One of the more challenging things to accomplish in the RSA NetWitness
core database is querying and filtering using meta items that represent
byte sizes. At face value it may seem simple: sizes are just numbers, so
why would it be difficult to compa...
RSA NetWitness v11.1 introduces powerful new text indexing features to
the RSA NetWitness core database. However, they are disabled by default,
since using these features imposes a cost in terms of storage retention,
and potentially throughput. This ...
Who should read this documentPrerequisitesOverviewInstall the
ApplianceAllocate Storage in UnityRAID Groups needed for the RSA
NetWitness PlatformPerformance RecommendationsRecommended Storage
Allocation Per ApplianceInstall Dell EMC PowerPath on the...
The warning isn't written to trigger on 'unique values > valueMax'
because that condition is never allowed to occur. We can't put more
values than valueMax in the index. So if it was written that way, it
would never fire. The valueMax on the port val...
You probably have some parser (or other content) generating tcp.srcport
as something other than UInt16, for example as Text values. It would
likely be something non-RSA.
There's no way to predict exactly what the compression ratios will be.
It depends entirely on the data provided on input, and it can vary
wildly depending on what data is coming in at any given moment. As a
very broad estimate you could say log db (p...
