We just upgraded from 11.5.3.2 to 11.6.1.0. We enabled the Legacy
Navigate view ( /investigation/navigate ) but non of our analysts were
able to use it. They received a blue error message: Forbidden. You
cannot access the requested page.
/var/netwitn...
We find the NwConsole makemeta command (which is not described in the
User Guide) quite useful. It has an output format msgpack that looks
interesting. What tools can parse this msgpack format? Is there a way to
export metadata for long time storage ...
We are rolling out the new NwConsole fileHash feature across our packet
sensors. For other scripts we used tlogin so we don't have to store a
password in the script or config file. This does not seem to work for
sdk commands.My first try: # NwConsole...
I just upgraded our servers to NetWitness 11.4.1.2 and noticed almost
every page sends beacons to pendo.io:
https://cdn.pendo.io/agent/releases/2.58.0/guide.css
https://cdn.pendo.io/agent/static/5573cea1-9980-41fc-5e47-9708e86ba7ad/pendo.js
https://d...
I just had an interesting upgrade experience. On our test environment I
did an upgrade from NetWitness 11.4.0.1 to 11.4.1.0 and got stuck with
the UI not coming up. After some investigation the culprit showed in
/var/lib/netwitness/uax/logs/sa.log :2...
What do we need to do/configure to make NetWitness set service to 1099
for JRMI traffic? We always get service=0, see screenshot. JRMI example
Same question for service=636 / LDAPS.
I just used this procedure to access the platform.h2.db of
jettyuax-11.6.1.1-9_4_43_2108131346.5.6926b10.el7.noarch So
h2-1.4.199.jar still works for NetWitness 11.6.1.1
I suspect the md5 function was moved to a different lua library. Does
anybody know which one? --[[ -------------------- CALCULATE AN MD5 SUM
-------------------- 2013.10.01.1 REMOVED --]]
How about setting valueMax="0" for some meta keys? Does that make the
number of possible unique values unlimited? I understand this
can cause the index for these meta keys to become very large but that is
sometimes better than loosing the ability ...
Ok, so when the raw logs/pcap are gone because of retention and/or disk
space and we want to preserve the metadata for prosperity (and later
analysis) what is the recommended method in NetWitness?
