NetWitness SASE Vendor Integration Support

[#1]

Each NetWitness SASE Vendor integration has specific deployment configuration requirements beyond a baseline SASE deployment and configuration of NetWitness Decoders and Concentrators. The NetWitness SASE deployment is the basis for the SASE Vendor Integration. The deployment, whether using the NetWitness SASE Automated Deployment or the NetWitness SASE Manual Deployment, establishes the environment for SASE based packet capture. There are an unlimited number of possible deployment scenarios based on the three supported Cloud Vendors (AWS, GCP and Azure) and the locations (cloud or on-prem) of the Customer’s NetWitness Admin-Server, Decoder(s), Concentrator(s), Broker(s), etc. The optimal deployment includes one or more NetWitness Decoders and one or more Concentrators deployed in the Cloud Vendor of choice for the Customer’s specific SASE VPN Provider. The Decoder(s) and Concentrator(s) should be deployed in the same Cloud Region as the VPN Provider’s artifacts. The Decoder(s) and Concentrator(s) must be orchestrated by the NetWitness Admin-Server and have the necessary available storage configuration based on the Customer’s expected ingest rate, and the communication paths defined in Network Architecture and Ports or have utilized the NetWitness SASE Automated Deployment. Each SASE VPN Vendor Integration may have additional artifact deployment requirements.

Palo Alto Prisma

NetWitness Platform SASE enhances visibility into device and service behavior across on-premises, hybrid, and cloud environments. It streamlines investigations by providing a single interface for quick searches, metadata pivots, and session reconstructions. Analysts can perform forensic analysis on detections and hunt threats using retained raw network data. The platform enriches investigations by correlating network traffic with user activities, offering complete end-to-end insights. Additionally, it optimizes costs through advanced compression, selective data retention, and flexible cloud components.

After deploying the SASE Decoder and Concentrator through the NetWitness SASE Automated Deployment or manually, follow the instructions in Palo Alto SASE Configuration Guide. Go to NetWitness Community and download the Palo Alto Prisma SASE Configuration Guide. You can also view the online version of the Palo Alto Prisma SASE Configuration Guide in the NetWitness Community.