RSA NetWitness v11.1 Deprecated
Deprecated. Use RSA NetWitness v11.5 instead
Analytics & SIEM · NetWitness
Details
| ID | RSA NetWitness v11.1 |
|---|---|
| Provider | PartnerOne |
| Category | Analytics & SIEM |
| From Version | 5.0.0 |
| Docker Image | demisto/python:2.7.18.27799 |
| Supported Modules | Agentix XSIAM |
README
Use the RSA NetWitness integration for systems Logs, Network, and endpoint visibility for real-time collection, detection, and automated response on Cortex XSOAR.
Providing full session analysis, customers can extract critical data and effectively operate security operations automated playbook.
Use Cases
- Monitor NetWitness incidents.
- Update existing incident.
- Query incidents in a specific time frame.
Prerequisites
You need the server URL and a valid NetWitness account before configuring a new instance.
Required Permissions
The following permission is required for all commands.
- integration-server.api.access
Configure RSA Netwitness on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for RSA netwitness.
- Click Add instance to create and configure a new integration instance.
- Name: A textual name for the integration instance.
- Server URL: Exchange server URL.
- Credentials: Your personal account username.
- Password: Your personal account password.
- Fetched incidents data: The integration imports NetWitness incident, and all alerts related, as Cortex XSOAR incident. All incidents created 24 hours prior to the configuration of ‘Fetch-incidents’ and up to current time will be imported.
- On Fetch incidents, import all alerts related to the incident.
- Fetch time: First fetch timestamp.
- Click Test to validate the URLs and token.
Fetched Incidents Data
To use Fetch incidents, select the Fetch Incidents checkbox when configuring a new integration instance.
By default, the integration will import NetWitness incidents data as Cortex XSOAR incidents.
To import related alerts data in addition to the incidents data, select the relevant checkbox in the instance settings.
All incidents created 24 hours prior to the configuration of Fetch Incidents and up to current time will be imported.
- Note - Due to API limitations, the first few attempts to fetch incidents may fail. If the fetch fails, you can either change the value of the "First fetch timestamp" parameter to fetch a smaller number of incidents or set the timeout of the fetch incidents command of the integration to a higher value.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- Get details for a specific incident: netwitness-get-incident
- Get a list of incidents: netwitness-get-incidents
- Update an incident: netwitness-update-incident
- Delete an incident: netwitness-delete-incident
- Get all alerts for an incident: netwitness-get-alerts
1. Get details for a specific incident
Get details of a specific incident, including all alerts related with the incident.
Base Command
netwitness-get-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| incidentId | The incident ID | Required |
Context Output
| Path | Description |
|---|---|
| NetWitness.Incidents.id | The unique identifier of the incident. |
| NetWitness.Incidents.title | Title of the incident. |
| NetWitness.Incidents.summary | Summary of the incident. |
| NetWitness.Incidents.priority | The incident priority. |
| NetWitness.Incidents.riskScore | Incident risk score calculated based on associated alert’s risk score. Risk score ranges from 0 (no risk) to 100 (highest risk). |
| NetWitness.Incidents.status | The current status. |
| NetWitness.Incidents.alertCount | Number of alerts associated with the Incident. |
| NetWitness.Incidents.averageAlertRiskScore | Average risk score of the alerts associated with the incident. |
| NetWitness.Incidents.sealed | Indicates if additional alerts can be associated with an incident. |
| NetWitness.Incidents.totalRemediationTaskCount | The number of total remediation tasks for the incident. |
| NetWitness.Incidents.openRemediationTaskCount | The number of open remediation tasks for the incident. |
| NetWitness.Incidents.created | The timestamp of when the incident is created. |
| NetWitness.Incidents.lastUpdated | The timestamp of when the incident was last updated. |
| NetWitness.Incidents.lastUpdatedBy | The NetWitness user identifier of the user who last updated the incident. |
| NetWitness.Incidents.assignee | The NetWitness user identifier of the user currently working on the incident. |
| NetWitness.Incidents.sources | Unique set of sources for all of the Alerts in the incident. |
| NetWitness.Incidents.ruleId | The unique identifier of the rule that created the incident. |
| NetWitness.Incidents.firstAlertTime | The timestamp of the earliest occurring Alert in this incident. |
| NetWitness.Incidents.categories.id | The unique category identifier. |
| NetWitness.Incidents.categories.parent | Parent name of the category. |
| NetWitness.Incidents.categories.name | Friendly name of the category. |
| NetWitness.Incidents.journalEntries.id | The unique journal entry identifier. |
| NetWitness.Incidents.journalEntries.author | The author of this entry. |
| NetWitness.Incidents.journalEntries.notes | Notes and observations about the incident. |
