To maintain healthy/secure systems and using enhanced features,
upgrading NetWitness stacks is one of key activities by security
operation team need to do at the time when new version or patch is
released. While performing the activities, one of key ...
When setting up capturing interface during decoder installation,There is
something useful if you know what happen under the hood of decoder.
[Network Interfaces] - S5 gearstandard interfaces: em1(IXGBE),
em2(IXGBE), em3(management), em4pfring interfa...
I've experienced an access deny saying "your account has expired"The
account was "admin" account also other accounts also has been denied
when trying a SA UI log in attempt. Right before admin sign in, customer
changed a security setting such as "pas...
I've developed a application rule to detect phishing attempt using fake
LinkedIn site.Don't hesitate to leave any suggestion or comment to
enhance this app rule [Scenario]Attacker lure a user to click a fake
LinkedIn link.the fake web site looks like...
Thanks Chris for clarifying on this. If you don't mind, one more quick
question for sure.If a customer of SA for packet want to use the meta
key, 'result.code' conveying only "response code number", Which one is
correct among these two options below,...
Hi Chris, Is this meta key included into new hunting pack? maybe new
http lua parser? or somewhere other?If i look into meta keys produced by
new http lua, no result.code meta key there.
If you have a value of ip.src you want compare,You can create a custom
lua parser to operate on meta-call back matching. This is about how to
create lua parser. https://community.rsa.com/docs/DOC-41370
