RSA NetWitness v11.1

Deprecated. Use RSA NetWitness v11.5 instead

Category

Analytics & SIEM

Pack

RSANetWitness_v11_1

Configuration parameters

• server — Server URL (e.g. https://192.168.0.1:30022) (required)
• credentials — Credentials (required)
• version — API version
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• isFetch — Fetch incidents
• incidentType — Incident type
• importAlerts — On 'Fetch incidents' import all alerts related to the incident
• fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• fetch_limit — Fetch limit: the maximum number of incidents to fetch

Commands (5)

• netwitness-delete-incident — Delete a specific incident, by its id.
• netwitness-get-alerts — Get all the alerts related to a specific incident.
• netwitness-get-incident — Get details of a specific incident, including all alerts related with the incident.
• netwitness-get-incidents — Get a list of incidents in a specific time frame. One of the followings must be specified: since, until, lastDays
• netwitness-update-incident — Update a specific incident. Currently, an incident's status and assignee may be modified