| NetWitness.Incidents.journalEntries.created | The timestamp of the journal entry created date. |
| NetWitness.Incidents.journalEntries.lastUpdated | The timestamp of the journal entry last updated date. |
| NetWitness.Incidents.journalEntries.milestone | Incident milestone classifier. |
| NetWitness.Incidents.createdBy | The NetWitness user id or name of the rule that created the incident. |
| NetWitness.Incidents.deletedAlertCount | The number of alerts that are deleted from theincident. |
| NetWitness.Incidents.eventCount | Number of events associated with incident. |
| NetWitness.Incidents.alertMeta.SourceIp | Unique source IP addresses. |
| NetWitness.Incidents.alertMeta.DestinationIp | Unique destination IP addresses. |
| NetWitness.Alerts.id | The unique alert identifier. |
| NetWitness.Alerts.incidentId | The incident id associated with the alert. |
| NetWitness.Alerts.title | The title or name of the rule that created the alert. |
| NetWitness.Alerts.detail | The details of the alert. This can be the module name or meta that the module included. |
| NetWitness.Alerts.created | The timestamp of the alert created date. |
| NetWitness.Alerts.source | The source of this alert. For example, "Event Stream Analysis", "Malware Analysis", etc. |
| NetWitness.Alerts.riskScore | The risk score of this alert, usually in the range 0 - 100. |
| NetWitness.Alerts.type | Type of alert, "Network", "Log", etc. |
| NetWitness.Alerts.events.source.device.ipAddress | The IP address. |
| NetWitness.Alerts.events.source.device.port | The port. |
| NetWitness.Alerts.events.source.device.macAddress | The ethernet MAC address. |
| NetWitness.Alerts.events.source.device.dnsHostname | The DNS resolved hostname. |
| NetWitness.Alerts.events.source.device.dnsDomain | The top-level domain from the DNS resolved hostname |
| NetWitness.Alerts.events.source.user.username | The unique username. |
| NetWitness.Alerts.events.source.user.emailAddress | An email address. |
| NetWitness.Alerts.events.source.user.adUsername | An Active Directory (AD) username. |
| NetWitness.Alerts.events.source.user.adDomain | An Active Directory (AD) domain |
| NetWitness.Alerts.events.destination.device.ipAddress | The IP address. |
| NetWitness.Alerts.events.destination.device.port | The port. |
| NetWitness.Alerts.events.destination.device.macAddress | The ethernet MAC address. |
| NetWitness.Alerts.events.destination.device.dnsHostname | The DNS resolved hostname. |
| NetWitness.Alerts.events.destination.device.dnsDomain | The top-level domain from the DNS resolved hostname |
| NetWitness.Alerts.events.destination.user.username | The unique username. |
| NetWitness.Alerts.events.destination.user.emailAddress | An email address. |
| NetWitness.Alerts.events.destination.user.adUsername | An Active Directory (AD) username. |
| NetWitness.Alerts.events.destination.user.adDomain | An Active Directory (AD) domain |
Command Example
!NetWitness -get-incident incidentId="INC-1"
Context Example
{
"NetWitness": {
"Alerts": {
"created": "2018-03-15T16:39:18.777Z",
"detail": null,
"events": [
{
"destination": {
"device": {
"dnsDomain": null,
"dnsHostname": null,
"ipAddress": "192.168.5.###",
"macAddress": "00:0C:29:62:29:##",
"port": 23
},
"user": {
"adDomain": null,
"adUsername": null,
"emailAddress": null,
"username": "administrator"
}
},
"domain": null,
"eventSource": null,
"eventSourceId": "7",
"source": {
"device": {
"dnsDomain": null,
"dnsHostname": null,
"ipAddress": "192.168.5.###",
"macAddress": "00:0C:29:D1:39:##",
"port": 1045
},
"user": {
"adDomain": null,
"adUsername": null,
"emailAddress": null,
"username": "administrator"
}
}
}
],
"id": "5aaaa1b69a95133336911c93",
"incidentId": "INC-12",
"riskScore": 50,
"source": "NetWitness Investigate",
"title": "Network Alert1",
"type": "Network"
},
"Incidents": {
"alertCount": 1,
"alertMeta": {
"DestinationIp": [
"192.168.5.###"
],
"SourceIp": [
"192.168.5.###"
]
},
"assignee": null,
"averageAlertRiskScore": 50,
"categories": [],
"created": "2018-03-15T16:39:18.802Z",
"createdBy": "admin",
"deletedAlertCount": 0,
"eventCount": 1,
"firstAlertTime": null,
"id": "INC-12",
"journalEntries": null,
"lastUpdated": "2018-03-16T05:51:03.233Z",
"lastUpdatedBy": "admin",
"openRemediationTaskCount": 0,
"priority": "Medium",
"riskScore": 50,
"ruleId": null,
"sealed": false,
"sources": [
"NetWitness Investigate"
],
"status": "New",
"summary": "",
"title": "Network Alert1",
"totalRemediationTaskCount": 0
}
}
}
Human Readable Output
Incident INC-12 Alerts
Alert Details
| ID | Title | Detail | Created | Source | Risk score | Type | Total events |
|---|---|---|---|---|---|---|---|
| 5aaaa1b69a95133336911c93 | Network Alert1 | 2018-03-15T16:39:18.777Z | NetWitness Investigate | 50 | Network | 1 |
Event Details
Domain: None
Source: None
ID: 7
Source
| Device IP | Device Port | Device MAC | User UserName |
|---|---|---|---|
| 192.168.5.189 | 1045 | 00:0C:29:D1:39:5D | administrator |
Destination
| Device IP | Device Port | Device MAC | User UserName |
|---|---|---|---|
| 192.168.5.172 | 23 | 00:0C:29:62:29:43 | administrator |
2. Get a list of incidents
Get a list of incidents in a specific time frame. All arguments are optional, but you need to specify at least one argument for the command to execute successfully.
