Hi, I was troubleshooting a custom packet parser in my environment when
I realized my test traffic is plaintext only AFTER Netwitness already
deencoded it for viewing. That's awesome from an analyst standpoint. But
my parser was not grabbing any meta...
Our default GeoIP enrichment for ESA is dated January 2018, does this
get updated at all? If so, how can I update an offline deployment? I did
not see any enrichment resources on the Live portal.
Hello, I was curious about an issue I ran into while writing a custom
rule for a Netwitness packets deployment. Rather than including
destination ports and protocols, I was trying to filter on the metakey
"service". However, I realized that while the...
Hello All, I was wondering if anyone could help me use ESA with my
packet concentrators to automate my process for investigating
teleworkers logging in from different sources within a specific window.
I run a daily report that displays all of the use...
We're running 11.5.0, and I'm just exporting meta from the Event Viewer,
and pasting it into the ESA test window. That's where I get the error
about the type mismatch. (you can see it does the same thing to
"ip.proto")
Hi Karim, Unfortunately, it looks like this doesn't work. As you can see
below I did tweak your code just a bit to match the metakeys I'm using
for my searches, but I ran a regular search for teleworkers today, and
ESA did not alert on two users I sa...
