This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Knowledge Base
Find answers to your questions and identify resolutions for known issues with knowledge base articles written by NetWitness experts.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
  • NetWitness Community
  • Knowledge Base
  • How to track RSA NetWitness Platform user activity
  • Options
    • Subscribe to RSS Feed
    • Bookmark
    • Subscribe
    • Email to a Friend
    • Printer Friendly Page
    • Report Inappropriate Content

The content you are looking for has been archived. View related content below.

How to track RSA NetWitness Platform user activity

Article Number

000001306

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: Log Collector, Remote Collector, Decoder, Concentrator, Broker, Hybrid
RSA Version/Condition: 10.x 11.x

Issue

How to track RSA NetWitness user activity.

Resolution

  1. How can I track the activity of NetWitness users?

    You can track user activity using the audit log messages.

    Below is a sample of downloaded audit logs specific to the user account "testuser" on a concentrator for the previous 24 hours. As you can see, a full history of what testuser did, when they were logged in, when they were logged out, the exact queries run, in addition to the time and the IP address of the computer being used. In the sample queries below, testuser appears to be trying to view all traffic related to www.facebook.com.

    The full text of every query is recorded in the audit trail. Although audit logs do not record query results you can copy the query out of the audit logs and run it to verify the query results. This can be performed thru Investigator or by running the query from NwConsole or Administrator (Explorer View or Console). Please see the attached PDF document, for example, NwConsole and Administrator queries. 

    Sample audit log activities:

    16161076 audit 2010-Apr-27 17:45:54 Engine User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has logged in
    16161077 audit 2010-Apr-27 17:45:56 SDK-Info User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has requested the SDK summary info
    16161271 audit 2010-Apr-27 17:46:37 SDK-Values User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has issued values: id1=1 id2=2642656608 size=20 flags=2305 threshold=100000 fieldName=ipv6.src where="time\=\"2010-Apr-26 21:47:16\"-\"2010-Apr-27 21:47:15\" && alias.host\=\"
    www.facebook.com\""
    16161275 audit 2010-Apr-27 17:46:37 SDK-Values User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has finished values (elapsed time 00:00:00): id1=1 id2=2642656608 size=20 flags=2305 threshold=100000 fieldName=ipv6.src where="time\=\"2010-Apr-26 21:47:16\"-\"2010-Apr-27 21:47:15\" && alias.host\=\"
    www.facebook.com\""
    16161276 audit 2010-Apr-27 17:46:37 SDK-Values User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has issued values: id1=1 id2=2642656608 size=20 flags=2305 threshold=100000 fieldName=ipv6.dst where="time\=\"2010-Apr-26 21:47:16\"-\"2010-Apr-27 21:47:15\" && alias.host\=\"
    www.facebook.com\""
    16161277 audit 2010-Apr-27 17:46:37 SDK-Values User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has canceled values (elapsed time 00:00:00): id1=1 id2=2642656608 size=20 flags=2305 threshold=100000 fieldName=ipv6.dst where="time\=\"2010-Apr-26 21:47:16\"-\"2010-Apr-27 21:47:15\" && alias.host\=\"
    www.facebook.com\""
    16161279 audit 2010-Apr-27 17:46:38 Engine User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has logged out

     

  2. How much log data can be stored and is it overwritten over time?

    The log database is configured to store 1 GB of log messages. Once that is exceeded, the newest logs overwrite the oldest logs.

    In most cases, 1 GB is sufficient for many months of log messages. However, it can be adjusted under /logs/config, assuming enough disk space is available.

Tags (12)
  • Customer Support Article
  • KB Article
  • Knowledge Article
  • Knowledge Base
  • NetWitness
  • NetWitness Platform
  • NW
  • RSA NetWitness
  • RSA NetWitness Platform
  • RSA Security Analytics
  • Security Analytics
  • SIEM
0 Likes
Was this article helpful? Yes No
No ratings

In this article

Version history
Last update:
‎2022-02-10 02:02 PM
Updated by:
Administrator nwinfotech Administrator

Related Content

Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.