Working with RulesWorking with Rules
This topic discusses additional procedures you can perform on rules. You may want to perform any of the following procedures:
Table of Contents
- Release Notes
-
Getting Started
-
Getting Started With NetWitness
- Getting Started with NetWitness Platform
- Logging in to NetWitness Platform
- Changing Your Password
- Identifying Your Role
- NetWitness Platform Basic Navigation
- Setting Up Your Default View by SOC Role
- Managing the Springboard
- Managing Dashboards
- Setting User Preferences
- Managing Jobs
- Viewing and Deleting Notifications
- Viewing Help in the Application
- Finding Documents on NetWitness Community
- Troubleshooting for User Setup
- NetWitness Platform Getting Started References
-
Set up your Hosts and Services
- Hosts and Services Basics
- Hosts and Services Set Up Procedures
- Hosts and Services Maintenance Procedures
-
References
- Hosts View
-
Services View
- Edit Service Dialog
- Services Config View
- Services Config View - Appliance Service Configuration Tab
- Services Config View - Data Retention Scheduler Tab
- Services Config View - Files Tab
- Services Explore View
- Services Explore View - Properties Dialog
- Services Logs View
- Services Security View
- Services Security View - Users Tab
- Services Security View - Roles Tab
- Services Security View - Settings Tab
- Services Stats View
- Services Stats View - Chart Stats Tray
- Services Stats View - Gauges
- Services Stats View - Timeline Charts
- Services System View
- Services Topology View
- Services System View - Host Task List Dialog
-
Service Configuration Parameters
- Aggregation Configuration Parameters
- Appliance Service Configuration Parameters
- Archiver Service Configuration Parameters
- Broker Service Configuration Parameters
- Concentrator Service Configuration Parameters
- Core Service Logging Configuration Parameters
- Core Service-to-Service Configuration Parameters
- Core Service System Configuration Parameters
- Decoder Configuration Parameters
- Network Decoder Service Configuration Parameters
- Log Decoder Service Configuration Parameters
- REST Interface Configuration Parameters
- NetWitness Platform Core Service system.roles Modes
- Centralized Service Configuration via Policy
- Troubleshooting Version Installations and Updates
-
Service Configuration Properties Guide
- Introduction
- Admin-server Configuration
- Analysis-server Configuration
- Config-server Configuration
- Content-server Configuration
- Contexthub-server Configuration
- Correlation-server Configuration
- Endpoint-broker-server Configuration
- Endpoint-server Configuration
- Enrichment-server Configuration
- Integration-server Configuration
- Investigate-server Configuration
- Launch-framework Configuration
- License-server Configuration
- Metrics-server Configuration
- Node-infra-server Configuration
- No-op-server Configuration
- Orchestration-server Configuration
- Relay-server Configuration
- Respond-server Configuration
- Security-server Configuration
- Source-server Configuration
- Quick Start - Investigation
- Quick Start - Endpoints
- Quick Start - UEBA
-
Getting Started With NetWitness
-
Install and Upgrade
- Deploy NetWitness
- Manage Licensing
- Physical Host Installation
-
Virtual Host Installation
- Basic Deployment
- Install NW Virtual Host in Virtual Environment
- Appendix A. Troubleshooting
- Appendix B. Silent Installation Using CLI
- Appendix C. Virtual Host Recommended System Requirements
- Appendix D. Update the Virtual ESA Host Memory
-
NetWitness Storage Configuration
- Storage Overview
- Storage Requirements
- Prepare Physical Storage
- Prepare Virtual or Cloud Storage
- Configure Storage Using the REST API
- Prepare Unity Storage
- Migrate Data to Another Storage Type
- Appendix A. How NetWitness Platform Hosts Store Data
- Appendix B. Encrypt a Series 6E Core or Hybrid Host (encryptSedVd.py)
- Appendix C. Troubleshooting
