NetWitness is excited to announce the general availability of NetWitness Platform 12.4 which delivers powerful new analyst features for network detection and response (NDR), enhanced investigative workflow, enhanced endpoint management, upgrade checks, and improved administration.
Security Fixes in the Release
Known Issues in the Release
... View more
This topic provides information about license usage calculations for Decoder and Log Decoder Services.
Decoder and Log Decoder generate stats called Capture Bytes Processed which is used for license usage calculations.
Decoders also generate stats known as Packet Write Bytes in addition to Capture Bytes Processed.
Every hour, the system compares the current reading with the previous hour's usage.
If the current reading is greater than or equal to the previous hour's usage, calculate the per-hour usage as the difference: currentHourUsage = currentReading - previousHourUsage.
If the current value is less than the previous hour's usage, it indicates a Decoder restart. In this case, set currentHourUsage = currentReading.
At the end of the day, combine the usages of each individual hour for that day.
The same calculation is carried out for each licensed Decoder in the environment.
The combined usage of Capture Bytes Processed per day of all Log Decoders is shown under Logs Analyzed.
The combined usage of Capture Bytes Processed per day of all decoders is shown under Packets Analyzed.
The combined usage of Packet Write Bytes per day of all decoders is shown under Packets on disk.
Note: - All the calculations are done based on UTC time. - The daily usages shown on the UI is also based on UTC, irrespective of the timezone set in the user profile.
... View more