RSA NetWitness v11.1 Deprecated

Deprecated. Use RSA NetWitness v11.5 instead

Analytics & SIEM · NetWitness

Configuration parameters

  • server — Server URL (e.g. https://192.168.0.1:30022) (required)
  • credentials — Credentials (required)
  • version — API version
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • importAlerts — On 'Fetch incidents' import all alerts related to the incident
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • fetch_limit — Fetch limit: the maximum number of incidents to fetch

Commands (5)

  • netwitness-delete-incident

    Delete a specific incident, by its id.

  • netwitness-get-alerts

    Get all the alerts related to a specific incident.

  • netwitness-get-incident

    Get details of a specific incident, including all alerts related with the incident.

  • netwitness-get-incidents

    Get a list of incidents in a specific time frame. One of the followings must be specified: since, until, lastDays

  • netwitness-update-incident

    Update a specific incident. Currently, an incident's status and assignee may be modified