The content you are looking for has been archived. View related content below.
NWD files are sometimes useful to Technical Support for troubleshooting. NWD files are pcap or log files which contain all parsers and meta information.
To extract NWD files from RSA Security Analytics, follow the steps below.
For instance:
As shown above, identify the session ID.
Copy the following link into a browser: http://<concentratorIP>:50105/sdk/content?session=<session number>&&render=nwd
Where concentratorIP is the IP address of the concentrator and session number is the session number you identify in the investigator module (in this example 38642969).
Once you browse to the link above, you will be asked to insert the RSA Security Analytics admin credentials.
Once you insert the credentials, a file called "Content" will be downloaded. Change the extension of the file to .nwd. This will be the nwd file that you need and will contain all parsers and meta information.
Once you open the session in the Investigator, this will be cached in the concentrator server in /var/netwitness/concentrator/cache
Therefore you will have a file called sessionID.nwd (38642969.nwd in this example). Alternatively you can use an SFTP client (such us WinSCP) to download the sessionID.nwd file from the concentrator