NetWitness Community

These scripts are used to allow the analysts to add and remove metadata keys with threat information that require additional monitoring. The 3 examples are for IP addresses, hostname and domain name (Wildcard). The scripts are configured with the fol...

Rui Ataide posted a useful Python script to query a Broker or Concentrator metadata from the command line (nwsdk_csv.py latest version 2016). In order to make it easier to use this Python script, I wrote a shell script to use as a simple interface th...

I needed to know how far back I can search my packets, logs and metadata and I created a shell script (netwitness_stats.sh) that runs on the SA Broker every 30 minutes that provides meta and packets statistics for a Concentrator, Decoder and LogDecod...

RSA used to provide a feed for Autonomous System Number (ASN) which is no longer available for download. I created a Perl script that convert the Maxmind CSV file into something usable by a decoder. The Perl script creates the ASN CSV file needed to ...

When a parser is updated (3 this week - DNS, HTTP and Mail), could support published/blog what was changed/updated in the parser to help us understand what kind of impact (i.e. new meta) or improvement (i.e. better memory management) it will have on ...