Base Command
netwitness-get-incidents
Input
| Argument Name | Description | Required |
|---|---|---|
| since | Timestamp in ISO 8601 format (2018-01-01T14:00:00.000Z). Use to retrieve incidents created on and after this timestamp. | Optional |
| until | Timestamp in ISO 8601 format (2018-01-01T14:00:00.000Z). Use to retrieve incidents created on and before this timestamp. | Optional |
| limit | Maximum number of incidents to retrieve. Default is 200. | Optional |
| lastDays | Use this to retrieve incidents from the previous number of days. | Optional |
Context Output
| Path | Description |
|---|---|
| NetWitness.Incidents.id | Unique identifier of the incident |
| NetWitness.Incidents.title | Title of the incident |
| NetWitness.Incidents.summary | Summary of the incident |
| NetWitness.Incidents.priority | The incident priority |
| NetWitness.Incidents.riskScore | Incident risk score calculated based on associated alert’s risk score. Risk score ranges from 0 (no risk) to 100 (highest risk). |
| NetWitness.Incidents.status | The current status of the incident |
| NetWitness.Incidents.alertCount | Number of alerts associated with the incident |
| NetWitness.Incidents.averageAlertRiskScore | Average risk score of the alerts associated with the incident |
| NetWitness.Incidents.sealed | Indicates if additional alerts can be associated with an incident |
| NetWitness.Incidents.totalRemediationTaskCount | The number of total remediation tasks for the incident |
| NetWitness.Incidents.openRemediationTaskCount | The number of open remediation tasks for the incident |
| NetWitness.Incidents.created | The timestamp of when the incident is created |
| NetWitness.Incidents.lastUpdated | The timestamp of when the incident was last updated |
| NetWitness.Incidents.lastUpdatedBy | The NetWitness user identifier of the user who last updated the incident |
| NetWitness.Incidents.assignee | The NetWitness user identifier of the user currently working on the incident |
| NetWitness.Incidents.sources | Unique set of sources for all alerts in the incident |
| NetWitness.Incidents.ruleId | The unique identifier of the rule that created the incident |
| NetWitness.Incidents.firstAlertTime | The timestamp of the earliest occurring alert in this incident |
| NetWitness.Incidents.categories.id | The unique category identifier |
| NetWitness.Incidents.categories.parent | Parent name of the category |
| NetWitness.Incidents.categories.name | Friendly name of the category |
| NetWitness.Incidents.journalEntries.id | The unique journal entry identifier |
| NetWitness.Incidents.journalEntries.author | The author of this entry |
| NetWitness.Incidents.journalEntries.notes | Notes and observations about the incident |
| NetWitness.Incidents.journalEntries.created | The timestamp of the journal entry created date |
| NetWitness.Incidents.journalEntries.lastUpdated | The timestamp of the journal entry last updated date |
| NetWitness.Incidents.journalEntries.milestone | Incident milestone classifier |
| NetWitness.Incidents.createdBy | The NetWitness user ID or username of the rule that created the incident |
| NetWitness.Incidents.deletedAlertCount | The number of alerts that are deleted from the incident |
| NetWitness.Incidents.eventCount | Number of events associated with incident |
| NetWitness.Incidents.alertMeta.SourceIp | Unique source IP addresses |
| NetWitness.Incidents.alertMeta.DestinationIp | Unique destination IP addresses |
Command Examples
!NetWitness -get-incidents since=2018-01-01T14:00:00.000Z limit=200
!NetWitness -get-incidents lastDays=4
Context Example
{
"NetWitness": {
"Incidents": [
{
"alertCount": 1,
"alertMeta": {
"DestinationIp": [
""
],
"SourceIp": [
""
]
},
"assignee": null,
"averageAlertRiskScore": 50,
"categories": [],
"created": "2018-03-29T13:55:55.644Z",
"createdBy": "admin",
"deletedAlertCount": 0,
"eventCount": 2,
"firstAlertTime": null,
"id": "INC-23",
"journalEntries": null,
"lastUpdated": "2018-03-29T13:55:55.644Z",
"lastUpdatedBy": "admin",
"openRemediationTaskCount": 0,
"priority": "Critical",
"riskScore": 50,
"ruleId": null,
"sealed": false,
"sources": [
"NetWitness Investigate"
],
"status": "New",
"summary": "summary test ",
"title": "test incident",
"totalRemediationTaskCount": 0
},
{
"alertCount": 1,
"alertMeta": {
"DestinationIp": [
"75.98.175.###"
],
"SourceIp": [
"192.168.11.###"
]
},
"assignee": null,
"averageAlertRiskScore": 50,
"categories": [],
"created": "2018-03-27T16:07:19.521Z",
"createdBy": "admin",
"deletedAlertCount": 0,
"eventCount": 1,
"firstAlertTime": null,
"id": "INC-14",
"journalEntries": null,
"lastUpdated": "2018-03-27T16:07:19.521Z",
"lastUpdatedBy": "admin",
"openRemediationTaskCount": 0,
"priority": "Critical",
"riskScore": 50,
"ruleId": null,
"sealed": false,
"sources": [
"NetWitness Investigate"
],
"status": "New",
"summary": "",
"title": "log",
"totalRemediationTaskCount": 0
}
]
}
}
Human Readable Output
NetWitness Get Incidents
Incident Details
| ID | Title | Summary | Risk score | Status | Alert count | Created | Last updated | Assignee | Sources | Categories |
|---|---|---|---|---|---|---|---|---|---|---|
| INC-23 | test incident | summary test | 50 | New | 1 | 2018-03-29T13:55:55.644Z | 2018-03-29T13:55:55.644Z | NetWitness Investigate | ||
| INC-22 | test | blob | 60 | Assigned | 1 | 2018-03-29T13:41:00.965Z | 2018-07-12T13:54:47.194Z | admin | NetWitness Investigate | Physical:Connection |
| INC-21 | User Behavior for test_user | 30 | New | 1 | 2018-03-28T19:27:48.521Z | 2018-03-28T19:27:48.521Z | Event Stream Analysis | |||
