My rules is to check for hits from the list, which the list might
contains quite a huge data. For example the rule is: ip.dst = $List:
1.1.1.1, 2.2.2.2,......, etc.When I drill in to particular hits, the
query should be: (ip.dst = 1.1.1.1, 2.2.2.2, ....
Hi,May I know whether we can put more than 1 Meta keys in the
identifier?example:@RSAAlert(oneInSeconds=0,
identifiers={"user_dst","host_src","event_time"})@Name ("Privilege users
{user_dst} login to {host_src} at {event_time}")
can we create a rules under monitor tab against the list in the context
hub?I have the black list in the context hub, but I would like to know
whether the event contains any traffic that contains data in the list.
Hi, may i know how can we import the ioc in excel sheet into RSA
Netwitness, and compare the excel sheet with the current traffic in the
RSA Netwitness to check whether the folllowing ioc in excel sheet is
being found in the traffic.
