Table of Contents
- Release Notes
-
Getting Started
-
Getting Started With NetWitness
- Getting Started with NetWitness Platform
- Logging in to NetWitness Platform
- Changing Your Password
- Identifying Your Role
- NetWitness Platform Basic Navigation
- Setting Up Your Default View by SOC Role
- Managing the Springboard
- Managing Dashboards
- Setting User Preferences
- Managing Jobs
- Viewing and Deleting Notifications
- Viewing Help in the Application
- Finding Documents on NetWitness Community
- Troubleshooting for User Setup
- NetWitness Platform Getting Started References
-
Set up your Hosts and Services
- Hosts and Services Basics
- Hosts and Services Set Up Procedures
- Hosts and Services Maintenance Procedures
-
References
- Hosts View
-
Services View
- Edit Service Dialog
- Services Config View
- Services Config View - Appliance Service Configuration Tab
- Services Config View - Data Retention Scheduler Tab
- Services Config View - Files Tab
- Services Explore View
- Services Explore View - Properties Dialog
- Services Logs View
- Services Security View
- Services Security View - Users Tab
- Services Security View - Roles Tab
- Services Security View - Settings Tab
- Services Stats View
- Services Stats View - Chart Stats Tray
- Services Stats View - Gauges
- Services Stats View - Timeline Charts
- Services System View
- Services Topology View
- Services System View - Host Task List Dialog
-
Service Configuration Parameters
- Aggregation Configuration Parameters
- Appliance Service Configuration Parameters
- Archiver Service Configuration Parameters
- Broker Service Configuration Parameters
- Concentrator Service Configuration Parameters
- Core Service Logging Configuration Parameters
- Core Service-to-Service Configuration Parameters
- Core Service System Configuration Parameters
- Decoder Configuration Parameters
- Network Decoder Service Configuration Parameters
- Log Decoder Service Configuration Parameters
- REST Interface Configuration Parameters
- NetWitness Platform Core Service system.roles Modes
- Centralized Service Configuration via Policy
- Troubleshooting Version Installations and Updates
-
Service Configuration Properties Guide
- Introduction
- Admin-server Configuration
- Analysis-server Configuration
- Config-server Configuration
- Content-server Configuration
- Contexthub-server Configuration
- Correlation-server Configuration
- Endpoint-broker-server Configuration
- Endpoint-server Configuration
- Enrichment-server Configuration
- Integration-server Configuration
- Investigate-server Configuration
- Launch-framework Configuration
- License-server Configuration
- Metrics-server Configuration
- Node-infra-server Configuration
- No-op-server Configuration
- Orchestration-server Configuration
- Relay-server Configuration
- Respond-server Configuration
- Security-server Configuration
- Source-server Configuration
- Quick Start - Investigation
- Quick Start - Endpoints
- Quick Start - UEBA
-
Getting Started With NetWitness
-
Install and Upgrade
- Deploy NetWitness
- Manage Licensing
- Physical Host Installation
-
Virtual Host Installation
- Basic Deployment
- Install NW Virtual Host in Virtual Environment
- Appendix A. Troubleshooting
- Appendix B. Silent Installation Using CLI
- Appendix C. Virtual Host Recommended System Requirements
- Appendix D. Update the Virtual ESA Host Memory
-
NetWitness Storage Configuration
- Storage Overview
- Storage Requirements
- Prepare Physical Storage
- Prepare Virtual or Cloud Storage
- Configure Storage Using the REST API
- Prepare Unity Storage
- Migrate Data to Another Storage Type
- Appendix A. How NetWitness Platform Hosts Store Data
- Appendix B. Encrypt a Series 6E Core or Hybrid Host (encryptSedVd.py)
- Appendix C. Troubleshooting
- Appendix D. Sample Storage Configuration Scenarios
- Revision History
- AWS Deployment
- Azure Deployment
- Google Cloud Platform Deployment