| INC-20 | ttyyy | 50 | New | 1 | 2018-03-27T16:16:01.899Z | 2018-03-27T16:16:01.899Z | NetWitness Investigate | |||
| INC-19 | test | 50 | New | 1 | 2018-03-27T16:15:50.027Z | 2018-03-27T16:15:50.027Z | NetWitness Investigate | |||
| INC-18 | log3 | 50 | New | 1 | 2018-03-27T16:08:10.565Z | 2018-03-27T16:08:10.565Z | NetWitness Investigate | |||
| INC-17 | log4 | 50 | New | 1 | 2018-03-27T16:07:55.403Z | 2018-03-27T16:07:55.403Z | NetWitness Investigate | |||
| INC-16 | log2 | 50 | New | 1 | 2018-03-27T16:07:43.418Z | 2018-03-27T16:07:43.418Z | NetWitness Investigate |
3. Update an incident
Update a specific incident. Currently, an incident’s status and assignee may be modified
Base Command
netwitness-update-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| incidentId | The incident ID | Required |
| status | The incident's current status | Optional |
| assignee | The NetWitness user identifier of the user currently working on the incident | Optional |
Context Output
| Path | Description |
|---|---|
| NetWitness.Incidents.id | The unique identifier of the incident. |
| NetWitness.Incidents.title | Title of the incident |
| NetWitness.Incidents.summary | Summary of the incident |
| NetWitness.Incidents.priority | The incident priority |
| NetWitness.Incidents.riskScore | Incident risk score calculated based on associated alert’s risk score. Risk score ranges from 0 (no risk) to 100 (highest risk). |
| NetWitness.Incidents.status | The current status of the incident |
| NetWitness.Incidents.alertCount | Number of alerts associated with the incident |
| NetWitness.Incidents.averageAlertRiskScore | Average risk score of the alerts associated with the incident |
| NetWitness.Incidents.sealed | Indicates if additional alerts can be associated with an incident |
| NetWitness.Incidents.totalRemediationTaskCount | The number of total remediation tasks for the incident |
| NetWitness.Incidents.openRemediationTaskCount | The number of open remediation tasks for the incident |
| NetWitness.Incidents.created | The timestamp of when the incident is created |
| NetWitness.Incidents.lastUpdated | The timestamp of when the incident was last updated |
| NetWitness.Incidents.lastUpdatedBy | The NetWitness user identifier of the user who last updated the incident |
| NetWitness.Incidents.assignee | The NetWitness user identifier of the user currently working on the incident |
| NetWitness.Incidents.sources | Unique set of sources for all alerts in the incident |
| NetWitness.Incidents.ruleId | The unique identifier of the rule that created the incident |
| NetWitness.Incidents.firstAlertTime | The timestamp of the earliest occurring alert in this incident |
| NetWitness.Incidents.categories.id | The unique category identifier |
| NetWitness.Incidents.categories.parent | Parent name of the category |
| NetWitness.Incidents.categories.name | Friendly name of the category |
| NetWitness.Incidents.journalEntries.id | The unique journal entry identifier |
| NetWitness.Incidents.journalEntries.author | The author of this entry |
| NetWitness.Incidents.journalEntries.notes | Notes and observations about the incident |
| NetWitness.Incidents.journalEntries.created | The timestamp of the journal entry created date |
| NetWitness.Incidents.journalEntries.lastUpdated | The timestamp of the journal entry last updated date |
| NetWitness.Incidents.journalEntries.milestone | Incident milestone classifier |
| NetWitness.Incidents.createdBy | The NetWitness user ID or username of the rule that created the incident |
| NetWitness.Incidents.deletedAlertCount | The number of alerts that are deleted from the incident |
| NetWitness.Incidents.eventCount | Number of events associated with incident |
| NetWitness.Incidents.alertMeta.SourceIp | Unique source IP addresses |
| NetWitness.Incidents.alertMeta.DestinationIp | Unique destination IP addresses |
Command Example
!netwitness-update-incident incidentId=INC-12 status=InProgress
Context Example
{
"NetWitness": {
"Incidents": {
"alertCount": 1,
"alertMeta": {
"DestinationIp": [
"192.168.5.172"
],
"SourceIp": [
"192.168.5.189"
]
},
"assignee": null,
"averageAlertRiskScore": 50,
"categories": [],
"created": "2018-03-15T16:39:18.802Z",
"createdBy": "admin",
"deletedAlertCount": 0,
"eventCount": 1,
"firstAlertTime": null,
"id": "INC-12",
"journalEntries": null,
"lastUpdated": "2018-08-28T16:18:20.858Z",
"lastUpdatedBy": "admin",
"openRemediationTaskCount": 0,
"priority": "Medium",
"riskScore": 50,
"ruleId": null,
"sealed": true,
"sources": [
"NetWitness Investigate"
],
"status": "InProgress",
"summary": "",
"title": "Network Alert1",
"totalRemediationTaskCount": 0
}
}
}
Human Readable Output
NetWitness Update Incident
Incident Details
| ID | Title | Summary | Risk score | Status | Alert count | Created | Last updated | Assignee | Sources | Categories |
|---|---|---|---|---|---|---|---|---|---|---|
| INC-12 | Network Alert1 | 50 | InProgress | 1 | 2018-03-15T16:39:18.802Z | 2018-08-28T16:18:20.858Z | NetWitness Investigate |
4. Delete an incident
Delete a specific incident, according to the incident ID.
Base Command
netwitness-delete-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| incidentId | The incident ID | Required |
Context Output
There is no context output for this command.
Command Example
!netwitness-delete-incident incidentId=INC-12
5. Get all alerts for an incident
Get all the alerts related to a specific incident.
