NetWitness has added support for the JA4 entity for UEBA from the 12.5
version or later. This change is implemented because JA4 is identified
as the most reliable and improved client identification method. JA4
leverages TLS Client Hello packets to id...
When adding Extended Meta to an environment it is recommended that this
be done slowly and incrementally. After each incremental change, users
should let the new data work its way through the system to see how
performance is impacted. Specific things...
Extended meta keys are configured in the index file using the attribute
maxValueLength. For example: Here we have
defined the meta key query to save values up to 4,096 bytes in size. Any
values exceeding 4k in length will be truncated to 4k. Note: A...
Users must opt into the Extended Meta feature and only specific types of
meta should be extended. Extended meta can have an impact on the
following areas (but not limited to): Database Size Extended meta refers
to data written to core databases. Incr...
The maximum meta value limit for Decoder and Log Decoder has always been
256 bytes. This means that when a Packet Decoder or Log Decoder
(hereafter collectively referred to as “Decoder”) parses raw data and
generates meta, the values of that meta can...