- Appendix D. Sample Storage Configuration Scenarios
- Revision History
- AWS Deployment
- Azure Deployment
- Google Cloud Platform Deployment
- Endpoint Agent Installation
- Migration Guide for NetWtiness Endpoint to RSA NetWitness Platform
- UEBA Standalone Installation
- Upgrade to NetWitness Platform 12.0
- Upgrade to NetWitness Platform 11.7
- Upgrade to NetWitness Platform 11.7.1
- Windows Legacy Log Collection Configuration
- NetWitness Export Connector Deployment
-
Configure and Manage
-
Decoder and Log Decoder Configuration
- Decoder and Log Decoder Quick Setup
-
Configure Common Settings on a Decoder
-
Configure Capture Settings
- (Optional) Configure System-Level (BPF) Packet Filtering
- (Optional) Configure a Decoder to Capture Data Across All Types of Network Interfaces
- (Optional) Configure Meta-Only Decoders
- (Optional) Configure Selective Network Data Collection
- (Optional) Configure a Decoder to Write Standard pcap-formatted Files
- (Optional) Multiple Adapter Packet Capture
- (Optional) Internet Content Adaptation Protocol Capture
- (Optional) Data Plane Development Kit Packet Capture
- (Optional) Preserve VLAN Tags When Using the Packet MMAP Capture Interface
- (Optional) Process Raw Syslog Data without Priority Field
- (Optional) Configure Decoder to Support OpenAppID
- Enable and Disable Parsers and Log Parsers
- Start and Stop Data Capture
-
Configure Capture Settings
- Configure Decoder Rules
- Configure Parsers and Feeds
-
Decoder and Log Decoder Additional Procedures
- Configure 10G Capability | NetWitness
- Configure 10G Capability
- Configure a Log Decoder to Accept Protobuf
- Configure Session Split Timeouts
- Configure Syslog Forwarding to Destination
- Configure Transaction Handling on a Decoder
- Configure Data Export
- Decrypt Incoming Packets TLS 1.2
- Decrypt Incoming Packets TLS 1.3
- Edit Decoder System Configuration Settings
- Enable CPU Usage Stats for Installed Content
- Enable Parser Mappings
- Enable or Disable Lua and Flex Parsing Systems
- Map IP Address to Service Type
- Event Time Support
- Obtain Log Files from a Pre-11.0 Log Decoder
- Upload a Log File to a Log Decoder
- Upload a Packet Capture File
- F5 BIG IP - NetWitness Perfect Forward Secrecy Inspection Visibility
- Troubleshooting Packet Drops (11.x and above)
-
Decoder and Log Decoder References
- Services Config View - Capture Policies Tab
- Services Config View - Edit Policies Wizard
- Services Config View - Data Privacy Tab
- Services Config View - Data Retention Scheduler
- Services Config View - Feeds Tab
- Services Config View - Upload Feeds Dialog
- Services Config View - Files Tab
- Services Config View - General Tab
- Services Config View - Parsers Tab
- Services Config View - Parser Mappings Tab
- Services Config View - Data Export Tab
- Services Config View - Rules Tab
- Services Config View - App Rules Tab
- Services Config View - Correlation Rules Tab
- Services Config View - Network Rules Tab
- Services System View - Decoders
- Broker and Concentrator Configuration
- Core Database Tuning
-
Live Services Management
- Live Content in NetWitness Suite
-
Deploy Content
- Create Live Account
- Set Up Live Services in NetWitness
- Deploy Content using Live Content UI
- Policy-based Centralized Content Management
-
Log Collection Configuration
- About Log Collection
- Log Collection Architecture
- Basic Implementation
- Log Collection Basics
-
Collection Protocols
- Configure AWS (CloudTrail) Event Sources
- Configure Azure Event Sources
- Configure Check Point Event Sources
- Configure File Event Sources
- Configure Logstash
- Configure Netflow Event Sources
- ODBC
- Configure SDEE Event Sources
- Configure SNMP Event Sources
- Configure Syslog Event Sources
- Configure VMware Event Sources
- Configure Windows Event Sources
- Windows Legacy Configuration
- Reference
- Log Collection: Troubleshoot
- Event Source Management
- Log Parser Customization
- Logstash Integration Configuration