- Endpoint Agent Installation
- Migration Guide for NetWtiness Endpoint to RSA NetWitness Platform
- UEBA Standalone Installation
- Upgrade to NetWitness Platform 11.7
- Upgrade to NetWitness Platform 11.7.1
- Windows Legacy Log Collection Configuration
- NetWitness Export Connector Deployment
-
Configure and Manage
-
Decoder and Log Decoder Configuration
- Decoder and Log Decoder Quick Setup
-
Configure Common Settings on a Decoder
-
Configure Capture Settings
- (Optional) Configure System-Level (BPF) Packet Filtering
- (Optional) Configure a Decoder to Capture Data Across All Types of Network Interfaces
- (Optional) Configure Meta-Only Decoders
- (Optional) Configure Selective Network Data Collection
- (Optional) Configure a Decoder to Write Standard pcap-formatted Files
- (Optional) Multiple Adapter Packet Capture
- (Optional) Internet Content Adaptation Protocol Capture
- (Optional) Data Plane Development Kit Packet Capture
- (Optional) Preserve VLAN Tags When Using the Packet MMAP Capture Interface
- (Optional) Process Raw Syslog Data without Priority Field
- (Optional) Configure Decoder to Support OpenAppID
- Enable and Disable Parsers and Log Parsers
- Start and Stop Data Capture
-
Configure Capture Settings
- Configure Decoder Rules
- Configure Parsers and Feeds
-
Decoder and Log Decoder Additional Procedures
- Config_10g115
- Configure 10G Capability
- Configure a Log Decoder to Accept Protobuf
- Configure Session Split Timeouts
- Configure Syslog Forwarding to Destination
- Configure Transaction Handling on a Decoder
- Configure Data Export
- Decrypt Incoming Packets
- Edit Decoder System Configuration Settings
- Enable CPU Usage Stats for Installed Content
- Enable Parser Mappings
- Enable or Disable Lua and Flex Parsing Systems
- Map IP Address to Service Type
- Event Time Support
- Obtain Log Files from a Pre-11.0 Log Decoder
- Upload a Log File to a Log Decoder
- Upload a Packet Capture File
-
Decoder and Log Decoder References
- Services Config View - Capture Policies Tab
- Services Config View - Edit Policies Wizard
- Services Config View - Data Privacy Tab
- Services Config View - Data Retention Scheduler
- Services Config View - Feeds Tab
- Services Config View - Upload Feeds Dialog
- Services Config View - Files Tab
- Services Config View - General Tab
- Services Config View - Parsers Tab
- Services Config View - Parser Mappings Tab
- Services Config View - Data Export Tab
- Services Config View - Rules Tab
- Services Config View - App Rules Tab
- Services Config View - Correlation Rules Tab
- Services Config View - Network Rules Tab
- Services System View - Decoders
- Broker and Concentrator Configuration
- Core Database Tuning
- Live Services Management
-
Log Collection Configuration
- About Log Collection
- Log Collection Architecture
- Basic Implementation
- Log Collection Basics
-
Collection Protocols
- Configure AWS (CloudTrail) Event Sources
- Configure Azure Event Sources
- Configure Check Point Event Sources
- Configure File Event Sources
- Configure Logstash
- Configure Netflow Event Sources
- ODBC
- Configure SDEE Event Sources
- Configure SNMP Event Sources
- Configure Syslog Event Sources
- Configure VMware Event Sources
- Configure Windows Event Sources
- Windows Legacy Configuration
- Reference
- Log Collection: Troubleshoot
- Event Source Management
- Log Parser Customization
- Logstash Integration Configuration
- NetWitness Export Connector Configuration
- Archiver Configuration For Logs
- Workbench Configuration For Logs
-
Event Stream Analysis Configuration
- Event Stream Analysis Overview
- Configure ESA Correlation Rules
-
Additional ESA Correlation Rules Procedures
- Update Your ESA Rules for the Required Multi-Value and Single-Value Meta Keys
- Configure Advanced Settings for ESA Correlation
- Configure Character Case for Advanced ESA Rules
- Deploy Endpoint Risk Scoring Rules on ESA
- Change Memory Threshold for ESA Rules
- Start, Stop, or Restart ESA Service
- View Audit Logs and Verify ESA Component Versions
- References - Previous ESA Versions
-
Alerting with ESA Correlation Rules
- Getting Started with ESA
- How ESA Handles Sensitive Data
- ESA Rule Types
- Working with Trial Rules
- Add Rules to the Rules Library
- Download Configurable RSA Live ESA Rules
- Add a Rule Builder Rule
- Working With Rules
- Choose How to Be Notified of Alerts
- Add a Data Enrichment Source
- Deploy Rules to Run on ESA
- View ESA Stats and Alerts
- Add an Advanced EPL Rule
- Configure an In-Memory Table Using an EPL Query
- ESA Alert References
-
Context Hub Configuration
- How Context Hub Works
- Configure Lists as a Data Source
- Configure Archer as a Data Source
- Configure Active Directory Data Source
- Configure RSA EndPoint Data Source
- Configure Respond Data Source
- Configure File Reputation Server Data Source
- Configure STIX as a Data Source
- Configure RESTAPI as a Data Source
- Configure Data Sources Settings
- Import or Export Lists for Context Hub
- Manage Meta Type and Meta Key Mapping
- Context Hub Data Sources Tab
- Context Hub Lists Tab
- Context Hub STIX Tab
- Troubleshooting
-
Malware Analysis Configuration
- How Malware Analysis Works
-
Basic Setup
- Configure Malware Analysis Operating Environment
- Configure General Malware Analysis Settings
- Configure Indicators of Compromise
- Configure Installed Antivirus Vendors
- Enable Community Scoring
- (Optional) Configure Auditing on Malware Analysis Host
- (Optional) Configure Hash Filter
- (Optional) Configure Malware Analysis Proxy Settings
- (Optional) Register for a ThreatGRID API Key
- Additional Procedures for Configuring Malware Analysis
- Supported Antivirus Vendors
-
Malware Analysis References
- Services Config View - General Tab
- Services Config View - Indicators of Compromise Tab
- Services Config View - IOC Summary Tab
- Services Config View - Auditing Tab
- Services Config View - Hash Tab
- Services Config View - AV Tab
- Services Config View - Proxy Tab
- Services Config View - ThreatGRID Tab
- Services Config View - Integration Tab
-
NetWitness Endpoint Configuration
- NetWitness Endpoint Overview
- Agent Modes
- Endpoint Server Configuration
- Deploy Endpoint Application Rules and ESA Correlation Rules
- Setup Meta Forwarding to Log Decoder
- Endpoint Sources
- Create Groups and Policies
- Manage Groups
- Manage Policies
- Change Policy Ordering for Groups
- Configure Data Retention Policy
- Manage Role Permissions at Endpoint Server Level
- Manage Inactive Agents
- Configure Retention Policy for Memory Dumps and MFT
- (Optional) Installing and Configuring Relay Server
- Endpoint YARA Rules
- Configure OPSWAT
- Integrate NetWitness Endpoint 4.4.0.2 or Later with NetWitness Endpoint 11.3
- Endpoint References
- Troubleshooting
- Appendices
-
Respond Configuration for Incident Management
- About this Document
- NetWitness Respond Configuration Overview
- Configuring NetWitness Respond
-
Additional Procedures for Respond Configuration
- Set Up and Verify Default Incident Rules
- Configure Risk Scoring Settings for Automated Incident Creation
- Configure Custom Respond Server Alert Normalization
- Configure Analyst UI for Respond Server Alert Normalization
- Configure Incident Email Notification Settings
- Set a Retention Period for Alerts and Incidents
- Obfuscate Private Data
- Manage Incidents in Archer Cyber Incident & Breach Response
- Configure the Option to Send Incidents to RSA Archer
- Configure Threat Aware Authentication
- Set a Counter for Matched Alerts and Incidents
- Edit the Incident Rules Export ZIP File
- Configure a Database for the Respond Server Service
- NetWitness Respond Configuration Reference
-
Reporting Configuration
- How Reporting Engine Works
- Configure Reporting Engine
- Configure the Data Sources
- Configure Data Privacy for Reporting Engine
- Configure Data Source Permissions
- Configure Reporting Engine Settings
- How to Define Reports, Charts, and Alerts
- Configure Reporting Engine General Settings
- Reporting Engine Reference
-
Warehouse Connector Configuration
- How Warehouse Connector Works
- Install Warehouse Connector Service on a Log Decoder or Decoder
- Configure a Warehouse Connector Service
- Configure the Data Source for Warehouse Connector
- Configure the Destination
- Configure a Stream
- Monitor a Warehouse Connector
- Add Warehouse as a Data Source to Reporting Engine
- Analyze a Warehouse Report
- View the Warehouse Connector Service
- Troubleshoot the Warehouse Connector
- Manage a Stream
- Manage a Lockbox
- Warehouse Connector Configuration References
- UEBA Configuration
-
Service Configuration
- Introduction
- Admin-server Configuration
- Analysis-server Configuration
- Config-server Configuration
- Content-server Configuration
- Contexthub-server Configuration
- Correlation-server Configuration
- Endpoint-broker-server Configuration
- Endpoint-server Configuration
- Enrichment-server Configuration
- Integration-server Configuration
- Investigate-server Configuration
- Launch-framework Configuration
- License-server Configuration
- Metrics-server Configuration
- Node-infra-server Configuration
- No-op-server Configuration
- Orchestration-server Configuration
- Relay-server Configuration
- Respond-server Configuration
- Security-server Configuration
- Source-server Configuration
-
System Security and User Management
- Set Up System Security
- How Role-Based Access Control Works
- Manage Users with Roles and Permissions
- Set Up Multi-Factor Authentication
- Set Up Single Sign-On Authentication
- (Optional) Set Up Public Key Infrastructure (PKI) Authentication
- Troubleshooting
- References
- Data Privacy Management
-
System Configuration
- System Configuration Overview
-
Standard Procedures
- Access System Settings
- Configure Notification Servers
- Configure Notification Outputs
- Configure Templates for Notifications
- Configure Email Server and Notification Account
- Configure Global Audit Logging
- Configure Centralized Audit Logging
- Configure Investigation Settings
- Configure Live Services Settings
- Configure Log File Settings
- Configure Syslog and SNMP Settings
- AdditionalProcedures
- Troubleshooting System Configuration
- References
-
System Maintenance
- Overview
- Review Best Practices
-
Health and Wellness
- Monitor Health and Wellness using NetWitness Platform UI
- Monitor using New Health and Wellness
- Manage NetWitness Platform Updates
- Reissue Certificates
- DisplaySystem and Service Logs
- Maintain Queries Using URL Integration
- Manage the deploy_admin Account
- NW Server Host Secondary IP Configuration Management
- Change Host Network Configuration
- Manage Custom Host Entries
- Configure FIPS Support
- Configure DISA STIG Hardening
- Troubleshoot NetWitness Platform
- Troubleshooting Cert-Reissue Command
-
References
-
Health and Wellness
- Health and Wellness View - Alarms View
- Event Source Monitoring View
- Health and Wellness Historical Graphs
- Health and Wellness Settings View - Archiver
- Health and Wellness Settings View - Event Sources
- Health and Wellness Settings View - Warehouse Connector
- Monitoring View
- Policies View
- System Stats Browser View
- New Health and Wellness Settings
- System View - System Info Panel
- System Updates Panel - Settings View
- System Logging - Settings View
- System Logging - Realtime View
- System Logging - Historical View
-
Health and Wellness
- Disaster Recovery Tool
-
Decoder and Log Decoder Configuration
-
Investigate and Respond
-
NetWitness Investigation
- How NetWitness Investigate Works
- Configuring NetWitness Investigate Views and Preferences
- Beginning an Investigation
-
Refining the Results Set
- Use Meta Groups to Focus on Relevant Meta Keys
- Use Columns and Column Groups in the Events List
- Use Query Profiles to Encapsulate Common Areas for Investigation
- Drill into Metadata in the Events View (Beta)
- Filter Results in the Events View
- Filter Results in the Navigate View
- Filter Results in the Legacy Events View
- Create a Query in the Navigate and Legacy Events Views
- Search for Text Patterns in the Navigate and Legacy Events Views
- View and Modify Queries Using URL Integration
-
Reconstructing and Analyzing Events
- Examine Event Details in the Events View
- Analyze Events in the Events View
- Reconstruct an Event in the Legacy Events View
- Look Up Additional Context for Results
- Launch a Lookup of a Meta Key
- Launch a Malware Analysis Scan from the Navigate View
- Group Events from Split and Related Sessions in the Events and Legacy Events Views
- Visualize Metadata as Parallel Coordinates
- Visualize the Current Drill Point in Informer
- Downloading and Acting Upon Results
- Troubleshooting Investigate
-
Investigate Reference Materials
- Add Events to an Incident Dialog
- Add/Remove from List Dialog
- Column Groups Dialogs
- Context Lookup Panel
- Create an Incident Dialog
- Events View
- Events View - Email Tab
- Events View - File Tab
- Events View - Host Tab
- Events View - Packet Tab
- Events View - Text Tab
- Investigate Dialog
- Investigation Tab - User Preferences Panel
- Investigate View
- Legacy Event Reconstruction View
- Legacy Events View
- Manage Default Meta Keys Dialog
- Meta Groups Dialogs
- Navigate View
- Query Dialog
- Query Profiles Dialogs
- Settings Dialogs for Investigate Views
-
Malware Analysis
- Malware Analysis Functions
- Malware Scoring Modules
-
Conducting Malware Analysis
- Begin a Malware Analysis Investigation
- Implement Custom YARA Content
- Examine Scan Files and Events in List Form
- Configure the Malware Analysis Summary of Events View
- Filter Dashlet Data in the Summary of Events View
- Upload Files for Malware Analysis Scanning
- View Detailed Malware Analysis of an Event
- Malware Analysis Reference Materials
-
NetWitness Endpoint Investigation
- Introduction to Endpoint Investigation
- Workflow of an Investigation
- Investigate Files
- Investigate Hosts
- Investigate Process
- Change File Status and Remediate
- Analyze Downloaded Files
- Perform Forensic Investigation
- Analyze Events
- Network Isolation
- NetWitness Endpoint with Third-Party Antivirus Products
- Troubleshooting NetWitness Endpoint
- NetWitness Endpoint Reference Materials
- User and Entity Based Analytics
- Respond to Incidents
-
Generate Reports
- Reporting Overview
- Configure and Generate a Report
- Configure a Rule
- Create and Schedule a Report
- View a Report
- Investigate a Report
- Manage a List or Rule or Report
- Working with Charts
- Working with Alerts
- Appendix
-
Reporting References
- Build Chart View
- Build List View
- Build Report View
- Build Rule View
- Chart Permissions Dialog
- Chart View
- Execution History Panel
- Generate List Dialog
- Import Chart Dialog
- Import Report Dialog
- Investigate a Chart View
- List Permissions Dialog
- List View
- Reports Permissions Dialog
- Report View
- Rule Permissions Dialog
- Rule View
- Select a Logo Dialog
- Schedule a Chart View
- Schedule Report Panel
- Scheduled Reports View
- Test a Chart View
- View a Chart Panel
- View All Charts Panel
- View a Report Panel
- View All Reports Panel
- Alerting References
-
NetWitness Investigation
- Develop and Integrate
Introduction
NetWitness® Platform 11.7
NetWitness is excited to announce the general availability of NetWitness Platform 11.7 which delivers powerful new analyst features for network detection and response (NDR), enhanced investigative workflow, enhanced endpoint management, upgrade checks and improved administration.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
On this page
