RSA NetWitness Layout

NetWitness Incident

Details

IDRSA NetWitness Layout
Groupincident
Version-1
From Version6.0.0

Layout Structure

Legacy Summary 0 sections

No sections defined.

Incident Info 11 sections

Case Details

Field IDPosition
type Col 0-2, Height: 22
severity Col 0-2, Height: 22
sourcepriority Col 0-2, Height: 22
owner Col 0-2, Height: 22
sourcebrand Col 0-2, Height: 22
sourceinstance Col 0-2, Height: 22
playbookid Col 0-2, Height: 22

Notes

Work Plan

Linked Incidents

Child Incidents

Evidence

Team Members

Indicators

Timeline Information

Field IDPosition
occurred Col 0-1, Height: 53
dbotmodified Col 0-1, Height: 53
dbotduedate Col 0-2, Height: 53
dbotcreated Col 1-2, Height: 53
dbotclosed Col 1-2, Height: 53

Closing Information

Field IDPosition
dbotclosed Col 0-2, Height: 22
closereason Col 0-2, Height: 22
closenotes Col 0-2, Height: 22

Investigation Data

Field IDPosition
details Col 0-2, Height: 106
SIEM 5 sections

Case

Field IDPosition
rsaid Col 0-2, Height: 22
description Col 0-2, Height: 22
sourcecategory Col 0-2, Height: 22
sourcecreatedby Col 0-2, Height: 22
lastmodifiedon Col 0-2, Height: 22
lastmodifiedby Col 0-2, Height: 22
firstseen Col 0-2, Height: 22
incidentlink Col 0-2, Height: 22

Details

Field IDPosition
rsaruleid Col 0-2, Height: 22
rsaalertcount Col 0-2, Height: 22
rsaeventcount Col 0-2, Height: 22
riskscore Col 0-2, Height: 22
sourceip Col 0-2, Height: 22
destinationip Col 0-2, Height: 22

RSA Logs

Field IDPosition
rsarawlogslist Col 0-6, Height: 106

RSA Metas Event

RSA Alerts

War Room 0 sections

No sections defined.

Work Plan 0 sections

No sections defined.

Evidence Board 0 sections

No sections defined.

Related Incidents 0 sections

No sections defined.

Canvas 0 sections

No sections defined.