Base Command
netwitness-get-alerts
Input
| Argument Name | Description | Required |
|---|---|---|
| incidentId | The incident ID | Required |
Context Output
| Path | Description |
|---|---|
| NetWitness.Alerts.id | The unique alert identifier |
| NetWitness.Alerts.incidentId | The incident ID associated with the alert |
| NetWitness.Alerts.title | The title or name of the rule that created the alert |
| NetWitness.Alerts.detail | The details of the alert. This can be the module name or meta that the module included. |
| NetWitness.Alerts.created | The timestamp of the alert created date |
| NetWitness.Alerts.source | The source of this alert. For example, "Event Stream Analysis", "Malware Analysis", and so on. |
| NetWitness.Alerts.riskScore | The risk score of this alert, usually in the range 0 - 100. |
| NetWitness.Alerts.type | Type of alert (Network, Log, and so on) |
| NetWitness.Alerts.events.source.device.ipAddress | The source IP address |
| NetWitness.Alerts.events.source.device.port | The source port |
| NetWitness.Alerts.events.source.device.macAddress | The source Ethernet MAC address |
| NetWitness.Alerts.events.source.device.dnsHostname | The source DNS resolved hostname |
| NetWitness.Alerts.events.source.device.dnsDomain | The top-level domain from the DNS resolved hostname (source) |
| NetWitness.Alerts.events.source.user.username | The unique username (source) |
| NetWitness.Alerts.events.source.user.emailAddress | An email address (source) |
| NetWitness.Alerts.events.source.user.adUsername | An Active Directory (AD) username (source) |
| NetWitness.Alerts.events.source.user.adDomain | An Active Directory (AD) domain (source) |
| NetWitness.Alerts.events.destination.device.ipAddress | The destination IP address |
| NetWitness.Alerts.events.destination.device.port | The destination port |
| NetWitness.Alerts.events.destination.device.macAddress | The destination Ethernet MAC address |
| NetWitness.Alerts.events.destination.device.dnsHostname | The destination DNS resolved hostname |
| NetWitness.Alerts.events.destination.device.dnsDomain | The top-level domain from the DNS resolved hostname (destination) |
| NetWitness.Alerts.events.destination.user.username | The unique username (destination) |
| NetWitness.Alerts.events.destination.user.emailAddress | An email address (destination) |
| NetWitness.Alerts.events.destination.user.adUsername | An Active Directory (AD) username (destination) |
| NetWitness.Alerts.events.destination.user.adDomain | An Active Directory (AD) domain (destination) |
Command Example
!netwitness-get-alerts incidentId="INC-12"
Context Example
{
"NetWitness": {
"Alerts": {
"created": "2018-03-15T16:39:18.777Z",
"detail": null,
"events": [
{
"destination": {
"device": {
"dnsDomain": null,
"dnsHostname": null,
"ipAddress": "192.168.5.172",
"macAddress": "00:0C:29:62:29:43",
"port": 23
},
"user": {
"adDomain": null,
"adUsername": null,
"emailAddress": null,
"username": "administrator"
}
},
"domain": null,
"eventSource": null,
"eventSourceId": "7",
"source": {
"device": {
"dnsDomain": null,
"dnsHostname": null,
"ipAddress": "192.168.5.189",
"macAddress": "00:0C:29:D1:39:5D",
"port": 1045
},
"user": {
"adDomain": null,
"adUsername": null,
"emailAddress": null,
"username": "administrator"
}
}
}
],
"id": "5aaaa1b69a95133336911c93",
"incidentId": "INC-12",
"riskScore": 50,
"source": "NetWitness Investigate",
"title": "Network Alert1",
"type": "Network"
}
}
}
Human Readable Output
Incident INC-12 Alerts
Alert Details
| ID | Title | Detail | Created | Source | Risk score | Type | Total events |
|---|---|---|---|---|---|---|---|
| 5aaaa1b69a95133336911c93 | Network Alert1 | 2018-03-15T16:39:18.777Z | NetWitness Investigate | 50 | Network | 1 |
Event Details
Domain: None
Source: None
ID: 7
Source
| Device IP | Device Port | Device MAC | User UserName |
|---|---|---|---|
| 192.168.5.189 | 1045 | 00:0C:29:D1:39:5D | administrator |
Destination
| Device IP | Device Port | Device MAC | User UserName |
|---|---|---|---|
| 192.168.5.172 | 23 | 00:0C:29:62:29:43 | administrator |
Additional Information
Incidents query with time frame restriction
The time frame can be restricted on only one end, specifying since or until arguments, or restricted on both ends, specifying both arguments.
Both arguments should be passed in ISO 8601 format:
!NetWitness-get-incidents since=2018-01-01T14:00:00.000Z
until=2018-01-01T16:30:00.000Z
In this example, all incidents created between 2:00 PM on January 1, 2018 and 2:30 PM
the same day will be fetched.
Another option is to specify the number of days prior as a time frame:
!NetWitness-get-incidents lastDays=10
In this example, all incidents created in the 10 days prior to the current date will be fetched.
Known Limitations
- Only an incident’s status and assignee fields can be modified.
- Incidents query can only be filtered using by time frame.
Troubleshooting
-
‘Request failed with status: 400..’ error when running a NetWitness command
If this error raises, it indicates one of the arguments passed is not a valid value.
For example:- Passing non-existing incident id to ‘get-incidents’ will cause this type of error.
- Passing invalid timestamp to ‘NetWitness-get-incidents’ will cause this type of error.
The error message provides a short description of the problem.
Error snap-shot
-
‘Login failed with status: 401..’ when testing instance configuration
This error indicates bad credentials are configured in the instance settings.
Make sure correct credentials and password is configured in the instance settings.Error snap-shot
-
‘…CERTIFICATE_VERIFY_FAILED...’ error when testing instance configuration
This error may indicate that server certificate is missing/cannot be validated.
It is possible to bypass certificate validation by checking ‘Do not validate server certificate’ in the instance settings.
Configuration parameters
server— Server URL (e.g. https://192.168.0.1:30022) (required)credentials— Credentials (required)version— API versioninsecure— Trust any certificate (not secure)proxy— Use system proxy settingsisFetch— Fetch incidentsincidentType— Incident typeimportAlerts— On 'Fetch incidents' import all alerts related to the incidentfetch_time— First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)fetch_limit— Fetch limit: the maximum number of incidents to fetch
Commands (5)
-
netwitness-delete-incidentDelete a specific incident, by its id.
-
netwitness-get-alertsGet all the alerts related to a specific incident.
-
netwitness-get-incidentGet details of a specific incident, including all alerts related with the incident.
