Available backup and restore scripts for the RSA NetWitness Platform

[#1]

Article Number

000001031

Applies To

RSA Product Set: NetWitness Platform, Security Analytics
RSA Product/Service Type: All Appliances
RSA Version/Condition: 11.x, 10.6.x
Platform: CentOS
O/S Version: EL7, EL6

Issue

This article explains where to get an RSA NetWitness Disaster Recovery backup and restore script, and which version of the released scripts should be used.

Resolution

• NetWitness 11.x - nw-recovery-tool (NRT) 

  The NetWitness Recovery Tool (NRT) is a CentOS 7 rpm package included from NetWitness 11.1.x and later on all NetWitness appliances.
  
  NetWitness 11.1.x Note: The NetWitness Recovery Tool is an initial Alpha release, it is not officially supported by RSA Engineering.  There was no official announcement for this script, and no documentation, but it can be used like the later NetWitness 11.2+ versions.
  
  Use the following command to confirm the NetWitness Recovery Tool rpm is installed on NetWitness 11.1.x or later.
  
  For example:

  
  # rpm -q rsa-nw-recovery-tool
  rsa-nw-recovery-tool-11.5.1.0-2009021401.5.23178da.el7.noarch

  
  The NetWitness Recovery Tool can be used to:

  a. Backup and restore NetWitness 11.2.x and later.
   

  The documentation on how to use the NetWitness Recovery Tool is available on the RSA Link website:

  
  Note: The NetWitness Recovery Tool must be run on each host system locally for backup and restore.  NRT cannot be run from a remote host.
   

  • Recovery Tool User Guide for RSA NetWitness® Platform 11.5
  • Recovery Tool User Guide for RSA NetWitness® Platform 11.4
  • Recovery Tool User Guide for RSA NetWitness® Platform for 11.3
  • NetWitness 11.2 Recovery Tool User Guide

There is a NetWitness 11.2+ Wrapper Script that enables the running of the NetWitness Recovery Tool (NRT) from a single server like the nw-backup can do.

Centralized Backup & Restore of NetWitness Version 11.2+  (A Wrapper Script for NRT)
 

• NetWitness 10.6.x - nw-backup

  These scripts are designed to run on CentOS 6 only. The scripts must be run on CentOS 6 machines.

  The backup and restore scripts do not support backup and restore for STIG or FIPS hardened hosts. The only workaround is to backup before hardening the appliance, and after a restore harden the appliance again.
  
  The restore script is only supported for NetWitness 10.6.2.0 to 10.6.6.x.
   

  nw-backup-v4.6

  Note: The nw-backup-v4.6, supersedes all previous nw-backup versions.

  nw-backup-v4.6 can be used to:

  a. Backup and restore NetWitness 10.6.2.0 to 10.6.6.x.
  b. Upgrade NetWitness version 10.6.6.x to NetWitness 11.x.
  c. Renew 10.6.x certificates - Reissuing security certificates on RSA NetWitness Platform 10.6.x
  
  The documentation on how to use the scripts and the file nw-backup-v4.6.zip is available for download on the RSA Link website:

  • RSA Security Analytics Configuration Data Backup and Restore Guide for version 10.6.6
  • RSA NetWitness Platform 11.2, 11.3, and 11.4 Backup Scripts