RSA NetWitness® Suite Unified Data Model Meta Entities

[#1]

Meta Entities

In the RSA NetWitness® Platform, data is parsed into the most accurate meta key available based on the given context which is extremely important for analysts. However, this can present a challenge when analysts have use cases where they do not need the most granular context. If they need only the high level context, they do not want to have to query every possible key of relevance. For Example: To check if IP 1.1.1.1 showed up in the network, they would need to query 7 different keys namely: ip.src, ip.dst, alias.ip, stransaddr, dtransaddr, forward.ip, device.ip, etc. 

Meta Entities provide a way to link similar meta keys together. Once they are defined, an entity can be used the same way as a key, so that analysts use them as regular keys to get to multiple, similar concepts. For Example: We can link all the keys referenced above as "ip.all"

Note:

1. Meta Entities are only supported on RSA NetWitness 11.1 and above.
2. All Meta keys defined under a Meta Entity should have the same Data Type
3. All Meta keys defined under a Meta Entity should have the same Indexing Levels
4. Meta Entities nesting is not allowed: a Meta Entity can only reference Meta Keys and not another Meta Entity

Entity Name	Meta Keys in Entity	Data Type	Indexing	Notes
domain.all		Text	IndexValue	This Entity is linked with all relevant Domain Keys used in RSA NetWitness
	domain	Text	IndexValue	This key should only be used to capture a Domain when the directionality is not clear
	domain.src	Text	IndexValue	This key should only be used to capture Source Domain Only
	domain.dst	Text	IndexValue	This key should only be used to capture Destination Domain Only
ec.all		Text	IndexValue	This Entity is linked with all relevant Event Categorization Keys used in RSA NetWitness
	ec.activity	Text	IndexValue	This key should only contain a value from a predefined list of Event Category - Activities
	ec.outcome	Text	IndexValue	This key should only contain a value from a predefined list of Event Category - Outcome
	ec.subject	Text	IndexValue	This key should only contain a value from a predefined list of Event Category - Subject
	ec.theme	Text	IndexValue	This key should only contain a value from a predefined list of Event Category - Themes
email.all		Text	IndexValue	This Entity is linked with all relevant Email Keys used in RSA NetWitness
	email	Text	IndexValue	This key should only be used to capture an Email when the directionality is not clear
	email.dst	Text	IndexValue	This key should only be used to capture Destination Email Only
	email.src	Text	IndexValue	This key should only be used to capture Source Email Only
eth.all		MAC	IndexValue	This Entity is linked with all relevant Mac Address Keys used in RSA NetWitness
	alias.mac	MAC	IndexValue	This key should only be used to capture a MAC Address when the directionality is not clear
	eth.dst	MAC	IndexValue	This key should only be used to capture Destination MAC Address Only.
	eth.src	MAC	IndexValue	This key should only be used to capture Source MAC Address Only.
host.all		Text	IndexValue	This Entity is linked with all relevant Hostname Keys used in RSA NetWitness
	alias.host	Text	IndexValue	This key should only be used to capture a hostnames when the directionality is not clear
	host.dst	Text	IndexValue	This key should only be used to capture Destination Hostnames Only.
	host.src	Text	IndexValue	This key should only be used to capture Source Hostnames Only.
	device.host	Text	IndexValue	This is a Reserved Field, used to capture the Hostname of the Event Source
ip.all		IPv4	IndexValue	This Entity is linked with all relevant IPv4 Keys used in RSA NetWitness
	alias.ip	IPv4	IndexValue	This key should only be used to capture a IPv4 Address when the directionality is not clear
	ip.dst	IPv4	IndexValue	This key should only be used to capture Destination IPv4 Address Only.
	ip.src	IPv4	IndexValue	This key should only be used to capture Source IPv4 Address Only.
	ip.trans.src	IPv4	IndexValue	This key should only be used to capture a translated Source IPv4 Address only
	ip.trans.dst	IPv4	IndexValue	This key should only be used to capture a translated Destination IPv4 Address only
	forward.ip	IPv4	IndexValue	This is used to capture the IPv4 Address of the Relay system in beween the Event source and Destination
	device.ip	IPv4	IndexValue	This is a Reserved Field, used to capture the IPv4 Address of the Event Source
ipv6.all		IPv6	IndexValue	This Entity is linked with all relevant IPv6 Keys used in RSA NetWitness
	alias.ipv6	IPv6	IndexValue	This key should only be used to capture a IPv6 Address when the directionality is not clear
	device.ipv6	IPv6	IndexValue	This is a Reserved Field, used to capture the IPv6 Address of the Event Source
	forward.ipv6	IPv6	IndexValue	This is used to capture the IPv6 Address of the Relay system in beween the Event source and Destination
	ipv6.dst	IPv6	IndexValue	This key should only be used to capture Destination IPv6 Address Only.
	ipv6.src	IPv6	IndexValue	This key should only be used to capture Source IPv6 Address Only.
port.all		UInt16	IndexValue	This Entity is linked with all relevant Port Keys used in RSA NetWitness
	port	UInt16	IndexValue	This key should only be used when the directionality context of Port is not clear
	port.src	UInt16	IndexValue	This key should only be used when it’s a Source Port.
	port.dst	UInt16	IndexValue	This key should only be used when it’s a Destination Port.
	tcp.srcport	UInt16	IndexValue	This key should only be used when it’s a TCP based Source Port.
	tcp.dstport	UInt16	IndexValue	This key should only be used when it’s a TCP based Destination Port.
	udp.srcport	UInt16	IndexValue	This key should only be used when it’s a UDP based Source Port.
	udp.dstport	UInt16	IndexValue	This key should only be used when it’s a UDP based Destination Port.
	port.trans.src	UInt16	IndexValue	This key should only be used when it’s a Source Translated Port Number
	port.trans.dst	UInt16	IndexValue	This key should only be used when it’s a Destination Translated Port Number
port.src.all		UInt16	IndexValue	This Entity is linked with all relevant Source Port Keys used in RSA NetWitness
	port.src	UInt16	IndexValue	This key should only be used when it’s a Source Port.
	tcp.srcport	UInt16	IndexValue	This key should only be used when it’s a TCP based Source Port.
	udp.srcport	UInt16	IndexValue	This key should only be used when it’s a UDP based Source Port.
	port.trans.src	UInt16	IndexValue	This key should only be used when it’s a Source Translated Port Number
port.dst.all		UInt16	IndexValue	This Entity is linked with all relevant Destination Port Keys used in RSA NetWitness
	port.dst	UInt16	IndexValue	This key should only be used when it’s a Destination Port.
	tcp.dstport	UInt16	IndexValue	This key should only be used when it’s a TCP based Destination Port.
	udp.dstport	UInt16	IndexValue	This key should only be used when it’s a UDP based Destination Port.
	port.trans.dst	UInt16	IndexValue	This key should only be used when it’s a Destination Translated Port Number
user.all		Text	IndexValue	This Entity is linked with all relevant User Keys used in RSA NetWitness
	user	Text	IndexValue	This key should be used when the source / destination / initiated / target of a username is not clear
	user.src	Text	IndexValue	This key should only be used to capture the Secondary/Source User in the event
	user.dst	Text	IndexValue	This key should only be used to capture the Primary/Destination User in the event
	username	Text	IndexValue	This key has been discontinued and replaced by user. This is a part of the entity for Backward compatibility only
analysis.all		Text	IndexValue	This Entity is linked with all relevant Analysis Keys used in RSA NetWitness
	analysis.service	Text	IndexValue	This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service
	analysis.file	Text	IndexValue	This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file
	analysis.session	Text	IndexValue	This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session
filename.all		Text	IndexValue	This Entity is linked with all relevant Filename Keys used in RSA NetWitness
	filename	Text	IndexValue	This key is used to capture the complete filename/Webpage with extension where the directionality is not clear.  This should not include the directory/path
	filename.src	Text	IndexValue	This key is used to capture the complete Source or Child  filename/Webpage.  This should not include the directory/path
	filename.dst	Text	IndexValue	This key is used to capture the complete Destination or Child filename/Webpage.  This should not include the directory/path

