NetWitness Community

PhilFinn · 2014-02-25

Can anyone help me with this rule, it is not working properly: Select: ip.dstWhere: ip.src=10.10.10.10Then: lookup_and_add('ip.src','ip.dst',5); lookup_and_add('size','ip.dst',5); lookup_and_add('ip.dstport','ip.dst',5); lookup_and_add('payload','ip....

PhilFinn · 2014-02-24

OK I have successfully created several custom feeds for things like bad IP or Bad Domain. Now I have to keep these feeds up-to-date on a regular basis. Can I just recomplied the .feed file and upload it and the CSV file to the decoders, then restart ...

PhilFinn · 2014-02-12

I am trying to create an Informer rule that will feed a Informer alert. I am basically looking for a direct to IP http connection followed by a query string that contains a "/" followed by 44 alpha or numeric string. This is what I wrote as the rule:...

PhilFinn · 2014-02-07

Does anyone have rule ideas for detecting this CVE. I have searched for extension=swf but that as i am sure you guessed was to broad. Since this is in the wild any help you could provide on this one would be great. Phil

PhilFinn · 2014-02-05

Is there a way to search for a specific packet size in Netwitness?

PhilFinn · 2014-04-24

Spoke to soon, looking at the concentrator shows that the regex query is being mangled with extra escape characters:\"\\/[0-9a-zA-Z]{7}\\/\\?[09-a-zA-Z]{5,};\"

PhilFinn · 2014-04-24

Thanks that worked.

PhilFinn · 2014-04-24

So the above Regex should look like:query regex "\/[0-9a-zA-Z]{7,}\/\?[0-9a-zA-Z]{5,};" Even if I use quotes, I will need to upgrade to 9.8.5.19 for the quotes to even work?

PhilFinn · 2014-04-24

This syntax does not appear to work when I put a comma between {}, I get the following error: This is what I used to get this this error:query regex \/[0-9a-zA-Z]{7,}\/\?[0-9a-zA-Z]{5,}; The below query patterns I am trying to match: Running my regex...

PhilFinn · 2014-02-27

No Dice that did not change the results of the rule.

NetWitness Community

User Statistics

User Activity

Informer Rule Not Working Properly

Updating Custom Feeds

Regex to many hits

CVE-2014-0497 Help

Searching for a specific packet size

Re: Using Regular Expressions within Investigator

Re: Using Regular Expressions within Investigator

Re: Using Regular Expressions within Investigator

Re: Using Regular Expressions within Investigator

Re: Informer Rule Not Working Properly