In the version of 12.1.0.0 of NetWitness, in Respond, there are original alerts and normalized alerts. Simply speaking, what is the difference between original alerts and normalized alerts ?
Original alerts are basically raw alerts respond receives from ESA.
Once the raw alert comes into respond, it goes through a process called normalization which is basically mapping fields from raw alert to user known meta keys. The end alert info you see in UI is normalized alert data.
Original alerts are basically raw alerts respond receives from ESA.
Once the raw alert comes into respond, it goes through a process called normalization which is basically mapping fields from raw alert to user known meta keys. The end alert info you see in UI is normalized alert data.
