RSA NetWitness Endpoint
RSA NetWitness Endpoint provides deep visibility beyond basic endpoint security solutions by monitoring and collecting activity across all of your endpoints on and off your network. The RSA Demisto integration provides access to information about endpoints, modules and indicators.
- Category
- Endpoint
- Pack
- RSANetWitnessEndpoint
Configuration parameters
- server — Server URL (e.g. https://192.168.0.1:30022) (required)
- credentials — Username
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
Commands (7)
- netwitness-blacklist-domains — Add a list of domains to block list
- netwitness-blacklist-ips — Add a list of IP addresses to block list
- netwitness-get-machine — Get information on a specific machine.
- netwitness-get-machine-iocs — List IOC's for a specific machine.
- netwitness-get-machine-module — Get information on a specific machine module.
- netwitness-get-machine-modules — Get Names and ID's of modules of the machine. Filter by name or IOC score.
- netwitness-get-machines — Get machine GUID. Search by machine name and more.