RSANetWitnessv115

The RSA NetWitness integration provides system log, network, and endpoint visibility for real-time collection, detection, and automated response with the Cortex XSOAR Enterprise platform. Using full session analysis, customers can extract critical data and effectively run security operations automated playbooks.

Analytics & SIEM · NetWitness

Configuration parameters

  • url — Server URL (e.g https://192.168.0.1) (required)
  • credentials — User name (required)
  • service_id — Service Id
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • max_fetch — Fetch Limit
  • first_fetch — Fetch Time
  • import_alerts — On 'Fetch incidents' import all alerts related to the incident
  • max_alerts — Alerts Limit
  • incidentType — Incident type
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • mirror_direction — Incident Mirroring Direction
  • close_incident — Close Mirrored XSOAR Incident
  • max_mirror_time — Mirroring Days Limit

Commands (26)

  • endpoint

    Retrieves host information for a specific endpoint. To use this command, service ID must be set in the integration configuration.

  • get-mapping-fields

    Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.

  • get-modified-remote-data

    Gets the list of incidents and detections that were modified since the last update time. This method is used for debugging purposes.

  • get-remote-data

    Gets data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.

  • rsa-nw-endpoint-isolate-from-network

    Isolates the host with the specified agent ID from the network.

  • rsa-nw-endpoint-isolation-remove

    Restores the network connection and removes IP addresses added to the exclusion list for the host with the specified agent ID.

  • rsa-nw-endpoint-update-exclusions

    Updates the network isolation exclusion list for the host with the specified agent ID.

  • rsa-nw-file-alerts-list

    Gets all alerts triggered for a given file.

  • rsa-nw-file-download

    Initiate file download for a single file or multiple files to the endpoint server.

  • rsa-nw-files-list

    Lists all related file information from a specific endpoint server. You can limit the results using the limit argument or the page size argument.

  • rsa-nw-host-alerts-list

    Gets all alerts triggered for a given host.

  • rsa-nw-hosts-list

    Lists all host information from a specific endpoint server. Filter the results using the supplied arguments (can be a list) or use the 'filter' argument. You can limit the results using the limit argument or the page size argument.

  • rsa-nw-incident-add-journal-entry

    Add a journal entry to an existing incident.

  • rsa-nw-incident-list-alerts

    Retrieves all the alerts that are associated with an incident based on the incident ID. you can limit the results using the limit argument or the page size argument.

  • rsa-nw-list-incidents

    Retrieves a single incident by ID or multiple incidents by the date and time they were created using the start time ('since') or end time ('until'). You can limit the results using the limit argument or the page size argument. If no arguments are entered the last 50 results are returned.

  • rsa-nw-mft-download-request

    Initiates the MFT download to the endpoint server.

  • rsa-nw-process-dump-download-request

    Initiates the download of the process dump to the endpoint server. You can find the process details by using the 'rsa-nw-snapshot-details-get' and filter by category=PROCESSES, or use the RSA NW UI.

  • rsa-nw-remove-incident

    Remove a single incident using the incident's unique identifier.

  • rsa-nw-scan-request

    Starts a scan for the host with the specified agent ID. Each scan produces a snapshot, the full details can be seen using the 'rsa-nw-snapshot-details-get' command.

  • rsa-nw-scan-stop-request

    Stop a scan for the host with the specified agent ID.

  • rsa-nw-services-list

    Retrieves a list of all services, or filter by name.

  • rsa-nw-snapshot-details-get

    Provides snapshot details of the given host for the specified snapshot time. It is recommended to use categories to filter the results since this command returns a large amount of data.

  • rsa-nw-snapshots-list-for-host

    Retrieve a list os snapshot IDs for a given host.

  • rsa-nw-system-dump-download-request

    Initiates the download of the system dump to the endpoint server.

  • rsa-nw-update-incident

    Updates incident status and assignee.

  • update-remote-system

    Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.