- NetWitness Export Connector Configuration
- Archiver Configuration For Logs
- Workbench Configuration For Logs
-
Event Stream Analysis Configuration
- Event Stream Analysis Overview
- Configure ESA Correlation Rules
-
Additional ESA Correlation Rules Procedures
- Update Your ESA Rules for the Required Multi-Value and Single-Value Meta Keys
- Configure Advanced Settings for ESA Correlation
- Configure Character Case for Advanced ESA Rules
- Deploy Endpoint Risk Scoring Rules on ESA
- Change Memory Threshold for ESA Rules
- Start, Stop, or Restart ESA Service
- View Audit Logs and Verify ESA Component Versions
- References - Previous ESA Versions
-
Alerting with ESA Correlation Rules
- Getting Started with ESA
- How ESA Handles Sensitive Data
- ESA Rule Types
- Working with Trial Rules
- Add Rules to the Rules Library
- Download Configurable RSA Live ESA Rules
- Add a Rule Builder Rule
- Working With Rules
- Choose How to Be Notified of Alerts
- Add a Data Enrichment Source
- Deploy Rules to Run on ESA
- View ESA Stats and Alerts
- Add an Advanced EPL Rule
- Configure an In-Memory Table Using an EPL Query
- ESA Alert References
-
Context Hub Configuration
- How Context Hub Works
- Configure Lists as a Data Source
- Configure Archer as a Data Source
- Configure Active Directory Data Source
- Configure RSA EndPoint Data Source
- Configure Respond Data Source
- Configure File Reputation Server Data Source
- Configure STIX as a Data Source
- Configure RESTAPI as a Data Source
- Configure Data Sources Settings
- Import or Export Lists for Context Hub
- Manage Meta Type and Meta Key Mapping
- Context Hub Data Sources Tab
- Context Hub Lists Tab
- Context Hub STIX Tab
- Troubleshooting
-
Malware Analysis Configuration
- How Malware Analysis Works
-
Basic Setup
- Configure Malware Analysis Operating Environment
- Configure General Malware Analysis Settings
- Configure Indicators of Compromise
- Configure Installed Antivirus Vendors
- Enable Community Scoring
- (Optional) Configure Auditing on Malware Analysis Host
- (Optional) Configure Hash Filter
- (Optional) Configure Malware Analysis Proxy Settings
- (Optional) Register for a ThreatGRID API Key
- Additional Procedures for Configuring Malware Analysis
- Supported Antivirus Vendors
-
Malware Analysis References
- Services Config View - General Tab
- Services Config View - Indicators of Compromise Tab
- Services Config View - IOC Summary Tab
- Services Config View - Auditing Tab
- Services Config View - Hash Tab
- Services Config View - AV Tab
- Services Config View - Proxy Tab
- Services Config View - ThreatGRID Tab
- Services Config View - Integration Tab
-
NetWitness Endpoint Configuration
- NetWitness Endpoint Overview
- Agent Modes
- Endpoint Server Configuration
- Deploy Endpoint Application Rules and ESA Correlation Rules
- Setup Meta Forwarding to Log Decoder
- Endpoint Sources
- Create Groups and Policies
- Manage Groups
- Manage Policies
- Change Policy Ordering for Groups
- Configure Data Retention Policy
- Manage Role Permissions at Endpoint Server Level
- Manage Inactive Agents
- Configure Retention Policy for Memory Dumps and MFT
- (Optional) Installing and Configuring Relay Server
- Endpoint YARA Rules
- Configure OPSWAT
- Integrate NetWitness Endpoint 4.4.0.2 or Later with NetWitness Endpoint 11.3
- Endpoint References
- Troubleshooting
- Appendices
-
Respond Configuration for Incident Management
- About this Document
- NetWitness Respond Configuration Overview
- Configuring NetWitness Respond
-
Additional Procedures for Respond Configuration
- Set Up and Verify Default Incident Rules
- Configure Risk Scoring Settings for Automated Incident Creation
- Configure Custom Respond Server Alert Normalization
- Configure Analyst UI for Respond Server Alert Normalization
- Configure Incident Email Notification Settings
- Set a Retention Period for Alerts and Incidents
- Obfuscate Private Data
