Latest NetWitness Investigator Freeware Client

[Anonymous]

Welcome NetWitness Fans!

In case you have not heard we just posted the latest revision of the NetWitness Investigator Freeware client. This is also an update to the Security Analytics 10.5 enterprise client to NetWitness 10.6.1 since now the enterprise and freeware clients are one in the same.

You can find it here: NetWitness Investigator Freeware Client

The Freeware client is intended to provide access to the greater community to support users who need an open source or free solution in certain environments. Allow users to try out NetWitness to get familiar with how to write rules, execute queries, and test custom content. Investigator is certainly powerful in its own right but is one piece of the RSA NetWitness suite that helps analysts detect and analyze threats in enterprise networks.

The main highlights for this release:

• Updated NetWitness libraries to 10.6.1
• Freeware & Enterprise in single Windows 64 bit client
• Includes a few unencrypted sample Lua parsers
• New MSI Installer
• Freeware:
  • Automated registration process
  • RSA Link Community section for support - located here: RSA NetWitness Investigator
  • Limited to packet capture and import
  • Limited by 25 2GB storage collections
• Enterprise:
  • No registration required by connecting to an enterprise device
  • Lua parser content available from Live
  • Can connect to packet and log devices
  • Limited by 100 1TB storage collections

[Anonymous]

This appears to be an update to the SA Investigator 10.5.  Not to be captain obvious here, but the rebranding from Security Analytics (SA) back to Netwitness may not be obvious to the occasional user.

[Anonymous]

Good point. I will add a note to the discussion to make that more clear in case they do not read this thread. This is an update to the enterprise version from 10.5 to 10.6.1 in addition to enabling the freeware option.

[CDC_CyberIntel]

Hello, curious to know if there are any plans to create a v11 version of NW Investigator?

[Anonymous]

Potentially in the long-term. In the short-term the focus is making sure the current 10.6 thick client functions with all the 11.x versions. Any specific reason your still using the thick client?

[DavidGassman2]

A couple of reasons that I still use the thick client:

> testing new content before deploying in Prod (though it would be nice to have such a feature within the Production UI so that we don't have to maintain local parity of index files for new meta keys, apprule/parser parity, etc)
> connecting to the environment when the UI is unavailable for some reason (not only is this a good troubleshooting technique for Admins, it is useful for Analysts to have as a backup option to get to the data timely)

[CDC_CyberIntel]

Similar to David G, my primary reason for using the thick client is as a sandbox for content development (parsers, feeds, and app rules). Additionally, our investigative personnel heavily leverage the ability to isolate PCAP examination using Local Collections. As far as I know, Local Collections aren't a "thing" in the web-based NetWitness Platform...which is unfortunate. We are aware that the business use-case is changing for RSA NetWitness, but we're hoping (praying) that NetWitness Investigator isn't secretly dying a slow death.

[JeremiahWarren]

The hyperlink in the article doesn't work, at least it didn't for me. I was able to download the client here: https://information.rsa.com/netwitness-investigator-freeware.html . Hope this helps!

[Anonymous]

There is no current plan to get rid of the thick client as your feedback confirms the use cases we do not have covered in the web interface. Thanks for the feedback. I also updated the link in original post as Jeremiah suggested.

[JonathanScher]

Is there a way to have access to Live Services using Investigator without having a "License Server ID" ?

I downloaded Freeware Investigator on my personal PC, activated my License, and i tried accessing Live Services here (https://cms.netwitness.com/registration/), but I could not complete registration because i don't have a License Server ID, I only have the Freeware version for home/personal use.