-
netwitness-get-incidentsGet a list of incidents in a specific time frame. One of the followings must be specified: since, until, lastDays
-
netwitness-update-incidentUpdate a specific incident. Currently, an incident's status and assignee may be modified
category: Analytics & SIEM provider: PartnerOne commonfields: id: RSA NetWitness v11.1 version: -1 configuration: - display: Server URL (e.g. https://192.168.0.1:30022) name: server required: true type: 0 - display: Credentials name: credentials required: true type: 9 - defaultvalue: '1.0' display: API version name: version type: 0 required: false - defaultvalue: 'false' display: Trust any certificate (not secure) name: insecure type: 8 required: false - defaultvalue: 'false' display: Use system proxy settings name: proxy type: 8 required: false - display: Fetch incidents name: isFetch type: 8 required: false - display: Incident type name: incidentType type: 13 required: false - defaultvalue: 'false' display: On 'Fetch incidents' import all alerts related to the incident name: importAlerts type: 8 required: false - defaultvalue: 1 days display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) name: fetch_time type: 0 required: false - defaultvalue: '100' display: 'Fetch limit: the maximum number of incidents to fetch' name: fetch_limit type: 0 required: false description: Deprecated. Use RSA NetWitness v11.5 instead display: RSA NetWitness v11.1 (Deprecated) name: RSA NetWitness v11.1 deprecated: true script: commands: - arguments: - description: The incident id name: incidentId required: true description: Get details of a specific incident, including all alerts related with the incident. name: netwitness-get-incident outputs: - contextPath: NetWitness.Incidents.id description: The unique identifier of the incident. type: Unknown - contextPath: NetWitness.Incidents.title description: Title of the incident. type: Unknown - contextPath: NetWitness.Incidents.summary description: Summary of the incident. type: Unknown - contextPath: NetWitness.Incidents.priority description: The incident priority. type: Unknown - contextPath: NetWitness.Incidents.riskScore description: Incident risk score calculated based on associated alert's risk score. Risk score ranges from 0 (no risk) to 100 (highest risk). type: Unknown - contextPath: NetWitness.Incidents.status description: The current status. type: Unknown - contextPath: NetWitness.Incidents.alertCount description: Number of alerts associated with the Incident. type: Unknown - contextPath: NetWitness.Incidents.averageAlertRiskScore description: Average risk score of the alerts associated with the incident. type: Unknown - contextPath: NetWitness.Incidents.sealed description: Indicates if additional alerts can be associated with an incident. type: Unknown - contextPath: NetWitness.Incidents.totalRemediationTaskCount description: The number of total remediation tasks for the incident. type: Unknown - contextPath: NetWitness.Incidents.openRemediationTaskCount description: The number of open remediation tasks for the incident. type: Unknown - contextPath: NetWitness.Incidents.created description: The timestamp of when the incident is created. type: Unknown - contextPath: NetWitness.Incidents.lastUpdated description: The timestamp of when the incident was last updated. type: Unknown - contextPath: NetWitness.Incidents.lastUpdatedBy description: The NetWitness user identifier of the user who last updated the incident. type: Unknown - contextPath: NetWitness.Incidents.assignee description: The NetWitness user identifier of the user currently working on the incident. type: Unknown - contextPath: NetWitness.Incidents.sources description: Unique set of sources for all of the Alerts in the incident. type: Unknown - contextPath: NetWitness.Incidents.ruleId description: The unique identifier of the rule that created the incident. type: Unknown - contextPath: NetWitness.Incidents.firstAlertTime description: The timestamp of the earliest occurring Alert in this incident. type: Unknown - contextPath: NetWitness.Incidents.categories.id description: The unique category identifier. type: Unknown - contextPath: NetWitness.Incidents.categories.parent description: Parent name of the category. type: Unknown - contextPath: NetWitness.Incidents.categories.name description: Friendly name of the category. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.id description: The unique journal entry identifier. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.author description: The author of this entry. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.notes description: Notes and observations about the incident. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.created description: The timestamp of the journal entry created date. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.lastUpdated description: The timestamp of the journal entry last updated date. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.milestone description: Incident milestone classifier. type: Unknown - contextPath: NetWitness.Incidents.createdBy description: The NetWitness user id or name of the rule that created the incident. type: Unknown - contextPath: NetWitness.Incidents.deletedAlertCount description: The number of alerts that are deleted from theincident. type: Unknown - contextPath: NetWitness.Incidents.eventCount description: Number of events associated with incident. type: Unknown - contextPath: NetWitness.Incidents.alertMeta.SourceIp description: Unique source IP addresses. type: Unknown - contextPath: NetWitness.Incidents.alertMeta.DestinationIp description: Unique destination IP addresses. type: Unknown - contextPath: NetWitness.Alerts.id description: The unique alert identifier. type: Unknown - contextPath: NetWitness.Alerts.incidentId description: The incident id associated with the alert. type: Unknown - contextPath: NetWitness.Alerts.title description: The title or name of the rule that created the alert. type: Unknown - contextPath: NetWitness.Alerts.detail description: The details of the alert. This can be the module name or meta that the module included. type: Unknown - contextPath: NetWitness.Alerts.created description: The timestamp of the alert created date. type: Unknown - contextPath: NetWitness.Alerts.source description: The source of this alert. For example, "Event Stream Analysis", "Malware Analysis", etc. type: Unknown - contextPath: NetWitness.Alerts.riskScore description: The risk score of this alert, usually in the range 0 - 100. type: Unknown - contextPath: NetWitness.Alerts.type description: Type of alert, "Network", "Log", etc. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.ipAddress description: The IP address. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.port description: The port. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.macAddress description: The ethernet MAC address. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.dnsHostname description: The DNS resolved hostname. