This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
      • Netwitness XDR
      • EC-Council Training
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
    • Role-Based Training
  • Technology Partners
  • Trust Center
Sign InRegister Now
Enter a search word
    Turn off suggestions
    Enter a search word
      Turn off suggestions
      Enter a user name or rank
        Turn off suggestions
        Enter a search word
          Turn off suggestions
          Enter a search word
            Turn off suggestions
            cancel
            Turn on suggestions
            Showing results for 
            Search instead for 
            Did you mean: 
            NetWitness Discussions
            • NetWitness Community
            • Discussions
            • Re: When should one create a new indexed key?
            • Options
              • Subscribe to RSS Feed
              • Mark Topic as New
              • Mark Topic as Read
              • Float this Topic for Current User
              • Bookmark
              • Subscribe
              • Mute
              • Printer Friendly Page

            When should one create a new indexed key?

            TomiReiman
            TomiReiman Beginner
            Beginner
            Options
            • Mark as New
            • Bookmark
            • Subscribe
            • Mute
            • Subscribe to RSS Feed
            • Permalink
            • Print
            • Report Inappropriate Content

            ‎2018-05-03 05:01 AM

            In RSA NetWitness, when does it make sense to create a new index key instead of using an existing one to store more heterogeneous data?

             

            My example use case is a key named 'hash'. If hashes from logs and other sources can be either MD5, SHA-1, SHA-256, etc., would it make more sense to create separate keys for each of them instead of using a single key called 'hash'? First of all, these hashes have different lengths so putting them all under a single key would make the size of the index bigger. Secondly, if I can extract feeds per hash type from external systems, wouldn't it make sense to only match MD5 hashes to MD5 hashes, SHA-256 hashes to SHA-256 hashes, and so on?

             

            I plan on keeping the hash keys closed by default in the investigation view, so would there be any real and impactful downside of creating all these keys instead of just using a single key for all hashes?

            • Community Thread
            • Discussion
            • Forum Thread
            • index
            • indexing
            • metakey
            • NetWitness
            • NW
            • NWP
            • RSA NetWitness
            • RSA NetWitness Platform
            0 Likes
            Reply
            • All forum topics
            • Previous Topic
            • Next Topic
            2 REPLIES 2

            NaushadKasu1
            Trusted Contributor NaushadKasu1 Trusted Contributor
            Trusted Contributor
            Options
            • Mark as New
            • Bookmark
            • Subscribe
            • Mute
            • Subscribe to RSS Feed
            • Permalink
            • Print
            • Report Inappropriate Content

            ‎2018-05-10 09:03 AM

            Hello Tomi,

             

            It's a balance between data organization and query/system performance...

             

            When it comes to NW Indexing, uniqueness matters -- in that, if you have a variety of unique values (as you would expect with hashes), the high number of unique values in any given "index slice", could be overrun if your valueMax setting for that key is not set appropriately for your given environment.

             

            I can certainly elaborate on the topic above as I'm not sure how familiar you are with the way indexing works in NetWitness and its relationship of unique values stored per slice for a given key in that slice. Please let me know if you need me to dive deeper on this topic.

             

            Given the information you have provided, it would make sense to make separate keys for each subset of data i.e.  hash.md5, hash.sha256 etc.. to avoid index overruns and/or lowering the index save frequency to accommodate the high number of unique values stored in those keys. Particularly, as you mentioned that you are doing matching against some feed content, it could certainly help keep down the query times as you use this data for reporting, charts etc...

            0 Likes
            Reply

            NaushadKasu1
            Trusted Contributor NaushadKasu1 Trusted Contributor
            Trusted Contributor
            In response to NaushadKasu1
            Options
            • Mark as New
            • Bookmark
            • Subscribe
            • Mute
            • Subscribe to RSS Feed
            • Permalink
            • Print
            • Report Inappropriate Content

            ‎2018-05-10 09:12 AM

            Tomi,

             

            I should also mention that in NW 11.1, there is a new feature implemented called Meta Entities. This feature allows you to set a new "pointer" meta key in the index-concentrator-custom.xml that will "point" to other keys for the purpose of queries. So if you do move forward with separating your keys into hash.md5, hash.sha256 etc... In 11.1, you can/will be able to setup a new pointer meta key, let's call it "hash.all" and have it point to hash.md5, hash.sha256 etc.. so that any queries against hash.all would run a query against all of the sub-keys (entities) you have pointed to in the index-concentrator-custom.xml to make it easier to write queries.

            0 Likes
            Reply
            li.common.scroll-to.top
            Powered by Khoros
            • Blog
            • Events
            • Discussions
            • Idea Exchange
            • Knowledge Base
            • Case Portal
            • Community Support
            • Product Life Cycle
            • Support Information
            • About the Community
            • Terms & Conditions
            • Privacy Statement
            • Acceptable Use Policy
            • Employee Login
            © 2022 RSA Security LLC or its affiliates. All rights reserved.
            Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.