NetWitness Community

Table of Contents

•   Use Cases
  •   RSA NetWitness Packet Hunting Guide
  •   RSA UEBA Essentials Hunting Guide
•   Content Deployment
  •   Live Content Search Tags
  •   Investigation Model
  •   Endpoint Content 11.3
•   Content Development
  •   Guides
    •   Content Quick Start Guide
  •   Tools
    •   Virtual Hosts Additional Storage Playbook
    •   HTTP Lua Parsers CLI Debugging Tool
  •   Procedures
    •   Log Parsers
      •   Create Custom (File Collection) Typespec
      •   Create Custom (ODBC Collection) Typespec
      •   Log Parser Customization
      •   Custom CEF Parser
    •   ESA
      •   Implement Non-Standard Meta Keys Used in ESA Rules
      •   Context Hub Lists in ESA Rules
      •   ESA Rule Writing Best Practices
  •   Cheat Sheets
    •   Application Rules
    •   ESA Rule Writing Best Practices
•   RSA NetWitness Platform Content
  •   Bundles
    •   Known Threats Pack
    •   Lateral Movement Content Pack
    •   Hunting Pack
    •   UEBA Essentials Content Pack
  •   Parsers
    •   System Packet Parsers
    •   Lua Packet Parsers
      •   Traffic Flow LUA Parser
      •   Mail Lua Parser Options
      •   TLD Lua Parser Options
      •   HTTP Lua Parser Options
      •   LDAP Parser Options
      •   SMTP Parser Options
      •   Phishing Lua Parsons Options
  •   Investigation Meta
  •   RSA Threat Content Mapping with MITRE ATT&CK(tm)
  •   Feeds
    •   Investigation Feed
    •   In Depth Feeds Information
  •   Reports
    •   Core Compliance Reports
    •   RSA NetWitness Lists
    •   RSA NetWitness Reports
    •   RSA NetWitness Rules
  •   Rules
    •   RSA Application Rules
    •   RSA ESA Rules
      •   User Login Baseline Rule
  •   Dashboards
    •   Dashboards
    •   Dashlets
  •   NetWitness Instructional Videos on YouTube
  •   Deprecated
    •   Remove Original IR Pack
    •   Discontinued Content