Hi community, any idea you have to be able to detect the duration of an
RDP session, I have used rules considering the correlation of login and
logoff/disconnected events but I have not been able to achieve it, has
anyone tried this use case before? ...
I'm trying to alert a Successful login from an Admin User in
Non-Business Hours... I copied the syntax from the RSA Live ESA Rule
related to Failed Logins: Here is the content of the new one:
@Name('Logon_Success_NBH')create context NotWorkingHours s...
I'm trying to index a meta key but it appears as "Not Index", anyway If
I do a query using the meta and a value the query shows the info as
well, looks like an aesthetic issue. I followed this guide:
https://community.netwitness.com/t5/netwitness-pla...