- Manage Incidents in Archer Cyber Incident & Breach Response
- Configure the Option to Send Incidents to RSA Archer
- Configure Threat Aware Authentication
- Set a Counter for Matched Alerts and Incidents
- Edit the Incident Rules Export ZIP File
- Configure a Database for the Respond Server Service
- NetWitness Respond Configuration Reference
-
Reporting Configuration
- How Reporting Engine Works
- Configure Reporting Engine
- Configure the Data Sources
- Configure Data Privacy for Reporting Engine
- Configure Data Source Permissions
- Configure Reporting Engine Settings
- How to Define Reports, Charts, and Alerts
- Configure Reporting Engine General Settings
- Reporting Engine Reference
-
Warehouse Connector Configuration
- How Warehouse Connector Works
- Install Warehouse Connector Service on a Log Decoder or Decoder
- Configure a Warehouse Connector Service
- Configure the Data Source for Warehouse Connector
- Configure the Destination
- Configure a Stream
- Monitor a Warehouse Connector
- Add Warehouse as a Data Source to Reporting Engine
- Analyze a Warehouse Report
- View the Warehouse Connector Service
- Troubleshoot the Warehouse Connector
- Manage a Stream
- Manage a Lockbox
- Warehouse Connector Configuration References
- UEBA Configuration
-
Service Configuration
- Introduction
- Admin-server Configuration
- Analysis-server Configuration
- Config-server Configuration
- Content-server Configuration
- Contexthub-server Configuration
- Correlation-server Configuration
- Endpoint-broker-server Configuration
- Endpoint-server Configuration
- Enrichment-server Configuration
- Integration-server Configuration
- Investigate-server Configuration
- Launch-framework Configuration
- License-server Configuration
- Metrics-server Configuration
- Node-infra-server Configuration
- No-op-server Configuration
- Orchestration-server Configuration
- Relay-server Configuration
- Respond-server Configuration
- Security-server Configuration
- Source-server Configuration
-
System Security and User Management
- Set Up System Security
- How Role-Based Access Control Works
- Manage Users with Roles and Permissions
- Set Up Multi-Factor Authentication
- Set Up Single Sign-On Authentication
- (Optional) Set Up Public Key Infrastructure (PKI) Authentication
- Troubleshooting
- References
- Data Privacy Management
-
System Configuration
- System Configuration Overview
-
Standard Procedures
- Access System Settings
- Configure Notification Servers
- Configure Notification Outputs
- Configure Templates for Notifications
- Configure Email Server and Notification Account
- Configure Global Audit Logging
- Configure Centralized Audit Logging
- Configure Investigation Settings
- Configure Live Services Settings
- Configure Log File Settings
- Configure Syslog and SNMP Settings
- AdditionalProcedures
- Troubleshooting System Configuration
- References
-
System Maintenance
- Overview
- Review Best Practices
-
Health and Wellness
- Monitor Health and Wellness using NetWitness Platform UI
- Monitor using New Health and Wellness
- Manage NetWitness Platform Updates
- Reissue Certificates
- DisplaySystem and Service Logs
- Maintain Queries Using URL Integration
- Manage the deploy_admin Account
- NW Server Host Secondary IP Configuration Management
- Change Host Network Configuration
- Manage Custom Host Entries
- Configure FIPS Support
- Configure DISA STIG Hardening
- Troubleshoot NetWitness Platform
- Troubleshooting Cert-Reissue Command
-
References
-
Health and Wellness
- Health and Wellness View - Alarms View
- Event Source Monitoring View
- Health and Wellness Historical Graphs
- Health and Wellness Settings View - Archiver
- Health and Wellness Settings View - Event Sources
- Health and Wellness Settings View - Warehouse Connector
- Monitoring View
- Policies View
- System Stats Browser View
- New Health and Wellness Settings
- System View - System Info Panel
- System Updates Panel - Settings View
