RSANetWitnessv115

The RSA NetWitness integration provides system log, network, and endpoint visibility for real-time collection, detection, and automated response with the Cortex XSOAR Enterprise platform. Using full session analysis, customers can extract critical data and effectively run security operations automated playbooks.

Category

Analytics & SIEM

Pack

RSANetWitness_v11_1

Configuration parameters

• url — Server URL (e.g https://192.168.0.1) (required)
• credentials — User name (required)
• service_id — Service Id
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)
• max_fetch — Fetch Limit
• first_fetch — Fetch Time
• import_alerts — On 'Fetch incidents' import all alerts related to the incident
• max_alerts — Alerts Limit
• incidentType — Incident type
• isFetch — Fetch incidents
• incidentFetchInterval — Incidents Fetch Interval
• mirror_direction — Incident Mirroring Direction
• close_incident — Close Mirrored XSOAR Incident
• max_mirror_time — Mirroring Days Limit

Commands (26)

• endpoint — Retrieves host information for a specific endpoint. To use this command, service ID must be set in the integration configuration.
• get-mapping-fields — Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
• get-modified-remote-data — Gets the list of incidents and detections that were modified since the last update time. This method is used for debugging purposes.
• get-remote-data — Gets data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
• rsa-nw-endpoint-isolate-from-network — Isolates the host with the specified agent ID from the network.
• rsa-nw-endpoint-isolation-remove — Restores the network connection and removes IP addresses added to the exclusion list for the host with the specified agent ID.
• rsa-nw-endpoint-update-exclusions — Updates the network isolation exclusion list for the host with the specified agent ID.
• rsa-nw-file-alerts-list — Gets all alerts triggered for a given file.
• rsa-nw-file-download — Initiate file download for a single file or multiple files to the endpoint server.
• rsa-nw-files-list — Lists all related file information from a specific endpoint server. You can limit the results using the limit argument or the page size argument.
• rsa-nw-host-alerts-list — Gets all alerts triggered for a given host.
• rsa-nw-hosts-list — Lists all host information from a specific endpoint server. Filter the results using the supplied arguments (can be a list) or use the 'filter' argument. You can limit the results using the limit argument or the page size argument.
• rsa-nw-incident-add-journal-entry — Add a journal entry to an existing incident.
• rsa-nw-incident-list-alerts — Retrieves all the alerts that are associated with an incident based on the incident ID. you can limit the results using the limit argument or the page size argument.
• rsa-nw-list-incidents — Retrieves a single incident by ID or multiple incidents by the date and time they were created using the start time ('since') or end time ('until'). You can limit the results using the limit argument or the page size argument. If no arguments are entered the last 50 results are returned.
• rsa-nw-mft-download-request — Initiates the MFT download to the endpoint server.
• rsa-nw-process-dump-download-request — Initiates the download of the process dump to the endpoint server. You can find the process details by using the 'rsa-nw-snapshot-details-get' and filter by category=PROCESSES, or use the RSA NW UI.
• rsa-nw-remove-incident — Remove a single incident using the incident's unique identifier.
• rsa-nw-scan-request — Starts a scan for the host with the specified agent ID. Each scan produces a snapshot, the full details can be seen using the 'rsa-nw-snapshot-details-get' command.
• rsa-nw-scan-stop-request — Stop a scan for the host with the specified agent ID.
• rsa-nw-services-list — Retrieves a list of all services, or filter by name.
• rsa-nw-snapshot-details-get — Provides snapshot details of the given host for the specified snapshot time. It is recommended to use categories to filter the results since this command returns a large amount of data.
• rsa-nw-snapshots-list-for-host — Retrieve a list os snapshot IDs for a given host.
• rsa-nw-system-dump-download-request — Initiates the download of the system dump to the endpoint server.
• rsa-nw-update-incident — Updates incident status and assignee.
• update-remote-system — Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.