Netwitness 11.2 - ESA Rules

[AdiShraga]

Hi,

we are now configuring netwitness 11.2 and on "ESA rules" tab under "Configure" we have no rules yet.

I was wondering if there is a set of baseline rules that can be implemented instantly, instead of 

adding each rule individually (similar to just simple, 'regular', out-of-the-box default rules).

did someone has performed this before and can help?

Thanks!

Adi

Jay Alexander

Matar Weiss‌

[EricPartington]

Use RSA live to subscribe to the current OOTB ESA rules that are available to you

deploy to your ESA library then push selected to the ESA collection

RSA Content for the RSA NetWitness Platform - ESA content

[AdiShraga]

I have created a new deployment folder and named it "OOTB ESA"

clicked the "+" sign to add from "ESA rules", then found 59 RSA live rules.

am I at the right place?

[EricPartington]

Sounds like it