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.dnsDomain description: The top-level domain from the DNS resolved hostname type: Unknown - contextPath: NetWitness.Alerts.events.source.user.username description: The unique username. type: Unknown - contextPath: NetWitness.Alerts.events.source.user.emailAddress description: An email address. type: Unknown - contextPath: NetWitness.Alerts.events.source.user.adUsername description: An Active Directory (AD) username. type: Unknown - contextPath: NetWitness.Alerts.events.source.user.adDomain description: An Active Directory (AD) domain type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.ipAddress description: The IP address. type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.port description: The port. type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.macAddress description: The ethernet MAC address. type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.dnsHostname description: The DNS resolved hostname. type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.dnsDomain description: The top-level domain from the DNS resolved hostname type: Unknown - contextPath: NetWitness.Alerts.events.destination.user.username description: The unique username. type: Unknown - contextPath: NetWitness.Alerts.events.destination.user.emailAddress description: An email address. type: Unknown - contextPath: NetWitness.Alerts.events.destination.user.adUsername description: An Active Directory (AD) username. type: Unknown - contextPath: NetWitness.Alerts.events.destination.user.adDomain description: An Active Directory (AD) domain type: Unknown - arguments: - description: A timestamp in ISO 8601 format (e.g. 2018-01-01T14:00:00.000Z). Use to retrieve incidents created on and after this timestamp. name: since - description: A timestamp in ISO 8601 format (e.g. 2018-01-01T14:00:00.000Z). Use to retrieve incidents created on and before this timestamp. name: until - defaultValue: '200' description: The maximum number of incidents to retrieve. default is 200. name: limit - description: Use this to retrieve incidents from the last number of days specified. name: lastDays - defaultValue: '0' description: The requested page number. name: pageNumber description: 'Get a list of incidents in a specific time frame. One of the followings must be specified: since, until, lastDays' name: netwitness-get-incidents outputs: - contextPath: NetWitness.Incidents.id description: The unique identifier of the incident. type: Unknown - contextPath: NetWitness.Incidents.title description: Title of the incident. type: Unknown - contextPath: NetWitness.Incidents.summary description: Summary of the incident. type: Unknown - contextPath: NetWitness.Incidents.priority description: The incident priority. type: Unknown - contextPath: NetWitness.Incidents.riskScore description: Incident risk score calculated based on associated alert's risk score. Risk score ranges from 0 (no risk) to 100 (highest risk). type: Unknown - contextPath: NetWitness.Incidents.status description: The current status. type: Unknown - contextPath: NetWitness.Incidents.alertCount description: Number of alerts associated with the Incident. type: Unknown - contextPath: NetWitness.Incidents.averageAlertRiskScore description: Average risk score of the alerts associated with the incident. type: Unknown - contextPath: NetWitness.Incidents.sealed description: Indicates if additional alerts can be associated with an incident. type: Unknown - contextPath: NetWitness.Incidents.totalRemediationTaskCount description: The number of total remediation tasks for the incident. type: Unknown - contextPath: NetWitness.Incidents.openRemediationTaskCount description: The number of open remediation tasks for the incident. type: Unknown - contextPath: NetWitness.Incidents.created description: The timestamp of when the incident is created. type: Unknown - contextPath: NetWitness.Incidents.lastUpdated description: The timestamp of when the incident was last updated. type: Unknown - contextPath: NetWitness.Incidents.lastUpdatedBy description: The NetWitness user identifier of the user who last updated the incident. type: Unknown - contextPath: NetWitness.Incidents.assignee description: The NetWitness user identifier of the user currently working on the incident. type: Unknown - contextPath: NetWitness.Incidents.sources description: Unique set of sources for all of the Alerts in the incident. type: Unknown - contextPath: NetWitness.Incidents.ruleId description: The unique identifier of the rule that created the incident. type: Unknown - contextPath: NetWitness.Incidents.firstAlertTime description: The timestamp of the earliest occurring Alert in this incident. type: Unknown - contextPath: NetWitness.Incidents.categories.id description: The unique category identifier. type: Unknown - contextPath: NetWitness.Incidents.categories.parent description: Parent name of the category. type: Unknown - contextPath: NetWitness.Incidents.categories.name description: Friendly name of the category. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.id description: The unique journal entry identifier. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.author description: The author of this entry. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.notes description: Notes and observations about the incident. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.created description: The timestamp of the journal entry created date. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.lastUpdated description: The timestamp of the journal entry last updated date. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.milestone description: Incident milestone classifier. type: Unknown - contextPath: NetWitness.Incidents.createdBy description: The NetWitness user id or name of the rule that created the incident. type: Unknown - contextPath: NetWitness.Incidents.deletedAlertCount description: The number of alerts that are deleted from theincident. type: Unknown - contextPath: NetWitness.Incidents.eventCount description: Number of events associated with incident. type: Unknown - contextPath: NetWitness.Incidents.alertMeta.SourceIp description: Unique source IP addresses. type: Unknown - contextPath: NetWitness.Incidents.alertMeta.DestinationIp description: Unique destination IP addresses. type: Unknown - contextPath: NetWitness.Incidents.NextPage description: Next page number that wasn't fetched in the last command run (will be empty if all incidents were fetched). type: Number - arguments: - description: The incident's id name: incidentId required: true - auto: PREDEFINED description: The current status name: status predefined: - New - Assigned - InProgress - RemediationRequested - RemediationComplete - Closed - ClosedFalsePositive - description: The NetWitness user identifier of the user currently working on the incident. name: assignee description: Update a specific incident. Currently, an incident's status and assignee may be modified name: netwitness-update-incident outputs: - contextPath: NetWitness.Incidents.id description: The unique identifier of the incident. type: Unknown - contextPath: NetWitness.Incidents.title description: Title of the incident. type: Unknown - contextPath: NetWitness.Incidents.summary description: Summary of the incident. type: Unknown - contextPath: NetWitness.Incidents.priority description: The incident priority. type: Unknown - contextPath: NetWitness.Incidents.riskScore description: Incident risk score calculated based on associated alert's risk score. Risk score ranges from 0 (no risk) to 100 (highest risk). type: Unknown - contextPath: NetWitness.Incidents.status description: The current status. type: Unknown - contextPath: NetWitness.Incidents.alertCount description: Number of alerts associated with the Incident. type: Unknown - contextPath: NetWitness.Incidents.averageAlertRiskScore description: Average risk score of the alerts associated with the incident. type: Unknown - contextPath: NetWitness.Incidents.sealed description: Indicates if additional alerts can be associated with an incident. type: Unknown - contextPath: NetWitness.Incidents.totalRemediationTaskCount description: The number of total remediation tasks for the incident. type: Unknown - contextPath: NetWitness.Incidents.openRemediationTaskCount description: The number of open remediation tasks for the incident. type: Unknown - contextPath: NetWitness.Incidents.created description: The timestamp of when the incident is created. type: Unknown - contextPath: NetWitness.Incidents.lastUpdated description: The timestamp of when the incident was last updated. type: Unknown - contextPath: NetWitness.Incidents.lastUpdatedBy description: The NetWitness user identifier of the user who last updated the incident. type: Unknown - contextPath: NetWitness.Incidents.assignee description: The NetWitness user identifier of the user currently working on the incident. type: Unknown - contextPath: NetWitness.Incidents.sources description: Unique set of sources for all of the Alerts in the incident. type: Unknown - contextPath: NetWitness.Incidents.ruleId description: The unique identifier of the rule that created the incident. type: Unknown - contextPath: NetWitness.Incidents.firstAlertTime description: The timestamp of the earliest occurring Alert in this incident. type: Unknown - contextPath: NetWitness.Incidents.categories.id description: The unique category identifier. type: Unknown - contextPath: NetWitness.Incidents.categories.parent description: Parent name of the category. type: Unknown - contextPath: NetWitness.Incidents.categories.name description: Friendly name of the category. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.id description: The unique journal entry identifier. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.author description: The author of this entry. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.notes description: Notes and observations about the incident. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.created description: The timestamp of the journal entry created date. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.lastUpdated description: The timestamp of the journal entry last updated date. type: Unknown - contextPath: NetWitness.Incidents.journalEntries.milestone description: Incident milestone classifier. type: Unknown - contextPath: NetWitness.Incidents.createdBy description: The NetWitness user id or name of the rule that created the incident. type: Unknown - contextPath: NetWitness.Incidents.deletedAlertCount description: The number of alerts that are deleted from theincident. type: Unknown - contextPath: NetWitness.Incidents.eventCount description: Number of events associated with incident. type: Unknown - contextPath: NetWitness.Incidents.alertMeta.SourceIp description: Unique source IP addresses. type: Unknown - contextPath: NetWitness.Incidents.alertMeta.DestinationIp description: Unique destination IP addresses. type: Unknown - arguments: - description: The incident id name: incidentId required: true description: Delete a specific incident, by its id. name: netwitness-delete-incident - arguments: - description: The incident id name: incidentId required: true description: Get all the alerts related to a specific incident. name: netwitness-get-alerts outputs: - contextPath: NetWitness.Alerts.id description: The unique alert identifier. type: Unknown - contextPath: NetWitness.Alerts.incidentId description: The incident id associated with the alert. type: Unknown - contextPath: NetWitness.Alerts.title description: The title or name of the rule that created the alert. type: Unknown - contextPath: NetWitness.Alerts.detail description: The details of the alert. This can be the module name or meta that the module included. type: Unknown - contextPath: NetWitness.Alerts.created description: The timestamp of the alert created date. type: Unknown - contextPath: NetWitness.Alerts.source description: The source of this alert. For example, "Event Stream Analysis", "Malware Analysis", etc. type: Unknown - contextPath: NetWitness.Alerts.riskScore description: The risk score of this alert, usually in the range 0 - 100. type: Unknown - contextPath: NetWitness.Alerts.type description: Type of alert, "Network", "Log", etc. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.ipAddress description: The IP address. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.port description: The port. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.macAddress description: The ethernet MAC address. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.dnsHostname description: The DNS resolved hostname. type: Unknown - contextPath: NetWitness.Alerts.events.source.device.dnsDomain description: The top-level domain from the DNS resolved hostname type: Unknown - contextPath: NetWitness.Alerts.events.source.user.username description: The unique username. type: Unknown - contextPath: NetWitness.Alerts.events.source.user.emailAddress description: An email address. type: Unknown - contextPath: NetWitness.Alerts.events.source.user.adUsername description: An Active Directory (AD) username. type: Unknown - contextPath: NetWitness.Alerts.events.source.user.adDomain description: An Active Directory (AD) domain type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.ipAddress description: The IP address. type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.port description: The port. type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.macAddress description: The ethernet MAC address. type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.dnsHostname description: The DNS resolved hostname. type: Unknown - contextPath: NetWitness.Alerts.events.destination.device.dnsDomain description: The top-level domain from the DNS resolved hostname type: Unknown - contextPath: NetWitness.Alerts.events.destination.user.username description: The unique username. type: Unknown - contextPath: NetWitness.Alerts.events.destination.user.emailAddress description: An email address. type: Unknown - contextPath: NetWitness.Alerts.events.destination.user.adUsername description: An Active Directory (AD) username. type: Unknown - contextPath: NetWitness.Alerts.events.destination.user.adDomain description: An Active Directory (AD) domain type: Unknown isfetch: true runonce: false script: '-' subtype: python2 type: python dockerimage: demisto/python:2.7.18.27799 tests: - RSA NetWitness Test fromversion: 5.0.0