We have a problem with character encoding in CSV files generated by
scheduled reports in NetWitness.Reporting engine creates CSV files only
with UTF-8 encoding, which MS Excel is unable to process correctly and
it displays special/national characters...
I am trying to write a rule that will create alert on login out of
office hours, while using a context-hub list enrichment containing
whitelist of users that are allowed to do that. For imagination,
simplified version of the rule is: create context O...
I am creating EPL rule, where I want to take 2 type of events - one type
has user.src and the second type has different identification of user in
custom meta, for which I add user.src using a custom feed, but it can
have also empty user.src if the fe...
I am creating ESA Rules, but I see that alert generated by these rules
usually contains only one event, not all events that participated in
creation of the alert. I would like to add all related events into the
alert for some of the rules. Example of...
We recently upgraded from NetWitness 10.6.6 to 11.3. Several rules got
disabled during the upgrade and they no longer work.I suppose it is
mainly because directory meta changed type from string to string[], so
that it became an array.Simplified versi...
Hi Josh, I am not sure if that can help me, because as I mentioned, I
need to use a whitelist stored in a contexthub list (which is actually
created by export of AD group) in the rule. Your sample also uses
context, so I suppose I would have the same...
This looks like a useful tool, but I didn't find any update for it.
Where can I find the quarterly updated data and possibly released
version of the tool? I don't see any updates here since the initial post
in 2017...
I found a better and more effective solution. Your expression won't work
in case that more than one alias_host apperars in the event.This one
seems to work fine, at least in NW 11.3:expression string
firstString(arr)[ arr==null?'':(arr.get(0))]It ...
Hi Lee,I believe that your solution gives similar output like coalesce
function. The problem here is that when I create an alert using your
command:SELECT checkUser(checkThis) as user_src FROM Event checkThisThe
resulting alert will have only user_sr...
Thank you for your reply Joshua, but that is not what I was hoping to
find. I don't want to modify JS files as it is quite painful to maintain
that - they get replaced with every NetWitness update. And I want to
have just one rule for this.I hope the...