Creating Custom Meta Keys in RSA NetWitness

There are often cases where a relevant meta concept may not be available in the Data model. The purpose of the model is to normalize the most common concepts used for threat detection and analysis. However, if there is a need to create a new concept not available in the data model, please use the following guidelines to maintain the overall consistency of meta key usage.

1. It shouldn't clash with any of the existing concepts defined in the Unified Data Model.
2. A new concept should be defined with a Meta Key name, Data Type, Description of its usage, Indexing and stored in a centralized place for reference. 
3. If the key is used in a log parser, please ensure the exact same meta key is used as a Log Parser key as well. Also, the Log Parser Key Flag needs to be set
4. RSA NetWitness allows maximum key size of 16 characters. Only alpha numeric values are allowed except "." (dot) which is a delimiter.

Please use the following method to create a Meta Key. A meta key has 3 logical parts: Concept, Context and Delimiter

Concept:

This should be the main entity or the type of value. This should always be the first part of the Meta Key.

For example: ip, ipv6, host, mac, port, time, etc.

Context:

This is the additional context needed for the concept. This is the second part of the Key. Sometimes, there is no additional context needed for the concept and sometimes, there is additional context required. RSA recommends to not have keys with more than 2 levels of additional context.  (Please note, there is a 16-character size limit for a meta key). 

For example: Source, Destination, Sent, Received, Primary, Secondary. 

Additional Context: Translated, Numbers

Delimiter:

This is used to separate out concept and context and in some cases also separate out additional context. RSA NetWitness uses "." (dot) as the delimiter. 

Left to Right Rule:

Most Generic to Most Specific order should be maintained while defining meta keys, with delimiters in between.

For Example: "Translated Source IP Address"

Other Examples:

port.src (Source Port)

ip.src (Source IP)

port.trans.src (Source Translated Port)

port (This is a generic port key, to capture port numbers where additional context is not available)

src.ip.trans (Wrong Usage)

trans.ip.src (Wrong Usage)

Please reach out to nw.udm@rsa.com to request changes to the existing concepts defined in the Data Model or to request additions of new concepts in the Data Model.

Next