NetWitness (v3.2.14)
NetWitness Platform provides systems Logs, Network, and endpoint visibility for real-time collection, detection, and automated response with the Demisto Enterprise platform. Providing full session analysis, customers can extract critical data and effectively operate security operations automated playbook.
- Author
- Netwitness
- Support
- partner
- URL
- https://www.netwitness.com/services/technical-support/
- Categories
- Analytics & SIEM
Incident fields (7)
- RSA Alert Count
- RSA Alerts
- RSA Event Count
- RSA Id
- RSA Metas Events
- RSA Raw Logs List
- RSA Rule Id
Integrations (2)
- RSA NetWitness v11.1 (Deprecated)
- RSANetWitness v11.5
Layouts (1)
- RSA NetWitness Layout
Scripts (3)
- RSA_DisplayMetasEvents
- RSA_GetRawLog
- SetRSANetWitnessAlertsMD
README
RSA NetWitness provides your security team with the visibility it needs to detect sophisticated threats to your system. It collects and analyzes data across all capture points and computing platforms enriching data with threat intelligence and business context.
What does this pack do?
- Isolate/unisolate infected endpoints.
- Get alerts triggered for a given host.
- Retrieve the alerts that are associated with an incident.
- List, update, remove incidents.
- Get snapshots for a given host.
- List all related file information from a specific endpoint server and downloading files.
- Scan a host.
Note: Support for this Pack moved to the partner on 04, 17, 2024.
Please contact the partner directly via the support link on the right.