nCircle IP360 integration

[YogeshMavani]

Hello,

We are planning to correlate IPS and VA scanner events. We integrated IPS.

We need to integrate nCircle IP360 with RSA SA. It is listed in supported devices. We gone through integration guide also but it is for ENVISION only.

Please assist us to integrate nCircle IP360.

[RobertClum1]

An updated guide would be helpful for this, we are using Tripwire IP360 Version 8.1 and Netwitness 10.6.4

[EricPartington]

there is no VAM module in RSA NetWitness suite OOTB so an updated guide for that component is not planned AFAIK.

There may be a different method to your solution using the NW Feeds function.

what options other than XML are listed for the export format from IP360?  is CSV an option ?

If so then

• you can export the ssh keys as listed in the envision doc
• use an SSH script from the NW head server using the keys exported to pull the CSV from IP360 to the default www directory on the NW server and use a recurring feed to read that vuln feed (/var/netwitness/srv/www/).
• use the recurring feed option to point you to http://127.0.0.1/feedname.csv and you should be able to reference the feed in the UI
• Map the feed columns to useful values from the NW metakeys and make the primary key the metakey that would match from the IPS event logs (cve?) so that when a matching IPS event occurs the feed data is written (providing vuln context) to make your determination.
• if you need to match more than 1 column in the feed (say CVE and OS) then you will need to create a multi-column feed from the CLI using this guide (and the implementation might get more complicated)
• https://community.rsa.com/message/895987?commentID=895987#comment-895987