RSA Customer Communication - Confidential
The nwXXXX rule naming is historical, but the rules are still valid. These rules write to the "alert.id" key which is used by the "investigate" feed (historically it was used in the "alert.info", "alert.suspicious", and "alert.warning " feeds to populate the risk.info, risk.suspicious, risk.warning keys along with the threat.source, thread,category and threat.description and alert keyts"). So they are used to populate multiple other keys from this one piece of information, ( One to Many ).
The numeric part of the name denoted different "categories" of rules, and in the past were meant to be placed in the ruleset in numeric order from smallest to largest, as the rules are processed from top to bottom order. The reason for this was in older versions of NetWitness there were rules that referenced other NW rule names, so had to be in order to work properly (i.e. if rule NW45678 had a where clause that included alert.id='NW12345' but was placed BEFORE the rule NW12345, then it would NEVER trigger) .
Also at times I see people writing their own rules and sending them to alert.id, this should NOT be done, as the alert.id field is really ONLY used to trigger the "investigation" feed
Eventually these rules will be replaced with a more descriptive name, but that will take coordination with customers to change their "live" rules to the new names when it happens (you'll notice that newer app rules have actual descriptive names)
Example for rule
nw60005 service = 53 && udp.dstport = l-52,54-u && streams =2 (service is DNS, but UDP destination port is not 53, and traffic contains request & response packet streams)
so this writes "nw60005" to the alert.id key, triggering the investigation feed to run which has a matching index line for nw60005, and writes the following metakeys
* inv.category = 'operations'
* inv.context = 'event analysis'
* inv.contex t= 'protocol analysis'
* feed.name = 'investigation'
* analysis.service = 'dns over non-standard port'
* attack.tactic = 'command and control'
* attack.technique = "uncommonly used port"
