In this video, you'll learn how to interact with NetWitness core
services and Respond via the API. Having programmatic access to your
organization's raw data can enable automation of common or complex tasks
to save time and address security challenge...
It is no secret that getting your head around the capabilities or syntax
of Esper EPL can be difficult and that finding examples which fit your
needs can be just as hard. Even then, you may still be left with more
questions than answers. In this blog...
This video covers many topics related to HTTP and TLS investigation,
particularly in regards to NetWitness metadata and Wireshark fields.
During the course of an investigation it’s important to have as much
context as possible around typical behavior...
This article applies to hunting with Netwitness for Networks
(packet-based). Before proceeding, it is important that you are aware of
any GDPR or other applicable data collection regulations which will not
be covered here. Hunting for plaintext crede...
@J_Kerwin Not from me since my role is mostly focused in the NDR space.
However, Josh has a few videos on Endpoint which might be helpful if you
haven't seen them yet. Here's the first one:
https://www.youtube.com/watch?v=NDaDkYiOCCY
If anyone is struggling to get this running in newer versions of
NetWitness, try these two edits: Comment out or delete line 90 and move
line 91 to the left #if sys.version_info >= (2, 7, 9):
ssl._create_default_https_context = ssl._create_unverified...
For anyone using the NetWitness API token management manually (rather
than relying on the pre-request scripts), please note that there is a
mistake in the Auth > GetToken_refreshToken call. Under the Body
section, the token variable should be {<!-- -->{refre<!-- -->...
If you are receiving errors caused by an email address in the CN, here's
a fix for that. Basically, just add | sed 's/\/.*//' on line 65 as shown
below. [root@nwlab-nwadm01 feedcerts-joshrandal]# openssl s_client
-connect localhost:443 2>/dev/null | ...
