to help with the syntax if needed.
Create an ESA Rule: https://community.netwitness.com/t5/netwitness-platform-online/create-an-esa-rule/ta-p/688878
RSA ESA Rules: https://community.netwitness.com/t5/netwitness-platform-threat/rsa-esa-rules/ta-p/677885
Configure ESA Correlation Rules: https://community.netwitness.com/t5/netwitness-platform-online/configure-esa-correlation-rules/ta-p/669425
I hope this helps.
