Report showing Respond > Incidents > INC-000000 > Journal notes

[DavidHoneycutt]

Is anyone aware of how to create a Report (CSV) that includes the Journal notes from each Incident in RESPOND?

[EricaChalfin]

David Honeycutt‌,

I've moved your question to the RSA NetWitness Platform" data-type="space space where it will be seen by the product's support engineers, other customers and partners.  Please bookmark this page and use it when you have product-specific questions.

Alternatively, from the RSA Customer Support page, click on Ask A Question on the blue navigation bar and choose Ask A Product Related Question.  From there, scroll to RSA NetWitness Platform" data-type="space‌‌ and click Ask A Question.  That way your question will appear in the correct space.

Regards,

Erica

[SeanEnnis1]

Hi David,

There is currently no way to do this directly from the NetWitness UI.  The data is available via the REST API (details here: NetWitness Suite API User Guide for Version 11.1 ) if that approach is at all enticing to you.

Beyond that, if you can help me understand the use case a bit better, we can publish a concept on our Ideas portal and start the process of considering it for the product roadmap.  I could see a number of reasons you'd want to export the Journal information, but based on the underlying use cases there might be different approaches we could take that only exporting via CSV.  Eg. Do you want a timeline of analyst activity, the ability to extract indicators/insight out of the journals, just the ability to keep a historic record of activity, etc?  

FYI - in case you aren't familiar, the Ideas portal lives here: https://community.rsa.com/community/products/netwitness/ideas 

Thanks!

Sean