- System Logging - Settings View
- System Logging - Realtime View
- System Logging - Historical View
-
Health and Wellness
- Disaster Recovery Tool
-
Decoder and Log Decoder Configuration
-
Investigate and Respond
-
NetWitness Investigation
- How NetWitness Investigate Works
- Configuring NetWitness Investigate Views and Preferences
- Beginning an Investigation
-
Refining the Results Set
- Use Meta Groups to Focus on Relevant Meta Keys
- Use Columns and Column Groups in the Events List
- Use Query Profiles to Encapsulate Common Areas for Investigation
- Drill into Metadata in the Events View (Beta)
- Filter Results in the Events View
- Filter Results in the Navigate View
- Filter Results in the Legacy Events View
- Create a Query in the Navigate and Legacy Events Views
- Search for Text Patterns in the Navigate and Legacy Events Views
- View and Modify Queries Using URL Integration
-
Reconstructing and Analyzing Events
- Examine Event Details in the Events View
- Analyze Events in the Events View
- Reconstruct an Event in the Legacy Events View
- Look Up Additional Context for Results
- Launch a Lookup of a Meta Key
- Launch a Malware Analysis Scan from the Navigate View
- Group Events from Split and Related Sessions in the Events and Legacy Events Views
- Visualize Metadata as Parallel Coordinates
- Visualize the Current Drill Point in Informer
- Downloading and Acting Upon Results
- Troubleshooting Investigate
-
Investigate Reference Materials
- Add Events to an Incident Dialog
- Add/Remove from List Dialog
- Column Groups Dialogs
- Context Lookup Panel
- Create an Incident Dialog
- Events View
- Events View - Email Tab
- Events View - File Tab
- Events View - Host Tab
- Events View - Packet Tab
- Events View - Text Tab
- Investigate Dialog
- Investigation Tab - User Preferences Panel
- Investigate View
- Legacy Event Reconstruction View
- Legacy Events View
- Manage Default Meta Keys Dialog
- Meta Groups Dialogs
- Navigate View
- Query Dialog
- Query Profiles Dialogs
- Generate Springboard Panel Dialog
- Settings Dialogs for Investigate Views
-
Malware Analysis
- Malware Analysis Functions
- Malware Scoring Modules
-
Conducting Malware Analysis
- Begin a Malware Analysis Investigation
- Implement Custom YARA Content
- Examine Scan Files and Events in List Form
- Configure the Malware Analysis Summary of Events View
- Filter Dashlet Data in the Summary of Events View
- Upload Files for Malware Analysis Scanning
- View Detailed Malware Analysis of an Event
- Malware Analysis Reference Materials
-
NetWitness Endpoint Investigation
- Introduction to Endpoint Investigation
- Workflow of an Investigation
- Investigate Files
- Investigate Hosts
- Investigate Process
- Change File Status and Remediate
- Analyze Downloaded Files
- Perform Forensic Investigation
- Analyze Events
- Network Isolation
- NetWitness Endpoint with Third-Party Antivirus Products
- Troubleshooting NetWitness Endpoint
- NetWitness Endpoint Reference Materials
- User and Entity Based Analytics
- Respond to Incidents
-
Generate Reports
- Reporting Overview
- Configure and Generate a Report
- Configure a Rule
- Create and Schedule a Report
- View a Report
- Investigate a Report
- Manage a List or Rule or Report
- Working with Charts
- Working with Alerts
- Appendix
-
Reporting References
- Build Chart View
- Build List View
- Build Report View
- Build Rule View
- Chart Permissions Dialog
- Chart View
- Execution History Panel
- Generate List Dialog
- Import Chart Dialog
- Import Report Dialog
- Investigate a Chart View
- List Permissions Dialog
- List View
- Reports Permissions Dialog
- Report View
- Rule Permissions Dialog
- Rule View
- Select a Logo Dialog
- Schedule a Chart View
- Schedule Report Panel
- Scheduled Reports View
- Test a Chart View
- View a Chart Panel
- View All Charts Panel
- View a Report Panel
- View All Reports Panel
- Alerting References
-
NetWitness Investigation
- Develop and Integrate
On this page
