Hosts View - YARA Rules TabHosts View - YARA Rules Tab
Note: The information in this topic applies to NetWitness Version 12.0 and later.
The YARA Rules tab lists the various YARA rules used for the scan and their status. To access this tab, select a host from the Hosts view and click the YARA Rules tab.
What do you want to do?
|User Role||I want to ...||Show me how|
|Threat Hunter||review hosts with highest risk score|
|Threat Hunter||analyze hosts*||Investigating Hosts|
|Threat Hunter||perform adhoc scan*|
|Threat Hunter||review host details|
|Threat Hunter||search on snapshot*|
|Threat Hunter||analyze processes|
|Threat Hunter||review reported anomalies|
|Threat Hunter||analyze risky users||Analyzing Risky Users|
|Threat Hunter||download files for deeper analysis||Analyzing Downloaded Files|
|Threat Hunter||perform external lookups||Launch an External Lookup for a File|
|Threat Hunter||change file status or remediate||Changing File Status or Remediate|
|Threat Hunter||isolate host from network*||Isolating Hosts from Network|
|Threat Hunter||download MFT, system dump, or process dump*||Performing Host Forensics|
*You can perform this task in the current view.
Below is an example of the YARA Rules tab:
Agent and Scan Details. You can view the following agent and scan details of the selected host:
Host name - Name of the host. For example, WIN-ABC.
Risk score - Risk score of the host.
Operating System - Operating system on which the agent is running (Linux, Windows, or Mac).
Agent Scan Status - Current status of the scan - Idle, Scanning, Starting Scan, or Stopping Scan. For more information, see Scan Hosts.
Agent Last Seen - Time when the agent last communicated with the Endpoint server.
Agent Version - Version of the agent. For example, 220.127.116.11.
More - Provides options to:
Snapshot Time - Lists scanned time stamps. To view the scan history, you can select the snapshot time from the drop-down menu.
|2||Search on Snapshots. Lets you search on all snapshots (file name, file path, and SHA-256 checksum). For more information, see Search Files on Host.|
YARA Rules Panel - Displays the following tabs: