RSA NetWitness Endpoint

RSA NetWitness Endpoint provides deep visibility beyond basic endpoint security solutions by monitoring and collecting activity across all of your endpoints on and off your network. The RSA Demisto integration provides access to information about endpoints, modules and indicators.

Endpoint · RSA NetWitness Endpoint

Configuration parameters

  • server — Server URL (e.g. https://192.168.0.1:30022) (required)
  • credentials — Username
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (7)

  • netwitness-blacklist-domains

    Add a list of domains to block list

  • netwitness-blacklist-ips

    Add a list of IP addresses to block list

  • netwitness-get-machine

    Get information on a specific machine.

  • netwitness-get-machine-iocs

    List IOC's for a specific machine.

  • netwitness-get-machine-module

    Get information on a specific machine module.

  • netwitness-get-machine-modules

    Get Names and ID's of modules of the machine. Filter by name or IOC score.

  • netwitness-get-machines

    Get machine GUID. Search by machine name and more.