2019-08-06 08:30 AM
Hi,
based on previous knowledge with other siem systems.... is there a place in Netwitness where can I define what is the network segments that define my local network?
I am asking this since when I try to use meta key "outbound" and try to investigate this type of communication, the results also show my network ip addresses as destination IP... something doesnt make sense.
2019-08-06 09:15 AM
Take a look at the traffic flow options detailed here: https://community.rsa.com/docs/DOC-44948
Cheers,
Lee