Search and Download Content from NetWitness Cloud Services Live

Administrators can search for live content using the Search Content panel in the NetWitness Cloud Services Live, which is similar to browsing the live CMS content in the netwitness_configureicon_24x21.png (Configure) > Live Content page on the NetWitness Platform.

Note: If Admin server is not connected to the Live Services, you can use the NetWitness Cloud Services Live to search and download the required content.

netwitness_search_downloadlivecontent_586x250.png

Prerequisites

  • Ensure that you have created the Live account. For more information, see Create Live Account.

Quick Search for Content

You can now select and view the content based on the Sources available in the Cloud Services Live. You can select either NetWitness or Community from the Source drop-down list.

  • NetWitness: Displays all the content provided by NetWitness.

  • Community: Displays the content collected and retrieved from third party and open source communities.

You can also quickly select and view the available content types under Content section.

Clicking netwitness_contenticon_16x16.png expands the Content section and displays the following options:

  • New: Displays the content which is created in the last 21 days.

  • Recently Updated: Displays the content which is created or updated in the last 21 days.

FirstWatch Content

From 12.5 version or later, NetWitness introduces the FirstWatch Content section within the NetWitness Live. This FirstWatch Content section serves as a centralized hub for accessing up-to-date threat intelligence, including curated data and IOCs provided by NetWitness, to help you detect and respond to threats. This threat intelligence is continually updated by NetWitness to ensure you have the most current and actionable information for securing your network environment.

Clicking netwitness_contenticon_16x16.png expands the FirstWatch Content section and displays the following options:

  • New: Displays the FirstWatch content which is created in the last 21 days.
  • All: Displays all the FirstWatch content provided from NetWitness.

            125_Live_FirstWatch_2022x606.png

Advanced Search for Content

You can search for the specific content in the Search Content view. For more information, see Live Search Content View.

To search the content:

  1. Click netwitness_contenticon_16x16.png to expand the Search Content section.

  2. In the Search Content, specify the search criteria. Enter any or all of these: FirstWatch, keyword, type of resource, medium, risk, tag, platform versions, Mitre ATT&CK Tactics and Techniques, meta keys, meta values, date when content was created, date when content was modified, and (optional) discontinued content.

    125_Search1.png

  3. Click Search.

    The matching results are displayed on the right panel.

    125_FilterContent_1972x1064.png

    The following is an example of FirstWatch Content Search results.

             125_Live_FirstWatch_Search_Results_1972x638.png

 

You can sort the content using the name, created, updated, type, or any of the column.

Note: Clicking Reset Filter removes the existing filters applied from the Search Content, and displays all the available content on the right panel.

Download Content

You can download the content from the results displayed in the right panel by performing the following steps:

Note:
- You cannot download a discontinued content.
- NetWitness provides no assurance related to the quality and accuracy of the content provided by the third parties and open source communities.

To download the content:

  1. Click the name of the content that you want to download.

    The Content Details dialog is displayed.

    netwitness_detailresultspanel2_264x280.png

  2. Click Download.

    The content file is downloaded.