How to enable the new NetWitness 11.7 Endpoint Beta features?

[#1]

Article Number

000040034

Applies To

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Endpoint Log Hybrid
RSA Version/Condition: 11.7.0.0
Platform: CentOS
O/S Version: 7

Issue

NetWitness 11.7 introduced new Endpoint Beta features: Full System Scan and Standalone Scan on Air-gapped Windows Hosts, but the new features do not appear in the NetWitness UI as described in the online documentation.

The new Endpoint Beta features are not enabled by default.

Resolution

Enable the new Endpoint Beta features

Warning: Enable only the Endpoint beta feature wanted to be used, as the effect on performance and service stability is still being reviewed.

Select which Endpoint Server(s) the beta feature is wanted to be used on.

ssh login to the Endpoint Server and get the endpoint-server service id.
 

cat /etc/netwitness/platform/nodeinfo/endpoint-server/service-id

Make note of the shown service-id value.

For example,
Image description
 

A. Enable the Full System Scan feature.

ssh login to the NW Admin Server.

Run the following commands on the NW Admin Server to enable the feature.
 

nw-shell
login
admin
[password]
connect --service endpoint-server.[EP service-id]
cd endpoint/config
cd set-config-property
invoke "{\"rsa.endpoint.feature.full-scan\":true, \"rsa.endpoint.feature.full-scan-extensions\":true}"
cd ..
cd get-config-properties
invoke '^rsa.endpoint.feature.full-scan*'
invoke '^rsa.endpoint.feature.full-scan-extensions*'
exit

Substitute
[password] with the admin password
[EP service-id] with the previously collected endpoint-server service id

The output from the last two invoke commands should confirm the full-scan features are set to "true".

Note: If there is only a single Endpoint Server then can connect with, connect --service endpoint-server

For example
Image description

Note: The Full Scan is only available for Manual Scans and only for Advanced agents.
 

B. Enable the Standalone Scan feature.

ssh login to the NW Admin Server.

Run the following commands on the NW Admin Server to enable the feature.
 

nw-shell
login
admin
[password]
connect --service endpoint-server.[EP service-id]
cd endpoint/config
cd set-config-property
invoke "{\"rsa.endpoint.feature.standalone-scan\":true}"
cd ..
cd get-config-properties
invoke '^rsa.endpoint.feature.standalone-scan*'
exit

Substitute
[password] with the admin password
[EP service-id] with the previously collected endpoint-server service id

The output from the last invoke-command should confirm the standalone-scan feature was set to "true".

Note: If there is only a single Endpoint Server then can connect with, connect --service endpoint-server

For example
Image description

Note: The Offline Scan is only available for Advanced agents.

The Beta feature(s) will become immediately available in the NW UI, Hosts after enabling.