RSA NetWitness Security Analytics

RSA Security Analytics, compatible with prior to v11. A distributed and modular system that enables highly flexible deployment architectures that scale with the needs of the organization. Security Analytics allows administrators to collect two types of data from the network infrastructure, packet data and log data.

Analytics & SIEM · RSA NetWitness Security Analytics

Configuration parameters

  • url — Server Url (192.168.56.101) (required)
  • username — Username
  • password — Password
  • credentials — Username
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • proxy — Use system proxy settings

Commands (27)

  • fetch-incidents

    Simulates fetching incidents. Returns array of incidents from NetWitness.

  • netwitness-im-add-events-to-incident

    This command will add new events to existing incident.

  • netwitness-im-create-incident

    Creating new incident.

  • netwitness-im-get-alert-details

    Return single alert by id

  • netwitness-im-get-alert-original

    Returns the original events which this alert contains.

  • netwitness-im-get-alerts

    Return all the alerts filtered by filter.

  • netwitness-im-get-available-assignees

    Returns the available users to be assigned to incidents.

  • netwitness-im-get-components

    Returns all the components in the system.

  • netwitness-im-get-event-details

    Returns two entries. One is event details json and the second is.

  • netwitness-im-get-events

    Returns all the events in defined time range.

  • netwitness-im-get-incident-details

    Returns incident json by id.

  • netwitness-im-list-incidents

    Fetches incidents by filter.

  • netwitness-im-login

    Logins to the system and returns valid sessionId.

  • netwitness-im-update-incident

    Updates incident.

  • nw-add-events-to-incident Deprecated

    This command will add new events to existing incident.

  • nw-create-incident Deprecated

    Creating new incident.

  • nw-get-alert-details Deprecated

    Return single alert by id

  • nw-get-alert-original Deprecated

    Returns the original events which this alert contains.

  • nw-get-alerts Deprecated

    Return all the alerts filtered by filter.

  • nw-get-available-assignees Deprecated

    Returns the available users to be assigned to incidents.

  • nw-get-components Deprecated

    Returns all the components in the system.

  • nw-get-event-details Deprecated

    Returns two entries. One is event details json and the second is event/session content.

  • nw-get-events Deprecated

    Returns all the events in defined time range.

  • nw-get-incident-details Deprecated

    Returns incident json by id.

  • nw-list-incidents Deprecated

    Fetches incidents by filter.

  • nw-login

    Logins to the system and returns valid sessionId.

  • nw-update-incident Deprecated

    Updates incident.